Tooltip message for Enable Directory Indexing is not correct

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, 7.1.X, Master
• Fix Version/s: 7.0.0 DXP FP70, 7.0.X, 7.1.10 DXP FP5, 7.1.10.1 SP1, 7.1.2 CE GA3, 7.1.X, Master
• Component/s: Documents & Media, Translations
• Labels:
  • ee-ts
  • liferay-dxp-70-sp10
  • liferay-dxp-71-sp1
  • liferay-fixpack-de-70-7010
  • liferay-fixpack-dxp-5-7110
• Branch Version/s:
  7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Story Points: 0.25
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/65730
• QA Test Name:
  • dont-test-again

Steps to reproduce:

1. Log in as Admin
2. Create a new site (eg: Test)
3. After you click Save, Documents and Media section will apear in the bottom of settings
4. Check tooltip for Enable Directory Indexing

If this is checked, the site administrator can browse the site's document library files and folders. For example, the site administrator for Test can browse documents at http://localhost:8080/documents/test1.

 

Based on this message, you would understand that only site admins can browse the DL files and folders. However, when directory indexing is enabled, document libraries are browsable through the URL not only for site admins but for anyone according to the default Document Library permissions. This is a security risk as per OWASP: https://www.owasp.org/index.php/File_System#Insecure_Indexing

It may be considered changing the tooltip message to reflect this risk.