It's possible to leak usernames if pathauto patterns include usernames. It would be nice to disallow that.

Comments

mcdruid’s picture

It appears that this is a particular problem if globalredirect is enabled, as even users without the necessary permissions to "access user profiles" get redirected to a URL which reveals the username (or at least the token-processed version of the username), where they then get a 403.

greggles’s picture

@mcdruid - I forget the setting now, but I think there's a configuratin option to tell globalredirect not to forward people on a 403. Can you look for that?

mcdruid’s picture

@greggles, thanks - the option (in D7) is:

[] Menu Access Checking
If enabled, the module will check the user has access to the page before redirecting. This helps to stop redirection on protected pages and avoids giving away secret URL's. By default this feature is disabled to avoid any unexpected behavior

...and it does indeed seem to avoid the problem I described.

greggles’s picture

Maybe this module should warn if that feature is not enabled?

I kind of forget what my original idea was with this proposal :/

matt v.’s picture

Status: Active » Needs review
StatusFileSize
new2.33 KB

I'm attaching a patch that adds a new check to the module, which looks for a specific combination of settings (default settings) in Pathauto and Global Redirects. This patch depends on another patch, in issue #1524292.

charles belov’s picture

Issue summary: View changes

A workaround in pathauto appears to be to set change the path for users from users/[user:username] to users/[user:uid] then delete all user aliases, but not sure if there are any downsides (besides showing an URL like user/1 or users/1).

greggles’s picture

Just blank out the pattern so you don't get unnecessary aliases filling the table.

charles belov’s picture

@greggles Thank you. Workaround revised to:

1. Go to /admin/config/search/path/patterns
2. Scroll to bottom
3. If User Paths is not expanded, click "User Paths" to expand it.
4. Blank out Pattern for user account page paths
5. Click Save configuration
6. Go to /admin/config/search/path/delete_bulk
7. Check Users
8. Click Delete aliases now!

  • Matt V. committed d6b8701 on 7.x-1.x
    Issue #1651294: Warn of default Pathauto and Global Redirect settings...
matt v.’s picture

Status: Needs review » Fixed

I merged in a slight variation on the patch from comment #5. It doesn't prevent or disallow the settings, but it does display a warning. I'm open to a more stringent approach, if someone wants to provide a patch, but for now I'm marking this fixed.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.