Security hole with collections

[Starlionblue 80]

I have some movies in multiple languages for my kids. Swedish Kids Movies and English Kids Movies are in different media folders.

 

I currently have MB set so the kids user only has access to the Swedish Kids Movies media folder (want them to improve their Swedish this summer). The user does not have access to the Collections media folder. Here's where it gets a bit weird. 

 

I have Madagascar 2 in Swedish and English. If I play Madagascar 2, all is fine and I get the Swedish one as expected.

 

However Madagascar 2 is part of the Madagascar collection, which shows up in MediaBrowser. I can see and play the other movies in the collection, even if they are in a media folder that the user does not have access to. Again, the user does not have access to the Collections media folder.

 

Testing on different platforms:

• MBT. Bug exists. Collections show up and movies in "forbidden" media folders can be played.
• MB for iPad. Bug exists. Collections show up and movies in "forbidden" media folders can be played.
• MBC. Things work as they should. Collections do not show up.
• MB Mobile for iPhone. Things work as they should. Collections do not show up.
• MB Mobile for Windows Modern. Things work as they should. Collections do not show up.

Edited June 30, 2014 by Starlionblue

[Starlionblue 80]

Anyone else have this? IMHO it is a rather serious user security hole.

[Starlionblue 80]

Cheers. Let me know if you need logs or anything.

[kkhan 16]

Yes, I have noticed this as well

[Luke 37128]

Yes, thank you for reporting it.