Server configuration:
Server: Windows 2008 SP2
MapGuide Enterprise 2011 installed in IIS7. Aspnet
Viewer: AJAX
When the user tries to change the color of the buffer zone in a basic weblayout, there is an authentication request to the MapGuide on url:
http://server/mapguide2011/mapviewerajax/colorpicker.aspx?LOCALE=fr&CLR=ff0000&ALLOWTRANS=0&TRANS=0
If the user does not authenticate, it can still change the color.
I do not understand where does this security problem. Web Sharing is with anonymous user IUSR. The latter is in full control permissions on NTFS.
Thank you in advance for your answers.
