In some situations when the mandatory group module is used in combination with a user access or authentication module, such as openid, the anonymous user is added to the mandatory group. This appears to be caused because an account with uid 0 is being passed around prior to the account being properly setup. If the og_mandatory_group_user hook is executed before the module that is setting up the user, then user 0 may be added to the mandatory group.

The attached patch prevents this from happening and writes a watchdog message if it tries to.

CommentFileSizeAuthor
#2 uid0.patch867 bytespwolanin
og_mandatory_group_no_anonymous.patch970 byteshadsie

Comments

pwolanin’s picture

Is the watchdog message needed? Does this occurance suggest an attempted security breach, or just a badly written contrib module?

pwolanin’s picture

Status: Needs review » Fixed
StatusFileSize
new867 bytes

committed the attached minimal fix to all branches

Anonymous’s picture

Status: Fixed » Closed (fixed)