Currently any workflows/apps published to the gallery can be found via the search function - even when the particular user has no permission to this workflow/app. While this only allows for the non-permisssioned user to see the title, this could still leak information as it allows anyone to find apps published in someone's private gallery.
Both the Alteryx Public Gallery and the Private Gallery product are impacted by this. Additionally this is not just limited to logged in users, but also public viewers of the gallery.
My proposed idea:
- Force the search function to be permission aware, and only show a user workflows they have permission to see/execute.
- Allow for option 1 to be enabled/disabled if there are use cases where anyone should be able to search and find any app/workflow on the server.
Best regards,
Ryan
