[
https://issues.apache.org/jira/browse/JSPWIKI-266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134397#comment-18134397
]
Arturo Bernal commented on JSPWIKI-266:
---------------------------------------
Checked in the current code (upstream master) and on running instances (Tomcat
10.1).
The permission asked for in the report does not exist. The actions of
WikiPermission are createGroups, createPages, login, editPreferences and
editProfile; there is no action for creating a profile, and the default
jspwiki.policy gives editProfile to every user. As an anonymous visitor I
registered new profiles through the register form of the login page in two
instances, without any administrator action, so account creation is open by
default.
Whether to add a permission for it, as in the patch of 2008, or another switch,
is a design decision; I did not check how the patch of that time would apply to
the current code, and I did not look at the workarounds mentioned in the
description. Leaving the issue open as a feature request.
> Add ability to restrict account creation
> ----------------------------------------
>
> Key: JSPWIKI-266
> URL: https://issues.apache.org/jira/browse/JSPWIKI-266
> Project: JSPWiki
> Issue Type: New Feature
> Components: Authentication & Authorization
> Reporter: Aaron Hamid
> Assignee: Andrew R. Jaquith
> Priority: Major
> Attachments: limitprofilecreation.patch
>
>
> This is a formal feature request (because I could not find an existing issue)
> for the "Admin Creates User Profiles" Idea here:
> http://www.jspwiki.org/wiki/IdeaAdminCreatesUserProfiles
> Once way to implement it would be, that a different permission,
> "createProfile", be added, still configurable in the jspwiki.policy file.
> This way the desired policy could be configured such that the admin group has
> the "createProfile" permission, while the Authenticated have their
> "editProfile" permission.
> Workarounds are presented here
> http://www.jspwiki.org/wiki/AllowOnlyAdministratorCreateUserAccounts but have
> drawbacks, including allowing arbitrary junk accounts or forcing security to
> be configured external to the application.
> The proposal above, a new "createProfile" permission, seems like a
> straightforward way to address this concern directly in the product expanding
> its usefulness without weird workarounds.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
