I'm looking for a part-time remote job.

Hire me


I'm the author of:

Mastering Redmine is a comprehensive guide with tips, tricks and best practices, and an easy-to-learn structure.

Check the book's project or

Buy the book

Social pages of the book:

By buying this book you also donate to Redmine (see this page).


Follow me:

Bug #2045

Manual account registration vs automatic openid registration.

Added by Rostislav Šimoník almost 9 years ago. Updated about 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Start date:
07 Jun 2012
Due date:
07 Feb 2013
% Done:

100%

Redmine version:
External issue:

Description

Hello,
I would like warn you that your fix doesn’t follow original approvement of account as here

case Setting.self_registration
when '1'
    register_by_email_activation(user) do
        onthefly_creation_failed(user)
    end
when '3'
    register_automatically(user) do
        onthefly_creation_failed(user)
    end
else
    register_manually_by_administrator(user) do
        onthefly_creation_failed(user)
    end
end

but you instead changed default behavior that it automatically accepts the account,


case Setting.self_registration
when '2'
    register_manually_by_administrator(user) do
        onthefly_creation_failed(user)
    end
else
    register_automatically(user) do
        onthefly_creation_failed(user)
    end
end

which leads in future upgrades (for example they change self_registration code for manual approvement to something different than 2) to possibility of future exploit (it will automatically gives access to redmine).

By my opinion default behavior should be manual acceptance by administrator.

Associated revisions

Revision 7 (diff)
Added by Andriy Lesyuk about 8 years ago

Added self-registration configuration, restored the registration behavior (#2045)

History

#1 Updated by Andriy Lesyuk over 8 years ago

  • Target version set to 0.1.0

#2 Updated by Andriy Lesyuk about 8 years ago

  • Due date set to 07 Feb 2013
  • Status changed from New to Closed
  • Assignee set to Andriy Lesyuk
  • % Done changed from 0 to 100

Thanks for reporting!

Also available in: Atom PDF

Terms of use | Privacy policy