Workflow visibility between users in Share

[dhd]

Hi,

As far as I understand it, there is nothing to stop users seeing each other's workflows as created in Share.

For example, if you have 2 Share users userA, userB (who are not members of any sites), userA can create an ad-hoc task (assigned to himself, say), details of which might be accessible at:

  http://mysite.com/share/page/workflow-details?workflowId=activiti$684&referrer=workflows&myWorkflows...

If userB logs in and he either knows (or guesses) the workflowId, then he can see details of the workflow even though he has nothing to do with it.

My question is: is this a "by design" thing? i.e. are workflows considered global things with no permissions mechanism or concept of privacy?

Cheers,
David

[mitpatoliya]

workflow id is randomly generated number so I do not think it can be guessed easily and to answer you question this is not "by design" thing. User whom task is assigned can only see the workflow details.

[dhd]

Thank you for your reply.

workflowIds cannot be guessed easily, however someone might try to discover them with a script, say.

What I meant by "by design" was is it an acknowledged and accepted feature that the system is like this, i.e. userB can see details of userA's workflow if he can guess or find out the workflowId, even if he himself (i.e. userB) has nothing to do with the workflow.