[
http://jira.magnolia.info/browse/MAGNOLIA-2388?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116#action_18116
]
Fabrizio Giustina commented on MAGNOLIA-2388:
---------------------------------------------
great, I agree on all but I still only have one concern about:
{quote}
create a specific dialog for user preferences, without the group/role selector
yes, but I would prefer not to change this for 3.6.2, but to do it on major
version (e.g. 3.7 - current trunk) instead
Since this is intended for end users (editors, not magnolia administrators) I
am pretty scared also by the fact that users can easily lock themselves out
using a similar dialog. There is no security involved here, only people that
may click on that "remove" button near to the "roles" thing in the dialog (also
checking the disable checkbox, but that's to explicit also for a dummy user)...
it's just a sort of self-destroy button if consider a kind of user which
neither know what roles are in magnolia since they always only took care of
editing contents. I think it could be just a little more user friendly to not
to give them such power :)
{quote}
We also need to take care admin user still has such a dialog available and it
is unreachable for ordinary user even if they know the url to access it
directly. ... We also need to decide what makes user privileged enough to
access such dialog.
what about just creating a simpler dialog for 3.6.2 and leave the other stuff
(make the ordinary one unreachable for ordinary users) for 3.7? Should be a
simple thing and doesn't changes anything we had in 3.6.1.
(ps: I am still worried about the fact that users have write access to their
own acls at repository level but I agree that this could be problematic to do
in 3.6.2. We should only carefully check that there is really no way for
anybody to inject a role uuid there...)
> Easy privilege escalation from user preferences
> -----------------------------------------------
>
> Key: MAGNOLIA-2388
> URL: http://jira.magnolia.info/browse/MAGNOLIA-2388
> Project: Magnolia
> Issue Type: Bug
> Components: security
> Affects Versions: 3.6.2
> Reporter: Fabrizio Giustina
> Assignee: Fabrizio Giustina
> Priority: Blocker
> Fix For: 3.6.2
>
>
> This is a leftover from MAGNOLIA-574 : since the task was closed ignoring my
> comments and no other task is listed for 3.6.2 I am adding this as a separate
> issue since IMHO magnolia 3.6.2 can't be released as is now...
> After the change in MAGNOLIA-574 and related now every user (at least with a
> read only access to the user repository) can self-change its role to
> superuser using the preference dialog linked to the user name.
> Just create a user with a editor role and readonly access to userroles: he
> can just type "/superuser" in its preference dialog to gain full access.
> The are multiple issues/tasks associated to this:
> - user should not be have read/write permissions to the acls by default, this
> should be strictly forbidden unless explicitely added by a superuser
> - the preference box dialog should not list group/roles (it makes no sense,
> just name me another app where users have a similar thing in their preference
> page!)
> - a bug in the bug: if the user enters a role he doesn't have read rights for
> in the preference page the user node gets corrupted and can't be edited
> anymore
> as previously discussed, IMHO a better solution would be allowing only
> readonly access to own user node by default and using a custom save handler
> for the preference page which allow editing of checked properties using a
> system operation. User preferences should use obviously a different dialog
> from the standard user edit dialog.
> Nobody else cares about this?
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.magnolia.info/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
----------------------------------------------------------------
for list details see
http://documentation.magnolia.info/
----------------------------------------------------------------
