Re: RSS security

> It looks like the RSS feeds show everything, even from pages where  
> the user is not allowed to view.
>
> Are there any immediate plans to fix this?

Well... Considering that I didn't realize it until now I have no  
answer :-)

Can you file a bug, please?

> Is it possible to disallow some people from viewing the RSS feeds,  
> perhaps in the policies file?

RSS feeds are restricted using the "view" permission.  So if you  
can't view the page, you can't access the rss feed either.

BTW, global RSS feeds should be disabled, if you have view-restricted  
pages.  It's a file which gets generated... It might be a good idea  
to move to a dynamic model in that, I think...

/Janne