** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability
** Changed in: mahara Importance: Undecided => Medium ** Changed in: mahara Milestone: None => 1.4.0 ** Changed in: mahara Status: Opinion => Confirmed -- You received this bug notification because you are a member of Mahara Contributors, which is subscribed to Mahara. https://bugs.launchpad.net/bugs/618634 Title: Disabled features are still accessible by visiting their URI directly Status in Mahara ePortfolio: Confirmed Bug description: If I disable a plugin (e.g. Resume), then the menu items for it disappear (correctly). However, if I visit the URI for that plugin (e.g. /artefact/resume) on my site, I can still access, view, modify and submit information stored within the artefact. Marking this as a security vulnerability because the plugin has been disabled but this is being circumvented. _______________________________________________ Mailing list: https://launchpad.net/~mahara-contributors Post to : mahara-contributors@lists.launchpad.net Unsubscribe : https://launchpad.net/~mahara-contributors More help : https://help.launchpad.net/ListHelp