Re: Workflow security issue
from
Rob Miller
on Mar 07, 2007 09:01 PM
On Mar 5, 2007, at 6:59 PM, Eric Thomas wrote:
> Hi all. I'm trying to use remember with the
> member_approval_workflow and feel like it is really close to
> working. No new AT types here, just the standard membrane/remember
> types. Basically, I'm hoping to allow Anonymous users to register
> themselves as new members, but have the workflow put the new member
> into a pending state which must be approved by a reviewer.
>
> I've got the workflow transtions to where they look correct, but
> have a permissions issue. Currently, a user can choose 'Join' and
> enter their Username (tester2), Full name, and E-mail and select
> 'Register'. However, they are then prompted to Login.
thanks for reporting this. i've just made a couple of commits to
resolve these issues. if you update to svn trunk you should find
that the member_approval_workflow will work.
> The event.log snippet is below, and clearly indicates a
> permissions issue. However, I'm not sure what permission is
> required or whether it should be set in one of the states of
> member_approval_workflow or on one of the portal folders used in
> Member creation. So, I'm at the point of aimlessly modifying
> different permissions. Thanks for any help...
the permission was 'View'. problem was, member objects that are
pending review by the site admin are not _supposed_ to be visible to
anonymous users. i'm now catching the unauthorized exception so we
can present our nice "your account is awaiting approval" page to the
user.
-r