Bug 1150792 - Create user page can be used by any logged in user
Summary: Create user page can be used by any logged in user
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Zanata
Classification: Retired
Component: Component-UI
Version: 3.5
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: ---
Assignee: Carlos Munoz
QA Contact: Zanata-QA Mailling List
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-10-09 00:28 UTC by Damian Jansen
Modified: 2015-07-31 01:22 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-31 01:22:27 UTC
Embargoed:


Attachments (Terms of Use)

Description Damian Jansen 2014-10-09 00:28:47 UTC
Description of problem:
If a user signs in and goes to $server/zanata/profile/create, they can create a whole new user. This shouldn't generally be allowed.

Version-Release number of selected component (if applicable):
3.5

How reproducible:
Easy always

Steps to Reproduce:
1. Sign in
2. Go to 
3. $server/zanata/profile/create
4. Enter valid data for the fields, press Save

Actual results:
Assuming the username/email is unique, it will send a validation email and create a new user.

Expected results:
If the user is already validated, they should not be able to go to this page - it should redirect to their dashboard

Additional info:
If FAS is used for login, the user is presented with:
Error Validation failed for classes [org.zanata.model.security.HOpenIdCredentials] during persist time for groups [javax.validation.groups.Default, ] List of constraint violations:[ ConstraintViolationImpl{interpolatedMessage='{validator.unique}', propertyPath=, rootBeanClass=class org.zanata.model.security.HOpenIdCredentials, messageTemplate='{validator.unique}'} ]

Comment 1 Zanata Migrator 2015-07-31 01:22:27 UTC
Migrated; check JIRA for bug status: http://zanata.atlassian.net/browse/ZNTA-465


Note You need to log in before you can comment on or make changes to this bug.