Sometimes private collections are visible to admins #3454
Comments
|
It was recently changed so that admins have read permissions to collections if the id is known, so I suspect this is related – although it is indicative of a possible wider bug where permissions are not correctly propagated perhaps? Ideally we'd allow admins to see the existence and manage private collections but not read the content without being added explicitly as a member either by themselves or someone else. This will mean separating the permission that currently encompasses both. |
|
Right, I had noticed that read access was granted to admins given the full url. Nonetheless, this happened while I was in another document/collection, and I had not previously accessed this private collection, it just showed up on my sidebar. I will try to reproduce this in the next couple of days, and keep you posted. |
|
This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days |
|
Automatically closed due to inactivity |
|
I just experience this bug. Another admin created a collection with "No Access", and only themselves added with Read/Write Permissions. I was able to see this collection for a few minutes and then it disappeared... As an Admin/User, I still do not want to see everyones private collections, as this makes my end user experience terrible. |
|
Also, if there is a collection with view-only default permission, I can edit its pages, even if I don't have explicit edit permission. It is a bit inconsistent. However, as an admin, there are cases where I wan't to see all of the collections (even private ones). |
I've experienced this issue twice: a non admin user creates a collection and removes read and write access to all (making the collection private). Now, me, as an admin user, logged into our self deployed Outline and was able to see this user's private collection and documents. After refreshing the page, the collection was no longer visible to me.
To Reproduce
I don't know yet... We've only experienced this issue twice in the last month without any clear reproduction steps. I will keep a look out in our dev environment to try to catch it in the logs.
Expected behavior
Private documents should not be visible to anyone, including admin users.
Outline (please complete the following information):
Desktop (please complete the following information):
The text was updated successfully, but these errors were encountered: