Forgive me if this is a duplicate of http://drupal.org/node/25605. Since that bug is submitted against 4.6.1, I did not want to post my patch there. My patch applies to HEAD (4.7).

My patch prevents the anonymous user from visiting user/0/edit (even better, user/0/*). But administrators are still permitted to.

If an administrator does go to user/0, they see a weird looking page with tabs (view, edit, etc) but no content under 'view'. They can still hit edit to change settings on the anonymous user. I think it is important to allow this. You might for instance want to assign the anonymous user roles or change theme.

CommentFileSizeAuthor
#7 user_no_edit_0.patch.1606 bytesdww
#5 user_no_edit_0.patch1.74 KBdww
#3 drupal-4.7.0-rc3.user.0.edit.diff.txt1.55 KBkaare
user_0_edit.patch2.87 KBDave Cohen

Comments

Steve Dondley’s picture

Steve Dondley commented
Status: Needs review » Fixed

Can no longer be duplicated. Setting to fixed.

dries’s picture

dries commented
Status: Fixed » Closed (fixed)
kaare’s picture

kaare
him/his
Primary language Norwegian Bokmål
Location Tromsø
commented
Version: 4.7.0-beta2 » 4.7.0-rc3
Component: user system » user.module
Status: Closed (fixed) » Needs review
StatusFileSize
new drupal-4.7.0-rc3.user.0.edit.diff.txt1.55 KB

This bug isn't fixed as of 4.7.0-rc3. Anonymous users may still access user/0/edit. yogadex's patch won't apply for -rc3, so I've modified it to do so.

Uwe Hermann’s picture

Uwe Hermann commented
Version: 4.7.0-rc3 » x.y.z

Confirmed, current HEAD allows anonymous users to access user/0/edit (but not user/0/track or user/0/view).

dww’s picture

dww
we/he/they
commented
StatusFileSize
new user_no_edit_0.patch1.74 KB

confirmed bug. attached patch fixes a problem in the last patch. a typo ("selv" vs. "self") prevented non-admin users from being able to edit their own profiles. others should review, since this is critical, but i'd say this patch is RTBC...

-derek

dries’s picture

dries commented

Not sure about the patch. Shoud user/0 be accessible? Should admins be able to edit the anonymous user? The anonymous user name is set at ?q=admin/settings. If no one should be able to access that page, we should generate 404s, not 403s ...

dww’s picture

dww
we/he/they
commented
StatusFileSize
new user_no_edit_0.patch.1606 bytes

good point, dries. when i posted that patch, i was under the mistaken impression this was a gaping security hole because i was thinking in unix terms: uid==0 is root. now that it's clear we're just talking about the anonymous user, then yeah, we probably just don't want that page visible at all. new patch with a new approach. b/c of how the menu stuff works (walking up the menu tree automatically), any path of [site]/user/X will land on [site]/user anyway. i'm not sure if it's a good idea to explicity set paths for all these that point to 404 pages, etc. anyway, attached patch just doesn't register any of these menu callback paths if the uid is 0. what do y'all think?

dww’s picture

dww
we/he/they
commented

in case that last post wasn't clear. the result of user_no_edit_0.patch.1 is that if the anonymous user navigates to [site]/user/0/edit, they'll land on [site]/user, which is the login page. that seems reasonable to me (and it's a tiny diff).

dries’s picture

dries commented
Status: Needs review » Fixed

Committed to HEAD. Thanks.

Dave Cohen’s picture

Dave Cohen commented

In my opinion, administrator should be able to edit the anonymous user account. You could give the anonymous user another theme or configure which blocks they see. You may even assign additional roles to the anonymous user.

I've never had to do these things, so I do not feel strongly about it. But I see no reason not to allow it.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)