You understand correctly, and moreover a specific permission must be granted to allow the user to impersonate another one. And we even added another security to not allow impersonating a user with more permission than ourselves.
When we contributed the feature, it was discussed, and improved regarding the concern that were expressed. And i'm glad that was done this way (improvement through discussion). Gil On Fri, Feb 28, 2020 at 09:01:30AM +0100, Michael Brohl wrote: > *creating a new thread to leave the vote thread untouched* > > > In my understanding from the previous threads about the impersonation > features, it is disabled by default and must be enabled explicitly. > > Using this feature and dealing with the consequences is up to the user then. > So I see no valid concern to have this feature in the codebase. > > Am I missing something? > > Michael Brohl > > ecomify GmbH - www.ecomify.de > > Am 28.02.20 um 08:49 schrieb Gil Portenseigne: > > Hello Pierre, > > > > If you are talking about impersonation feature, that is not in the 17.12 > > branch. > > > > In either way, administrative tools, if we got access to it, allow what > > your are saying. But there is no security issue that grant these > > privilege we are aware of. If you do, please share to the security list. > > > > I'm open to discuss about the "criminal" aspect of the impersonation > > feature, but not on this thread. > > > > Gil > > > > On Fri, Feb 28, 2020 at 02:54:01AM +0100, Pierre Smits wrote: > > > -1 > > > > > > As this release contains software elements that will enable criminal > > > parties to gain access to the implemented OFBiz system of a user (a > > > business organisation) and impersonate valid users with the intent to > > > bring > > > harm to the aforementioned business organisation through transactions > > > registered by the impersonated valid user.. > > > > > > Met vriendelijke groet, > > > > > > Pierre Smits >
signature.asc
Description: PGP signature
