Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-25739

The guest user can be returned as a member of a group

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Major
    • 18.10.0-rc-1
    • 10.8-rc-1
    • User
    • None
    • Unknown

    Description

      When a group page holds a XWiki.XWikiGroups object whose member is the guest user (XWiki.XWikiGuest), GroupManager#getMembers() returns XWiki.XWikiGuest as a member of that group, even though the guest user can't be a member of any group: the rights system never gives the guest user any groups. The same goes for XWiki.superadmin, and an empty member value is returned as the group itself.

      Steps to reproduce

      1. Add an XWiki.XWikiGroups object with member XWiki.XWikiGuest to XWiki.XWikiAllGroup
      2. Call $services.user.group.getMembers($xwiki.getDocument('XWiki.XWikiAllGroup').documentReference, false)

      Expected

      The guest user is not listed.

      Actual

      xwiki:XWiki.XWikiGuest is listed as a member.

      Attachments

        Issue Links

          Activity

            People

              tmortagne Thomas Mortagne
              tmortagne Thomas Mortagne
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated: