When setting up registration for an entity you can set permissions for who can create registrations and view their own registrations. On a site where it's desired to allow anonymous users to register this is currently an issue.
Workflow when anonymous role can not view their own registrations.
1) Anonymous user John registers with john@example.com
2) John is redirected to example.com/registration/11
3) John gets an "Access denied" error
Workflow when anonymous role CAN view their own registrations.
1) Anonymous user Bob registers with bob@example.com
2) Bob is redirected to example.com/registration/12
3) Bob decides to see what example.com/registration/11 looks like and now sees John's registration details
On the one hand we have an error message which is a bad user experience, on the other hand we have a privacy and possibly a security problem.
Comments
Comment #1
jerdavisBumping this one.
Comment #2
dpi#1609152: Alternate ending page for anon registration to avoid Access Denied? fixes scenario A. Scenario B may be a desirable behavior (intranet etc). You can hide the email address by hiding the email field display (/admin/structure/registration/registration_types/manage/foobar/fields)
or use field access permissions to hide it for certain roles.Reopen if you feel there is a significant difference between the issues.
Comment #3
dpiEdit: nevermind.
Comment #3.0
dpihad the wrong path component