The autoregister setting leaves a hole open for users who are not cas authenticated to be able to auto register, unless you're really carefull with the cas configuration. We should either make the auto-account creation based on either a cas specific, or hard code the user register form to require cas auth.

Comments

deelight’s picture

deelight commented

You can perhaps disable auto-registration and modify cas.module like this :

Replace :

$user_register = variable_get('user_register',1);

With :

$user_register = 1;

Auto-registration will be disabled, but the Drupal CAS module will still be able to create accounts for CAS users.

metzlerd’s picture

metzlerd commented
Status: Active » Fixed

delight rolled a patch for a separate issue containing this. Fixed in Head

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)