Make profile information not avaialble for public when not shared
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | Mahara |
High
|
Aaron Wells | ||
| | 1.5 |
High
|
Aaron Wells | ||
| | 1.6 |
High
|
Aaron Wells | ||
| | 1.7 |
High
|
Aaron Wells | ||
Bug Description
From at least Mahara 1.6 on, very basic information about a user (profile picture, name, institution) is made public when public pages are allowed. This information is displayed even when the user hasn't shared their portfolio with the public. This came about when changes were made to the logged-in user profile access.
In the past (at least up to 1.4), you only saw the login screen when you tried to access a profile of a user but were not logged in. This should be the case again.
| Changed in mahara: | |
| milestone: | 1.8.0 → 1.7.0 |
| tags: | added: security |
| Changed in mahara: | |
| milestone: | 1.7.0 → 1.8.0 |
| Aaron Wells (u-aaronw) wrote : | #1 |
| tags: | added: bite-sized |
| Aaron Wells (u-aaronw) wrote : | #2 |
Used git bisect to trace this to https:/
Although, I think the intent of that feature was that *logged-in* users should still seem some basic information about the user. I still think it's a good idea if *logged-out* users can't see anything.
Reviewed: https:/
Committed: http://
Submitter: Robert Lyon (<email address hidden>)
Branch: master
commit 4ac8cb8fff64c43
Author: Aaron Wells <email address hidden>
Date: Tue Aug 20 19:02:19 2013 +1200
For private profiles, hide all profile information from logged-out users
Bug1158625: If the user hasn't made their profile public, don't even show their pic and name
to logged-out users.
And in order to prevent enumeration attacks, show the same access denied screen to a
logged-out user, whether they hit the URL for an exising profile or whether they entered
an invalid URL.
Change-Id: Ic926fde3e04a59
| Changed in mahara: | |
| status: | In Progress → Fix Committed |
| Changed in mahara: | |
| milestone: | 1.8rc1 → 1.8.0 |
| Mahara Bot (dev-mahara) wrote : | #5 |
Reviewed: https:/
Committed: http://
Submitter: Son Nguyen (<email address hidden>)
Branch: 1.5_STABLE
commit 3535ecd3e4ab820
Author: Aaron Wells <email address hidden>
Date: Tue Aug 20 19:02:19 2013 +1200
For private profiles, hide all profile information from logged-out users
Bug1158625: If the user hasn't made their profile public, don't even show their pic and name
to logged-out users.
And in order to prevent enumeration attacks, show the same access denied screen to a
logged-out user, whether they hit the URL for an exising profile or whether they entered
an invalid URL.
Change-Id: Ic926fde3e04a59
| Mahara Bot (dev-mahara) wrote : | #6 |
Reviewed: https:/
Committed: http://
Submitter: Son Nguyen (<email address hidden>)
Branch: 1.6_STABLE
commit 6490dda900d252c
Author: Aaron Wells <email address hidden>
Date: Tue Aug 20 19:02:19 2013 +1200
For private profiles, hide all profile information from logged-out users
Bug1158625: If the user hasn't made their profile public, don't even show their pic and name
to logged-out users.
And in order to prevent enumeration attacks, show the same access denied screen to a
logged-out user, whether they hit the URL for an exising profile or whether they entered
an invalid URL.
Change-Id: Ic926fde3e04a59
| Mahara Bot (dev-mahara) wrote : | #7 |
Reviewed: https:/
Committed: http://
Submitter: Son Nguyen (<email address hidden>)
Branch: 1.7_STABLE
commit fa6494a7ac8f088
Author: Aaron Wells <email address hidden>
Date: Tue Aug 20 19:02:19 2013 +1200
For private profiles, hide all profile information from logged-out users
Bug1158625: If the user hasn't made their profile public, don't even show their pic and name
to logged-out users.
And in order to prevent enumeration attacks, show the same access denied screen to a
logged-out user, whether they hit the URL for an exising profile or whether they entered
an invalid URL.
Change-Id: Ic926fde3e04a59
| Changed in mahara: | |
| status: | Fix Committed → Fix Released |
In order to avoid a username enumeration vulnerability on this, we should make sure that the message you see when trying to access a profile page you don't have access to, is the same as the message you see when trying to access a profile page that doesn't exist. This is especially true when clean urls are in place.
https:/