| When user tries to see a page where he/she has no view right the navigation menu on the left does not show the current page. But if the page does not exist at all the navigation menu inserts a "placeholder" with the page name. Also the error message when trying to view a page where the user has no view right is "You are not allowed to view this page or perform this action." whereas on a page that doesn't exists it's "The requested page could not be found." and displays a list of alternative existing pages. This behavior allows the user to probe which pages exist on the wiki even though he/she has no view right on them. This could leak sensitive information. |
