• Remember Mailing List

Re: Workflow security issue

from Rob Miller on Mar 07, 2007 09:01 PM
On Mar 5, 2007, at 6:59 PM, Eric Thomas wrote:

> Hi all.  I'm trying to use remember with the  
> member_approval_workflow and feel like it is really close to  
> working.  No new AT types here, just the standard membrane/remember  
> types.  Basically, I'm hoping to allow Anonymous users to register  
> themselves as new members, but have the workflow put the new member  
> into a pending state which must be approved by a reviewer.
>
> I've got the workflow transtions to where they look correct, but  
> have a permissions issue.  Currently, a user can choose 'Join' and  
> enter their Username (tester2), Full name, and E-mail and select  
> 'Register'.  However, they are then prompted to Login.

thanks for reporting this.  i've just made a couple of commits to  
resolve these issues.  if you update to svn trunk you should find  
that the member_approval_workflow will work.

>  The event.log snippet is below, and clearly indicates a  
> permissions issue.  However, I'm not sure what permission is  
> required or whether it should be set in one of the states of  
> member_approval_workflow or on one of the portal folders used in  
> Member creation.  So, I'm at the point of aimlessly modifying  
> different permissions.   Thanks for any help...

the permission was 'View'.  problem was, member objects that are  
pending review by the site admin are not _supposed_ to be visible to  
anonymous users.  i'm now catching the unauthorized exception so we  
can present our nice "your account is awaiting approval" page to the  
user.

-r
Return to date view: threaded or flat