When setting up registration for an entity you can set permissions for who can create registrations and view their own registrations. On a site where it's desired to allow anonymous users to register this is currently an issue.

Workflow when anonymous role can not view their own registrations.

1) Anonymous user John registers with john@example.com
2) John is redirected to example.com/registration/11
3) John gets an "Access denied" error

Workflow when anonymous role CAN view their own registrations.

1) Anonymous user Bob registers with bob@example.com
2) Bob is redirected to example.com/registration/12
3) Bob decides to see what example.com/registration/11 looks like and now sees John's registration details

On the one hand we have an error message which is a bad user experience, on the other hand we have a privacy and possibly a security problem.

Comments

jerdavis’s picture

Priority: Major » Critical

Bumping this one.

dpi’s picture

Status: Active » Closed (duplicate)

#1609152: Alternate ending page for anon registration to avoid Access Denied? fixes scenario A. Scenario B may be a desirable behavior (intranet etc). You can hide the email address by hiding the email field display (/admin/structure/registration/registration_types/manage/foobar/fields) or use field access permissions to hide it for certain roles.

Reopen if you feel there is a significant difference between the issues.

dpi’s picture

Edit: nevermind.

dpi’s picture

Issue summary: View changes

had the wrong path component