Closed (fixed)
Project:
Username Enumeration Prevention
Version:
7.x-1.0
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
21 Jun 2012 at 22:45 UTC
Updated:
8 May 2015 at 05:57 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
mcdruid commentedIt appears that this is a particular problem if globalredirect is enabled, as even users without the necessary permissions to "access user profiles" get redirected to a URL which reveals the username (or at least the token-processed version of the username), where they then get a 403.
Comment #2
greggles@mcdruid - I forget the setting now, but I think there's a configuratin option to tell globalredirect not to forward people on a 403. Can you look for that?
Comment #3
mcdruid commented@greggles, thanks - the option (in D7) is:
[] Menu Access Checking
If enabled, the module will check the user has access to the page before redirecting. This helps to stop redirection on protected pages and avoids giving away secret URL's. By default this feature is disabled to avoid any unexpected behavior
...and it does indeed seem to avoid the problem I described.
Comment #4
gregglesMaybe this module should warn if that feature is not enabled?
I kind of forget what my original idea was with this proposal :/
Comment #5
matt v. commentedI'm attaching a patch that adds a new check to the module, which looks for a specific combination of settings (default settings) in Pathauto and Global Redirects. This patch depends on another patch, in issue #1524292.
Comment #6
charles belovA workaround in pathauto appears to be to set change the path for users from users/[user:username] to users/[user:uid] then delete all user aliases, but not sure if there are any downsides (besides showing an URL like user/1 or users/1).
Comment #7
gregglesJust blank out the pattern so you don't get unnecessary aliases filling the table.
Comment #8
charles belov@greggles Thank you. Workaround revised to:
1. Go to /admin/config/search/path/patterns
2. Scroll to bottom
3. If User Paths is not expanded, click "User Paths" to expand it.
4. Blank out Pattern for user account page paths
5. Click Save configuration
6. Go to /admin/config/search/path/delete_bulk
7. Check Users
8. Click Delete aliases now!
Comment #10
matt v. commentedI merged in a slight variation on the patch from comment #5. It doesn't prevent or disallow the settings, but it does display a warning. I'm open to a more stringent approach, if someone wants to provide a patch, but for now I'm marking this fixed.