Joomla 2.5 Menu Item Access Level Security Bug - Joomla! Forum - community, help and support

hi there!

while working jomsocial support (fuqaha) have noticed joomla 2.5 menu item seems bypass security set on when &itemid removed url. example:

- created menu item called testing in main menu , set access level registered , link article called testing article access set public
- in frontend, testing menu item not shown until logged in
- if use url go directly article:

code: select all

index.php?option=com_content&view=article&id=1&itemid=264

joomla prompt me login

- if remove itemid in url can view article , not supposed happen.

code: select all

index.php?option=com_content&view=article&id=1

i tested joomla 1.5, security on menu item access level kicks in regardless of adding itemid or not in url supposed be.

so guess bug , security issue

if happen say, i'd see problem - me, menu should control access article, rather having explicitly set every article under menu registered (i'm assuming stop article displaying under circumstances you've described).

i suppose it's difficult article unless know it's there (you know article number), you'd unlikely find accident, wouldn't difficult build exploit this. also, once pages indexed in google, if clicked link , blocked access menu, you've described above.

mick.