From: https://social.mayfirst.org/mjray Date: Mon, 5 Feb 2018 10:51:48 +0000 (-0400) Subject: Try to explain editor loophole to viewing restrictions X-Git-Tag: 3.20180228~15 X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/36bb1f6dc74bcd8d81e0f0471897d109e0bd5282 Try to explain editor loophole to viewing restrictions --- diff --git a/doc/todo/Restrict_page_viewing.mdwn b/doc/todo/Restrict_page_viewing.mdwn index 20b59cb13..d40cee6d1 100644 --- a/doc/todo/Restrict_page_viewing.mdwn +++ b/doc/todo/Restrict_page_viewing.mdwn @@ -40,3 +40,7 @@ much more maintainable htaccess file. >>>>> If you use the httpauth and the cgiauthurl method, you can restrict a path >>>>> like /private/* to be accessible only under the authenticated request uri. + +>>>>>> Note that if editing is enabled, then you should set the restriction in locked_pages too +>>>>>> or they may be able to view pages by editing the page= value in the editor's +>>>>>> query string. --[mjr](http://mjr.towers.org.uk/)