Details
-
Improvement
-
Resolution: Duplicate
-
Major
-
None
-
2.5 M2
-
None
-
Unknown
-
Description
By default, xwiki doesn't verify if the user that logs in has an active or inactive state.
With this behavior, an inactive user can log in, and simply browse through the content without no restrictions.
Even more, it can use applications like Invitation application, and spam or invite unintended people to register to xwiki.
The check to see if the logging uses is active should be mandatory, without having to set
"Check Active fields for user authentication" accessible from Administer Wiki -> Registration.
Attachments
Issue Links
- duplicates
-
XWIKI-12653 Check user active/inactive status by default and remove the option to disable it
- Closed
- is duplicated by
-
XWIKI-6300 Remove "Check Active fields for user authentication" dropdown from Registration area
- Closed