Details
-
Bug
-
Resolution: Fixed
-
Major
-
11.10.5, 12.5.1
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce:
- Create 2 users U1 , U2
- Give to the user U1 Admin rights
- Login with U1 user
- Go to U2 Profile page
- Disable the U2 user using "Disable this account" button:
Expected results:
- The last author of the page to be the user U1, who disabled the account.
Actual results:
- The Administrator user, who was the last author of the page is author of the last modification. The author of the "disable" actions is the previous author of the page.
The history is well displayed when using disable button from the Users page ( the lock button from the users table)
Attachments
Issue Links
- causes
-
XWIKI-21611 Disabling a user account changes its author, allowing RCE from user account
- Closed
- relates to
-
XWIKI-22589 User set as active with a wrong Event stream guest user when email verifications is enabled
- Closed