• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use View topic Item7848 for generic doc work for TWiki-6.1.1. Use View topic Item7851 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
Does this site look broken?. Use the LitterTray web for test cases.

Item5008: If you register someone you are magically logged in as them

Item Form Data

AppliesTo: Component: Priority: CurrentState: WaitingFor: TargetRelease ReleasedIn
Engine TWikiUserMapping Normal Closed   minor 4.2.0

Edit Form Data

Summary:
Reported By:
Codebase:
Applies To:
Component:
Priority:
Current State:
Waiting For:
Target Release:
Released In:
 

Detail

From Item4771

The minor issue is that after registering someone else I am sort of "logged in" as this someone else, at least in the left bar. Probably this happens because the cookie "login state" is changed after registration to whoever has registered. It is straightened out as soon as I edit something, because edit wants genuine authentication and starts with $ENV{REMOTE_USER}. Maybe this should go to an extra bug item.

-- TWiki:Main.HaraldJoerg - 20 Nov 2007

as to the 'minor' issue, y, thats been bugging me (conceptually) for a few weeks, and I'm trying to figure out why we can't remove that, forcing users to actually log in after they have completed registration (or in your senario, they have already logged in)

There are 2 possible fixes:

  • if you are already authenticated, and you register, you remain as the user you are authenticated as
  • whenever a user completes the registration process, they Then have to authenticate, thus proving that their registration was less likely to have been hijacked.

I've done the first, but the second seems like a more complete fix.

-- TWiki:Main/SvenDowideit - 23 Nov 2007

thanks to all of you for working on this, i am glad that this has been found as a "bug". actually this is not a "minor" issue: as an admin, i often register for the new users, then go back to my own work, ... oops, then i found that i have edited some pages -- on behalf of the new user !! -- Edward Tam

-- TWiki:Main.EdwardTam - 07 Jan 2008

ItemTemplate
Summary If you register someone you are magically logged in as them
ReportedBy TWiki:Main.SvenDowideit
Codebase 4.2.0, ~twiki4
SVN Range TWiki-4.3.0, Thu, 15 Nov 2007, build 15610
AppliesTo Engine
Component TWikiUserMapping
Priority Normal
CurrentState Closed
WaitingFor

Checkins TWikirev:15698 TWikirev:15699
TargetRelease minor
ReleasedIn 4.2.0
Edit | Attach | Watch | Print version | History: r6 < r5 < r4 < r3 < r2 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r6 - 2008-01-22 - KennethLavrsen
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2018 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback