Affiliates can see members of communities they are not in

[Jim B. Glenn]

I just found a security-related bug. I just logged in as my Affiliate
account (https://karl.soros.org/profiles/nkatinborland/), which is a
member of 2 communities, with just a few other users. However, when I
click on the People tab, 195 users show up. If I click on user, who is
not a member of one of the two communities, then I get a forbidden
message, but affiliates should only see people in their communities in
the first place. I have tested with several other Affiliate accounts
with the same result. Please look into why Affiliate users are seeing
non-members of their communities.

Thanks,

Nat

[Jim B. Glenn (jimbglenn)]

Nat reported in RT at: https://rt01.sixfeetup.com/Ticket/Display.html?id=80101

[Paul Everitt (paul-agendaless)]

Hi Chris. I'm going to mark this as "High" just for the part about investigation. Once we learn more about it, we might change it to medium.

[Chris Rossi (chris-archimedeanco)]

This was caused by profiles added via GSA getting improperly indexed. I have fixed this bug and created an evolve script to reindex the people directory after the fix is applied.

[JimPGlenn (jpglenn09)]

fixed