Hi,

I see what you mean.

The issue is that query macro in Document types property of repeater is resolved and as a string value seems to be correct. But this classname obviously does not exist -> error. I will inform our security department to change documentation of print page creation.

As a workaround:

In case you use the page to print only specific document type or document types with common field names, you could simply define Document type property manually, i.e. without macro.

Instead you could define where property, something like:

DocumentID={%documentID%}

In other words, you would sent documentID to the print page instead of classname,

This way the attacker could see document or nothing. Of course he could guess ID and display documents which he should not see.

Another option is to create a custom macro and use it in Document type property. In this macro you could check if provided class name really exists and if not return "cms.root" class.

How to create a custom macro is described here:
Types of macro

In case you will need more information about second option please let us know.

Thank you also for letting us know about the issue.

Best regards,
Ivana Tomanickova