Description

When logged in as superuser, it is possible to go to UserPreferences and select another user account. But as you save the changed settings, this will lead to a situation where the superuser account is overwritten by a duplicate account that matches the said account. Ultimately, superuser privileges are revoked similar to MoinMoinBugs/AdminSelfDemotion.

Steps to reproduce

1. Log in as superuser

2. Go to UserPreferences

3. Select another user (say, JohnDoe) from the drop-down list, and press "Select User"

4. A help text will appear saying "Use UserPreferences to change settings of the selected user account".

5. Go to UserPreferences again

6. Type in a new email address for the user (MoinMoin will complain about a duplicate email address otherwise)

7. Press "Save"
8. Log out
9. Log in with the superuser credentials

10. The "superuser" account is now named JohnDoe, but has no superuser privileges.

Example

Component selection

• UserPreferences

Details

Workaround

• Make backups of the superuser account
• Configure SMTP capability to send users their new credentials when needed
• If you lose the superuser privileges
  • You can either

    • Revert the superuser account to directory MOIN/data/user

    • Delete the cache file MOIN/data/cache/wikiconfig/user/name2id

  • Or alternatively
    • Delete the overwritten account file
    • Create a new user account

    • Edit wikiconfig.py accordingly

Discussion

As a sidenote, it is possible to gain superuser privileges by following these steps:

1. Contact the Wiki administrator and ask him to change your password or email etc.
2. Wiki administrator will log in, make the changes to your account and log out
3. Create a new dummy account

4. MoinMoin will recalculate the cache file name2id ¹

5. Create a new account with the same name as the superuser account
6. Congratulations!

-- HenriOssi 2008-02-05 14:00:51

Plan

• Priority:
• Assigned to:

• Status: fixed in 1.6.1 (but the "fix" created a new bug: MoinMoinBugs/ChangeOtherAccountsPassword and was thus reverted with http://hg.moinmo.in/moin/1.6/rev/82a1426b0235 so it is currently "not fixed" again)

  • finally fixed in 1.6 by http://hg.moinmo.in/moin/1.6/rev/f405012e67af (and afterwards released as 1.6.3)

CategoryMoinMoinBugFixed