This issue is described in an awful and useless misleading way; if I didn't know the reporter I would believe it's done on purpose.
anybody who can access the wiki can read the favorites of anyone.
no, anybody who can access the user profile can read the favorites of that user profile.
and users profiles are world-readable
No, this is uselessly simplistic; the default access rights of an XWiki are set in such a way that user profiles inherit the view right settings from the wiki level. It's not hard to "close" a wiki from a non-logged in access, for example.
And finally, it's not really clear to me how is this a problem that is different / larger than the problem of the access to user profiles in general - does it really make a lot of sense to have some level of access to the user meta-data and another level of access to their favorites? I'm sure there is more than a usecase where this is needed, but is it a majority?
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
