Details
-
Bug
-
Resolution: Duplicate
-
Minor
-
None
-
1.34
-
None
Description
Since there is no document called XWikiGuest there is no means of preventing registration of such a user. After registration, actual guests have the same access as the user called XWikiGuest. I'm not classifying this as a security issue since a user may simply share their password if they wish to achieve this end.
However I think we ought to create a place holder document called XWikiGuest to improve constancy.
Attachments
Issue Links
- duplicates
-
XWIKI-5650 Registering a user as XWiki.XWikiGuest automatically gives AllGroup rights to unauthenticated users
- Closed