Security hole in Razuna: restricted user may upload or mail original asset

1

Hi,
A security hole was found in Razuna: restricted user not being member of any group cannot download original asset, but can upload it to FTP and email it.

2

We are looking into it and if an error is found we will surely fix it for the 1.7.1 release.

Thank you for reporting this and making Razuna better.

3

Hi,
Can you please provide specific steps on how to re-produce this?

Best
Harkirat

4

Add asset to shared folder, set “original not downloadable”, make a rendition (I haven’t tried without a rendition), re-login as restricted user (no groups), go to folder, select asset, go to details, select ftp or mail and you may select original and mail or upload it.