Description

If a user changes by Preferences his login name and the email address to another person then the other person can log in and the user who was changing his credentials stayed logged in. This happens because the cookie does not become invalidated. -- ReimarBauer 2008-07-23 22:22:14

Steps to reproduce

• create a user
• log in
• change your account data
• mail the data to the new user or tell him the password
• to simulate it
  • choose another different browser
  • login with the new credential
  • now you have the same account in two browsers
  • ( this can be two persons )

Example

Component selection

• general

Details

Workaround

Discussion

I do think we should require a new login if the name or the email address is changed.

Please explain why you see this as a bug.

For me it is an unwanted feature.

The approach we have implemented is that we assume that the same natural person gains access to the wiki later after he or the superuser has changed his credential. Currently we don't verify this. Another example: If one creates a lot of users by a script and did a mistake by the email address. If that email address with a typo exists someone gets invited and can log in. When the mistake is corrected the wrong one has already a cookie and stays logged in. As a user I believe I can't knock him off.

The concept of a moin wiki user is that of an identity (it does not need to be permanently bound to a fixed name or email address). People change their email address all the time and sometimes, they also change their name (e.g. if they marry), so the only constant thing is the numerical id each moin user has. If you have done a mistake when creating user accounts and you want to force a re-login, I guess you could simply delete the session cache. -- ThomasWaldmann 2008-07-24 10:55:17

We have to check if it is possible to delete the session cache to get the user kicked off. In 1.6 the session cache is rebuilded from a valid cookie.

Plan

• Priority:
• Assigned to:
• Status:

CategoryMoinMoinBug