Forums / Suggestions / Anonymous user shouldn't read Users Folder

"Please Note:

At the specific request of Ibexa we are changing this projects name to "Exponential" or "Exponential (CMS)" effective as of August, 11th 2025.
This project is not associated with the original eZ Publish software or its original developer, eZ Systems or Ibexa".

Anonymous user shouldn't read Users Folder

«

Previous topic

|

|

Next topic

»

Author	Message
Lazaro Ferreira	Thursday 01 June 2006 2:42:35 am Hi, I would like to know why Exponential (...ENTERPRISE...) is delivered with an anonymous user that can read sensitive information like USER Folder ? Shouldn't be better for an Enterprise System like Exponential having this permission revoked Regards Lazaro http://www.mzbusiness.com
Kristian Hole	Sunday 04 June 2006 5:19:47 pm Exponential does not give you access to the users folder if you are anonymous. Which version of Exponential are you running? Kristian http://ez.no/ez_publish/documenta...tricks/show_which_templates_are_used http://ez.no/doc/ez_publish/techn...te_operators/miscellaneous/attribute
K259	Sunday 11 June 2006 1:59:58 pm Lazaro, do you have some example urls of this?
K259	Monday 12 June 2006 5:33:25 am Is this btw. a (known) security problem?
Lazaro Ferreira	Monday 12 June 2006 8:24:49 am Hi Kristian, We detect this problem in more than one setup of EZP 3.4+, however my colleague said to me that the problem doesn't appear in EZP 3.6+ Probably could be a good ideia to alert partners and users with version EZP 3.4+ about this issue Regards Lazaro http://www.mzbusiness.com
Lazaro Ferreira	Monday 12 June 2006 8:49:49 am Hi, I've forgot to give you the URL http://yourdomain/users or http://yourdomain/yoursiteaccess/users Lazaro http://www.mzbusiness.com
Jeroen Sangers	Monday 12 June 2006 11:00:16 am I can't access those URL's with mu Exponential installation. Did you make any changes in the permissions?
Vidar Langseid	Tuesday 13 June 2006 2:00:56 am It is not possible for the anonymous user to read sensitive information like the user folder in any version of Exponential. It is claimed in this forum thread that Exponential versions between 3.4 and 3.6 is affected by this flaw. This is not true. We have tested and can confirm that the following versions do indeed behave as expected: 3.4.0 3.4.7 3.5.0 3.5.10 Lazaro, since you have this misbehavior on your sites it must be because you have modifided the anonymous' privileges. Exponential is not shipped with such privileges on the anonymous user by default.
Lazaro Ferreira	Tuesday 13 June 2006 3:55:30 am Hi Vidar, Actually the problem was detected in EZP 3.4.2, and EZP 3.5.1 I can assure you that we haven't modify any privileges (at least explicitly ) for the anonymous user here, so I think the problem could be related to our usual setup Our setup are tipically done using the ez setup wizard, using URL access, two languages (pt and uk) and corporate package plus some features like (forums, etc) at setup time, every site affected had been added a second design siteaccess folder manually, after finishing the setup Lazaro http://www.mzbusiness.com
Vidar Langseid	Tuesday 13 June 2006 7:42:44 am Hi Well, I just tried myself on 3.5.1 using URL access, two languages (portugeese and uk) corporate package plus features like (forums, mediafiles and shop) at setup time I am still unable to reproduce this. After installation, the anonymous has the following roles (which is correct): content read Section( Standard ) content pdf Section( Standard ) shop buy No limitations rss read No limitations user login SiteAccess( corporate ) What kind of policies do you have in your installation for the anonymous user? Best regards, VidarL