| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000109 | WackoWiki | action | public | 2007-10-14 12:38 | 2009-08-19 09:39 |
| Reporter | adrianw | Assigned To | Tann San | ||
| Priority | normal | Severity | feature | Reproducibility | have not tried |
| Status | resolved | Resolution | fixed | ||
| Product Version | 4.2 | ||||
| Target Version | 4.3.rc | Fixed in Version | 4.3.rc | ||
| Summary | 0000109: Security issue with {{usergroups}} action | ||||
| Description | 19-04-2005 23:23 adrianw Thank you for the usergroups action However there is a possible exposure. To avoid repeated editing of the Config file I usually add several users to a group at the same time. I can do this before the users register. Then as soon as they register, they have the appropriate group permissions. However, now anyone can use the {{usergroups}} action and check for any names who have not yet registered. Then this person could register with the name he found in the {{usergroups}} listing and gain access to resources he is not supposed to see. I suggest the following changes to the {{usergroups}} action: 1. for admins - output as at present 2. for registered users - list the group names but only list the members of the groups that I already belong to 3. for unregistered users - no output. | ||||
| Tags | No tags attached. | ||||
- Anonymous
