• Remember Mailing List

Re: Workflow security issue

from "Eric Thomas" on Mar 13, 2007 08:19 AM
> > Hi all.  I'm trying to use remember with the
> > member_approval_workflow and feel like it is really close to
> > working.  No new AT types here, just the standard membrane/remember
> > types.  Basically, I'm hoping to allow Anonymous users to register
> > themselves as new members, but have the workflow put the new member
> > into a pending state which must be approved by a reviewer.
> >
> > I've got the workflow transtions to where they look correct, but
> > have a permissions issue.  Currently, a user can choose 'Join' and
> > enter their Username (tester2), Full name, and E-mail and select
> > 'Register'.  However, they are then prompted to Login.
>
> thanks for reporting this.  i've just made a couple of commits to
> resolve these issues.  if you update to svn trunk you should find
> that the member_approval_workflow will work.
>
> >  The event.log snippet is below, and clearly indicates a
> > permissions issue.  However, I'm not sure what permission is
> > required or whether it should be set in one of the states of
> > member_approval_workflow or on one of the portal folders used in
> > Member creation.  So, I'm at the point of aimlessly modifying
> > different permissions.   Thanks for any help...
>
> the permission was 'View'.  problem was, member objects that are
> pending review by the site admin are not _supposed_ to be visible to
> anonymous users.  i'm now catching the unauthorized exception so we
> can present our nice "your account is awaiting approval" page to the
> user.
>
> -r
Thanks!  I was able to get this working with the latest svn trunk.
However, I had a few additional permissions and workflow related
issues that I had to resolve before this woked 'out-of-the-box'.
These were deja-vu issues that I had already resolved, but the
reinstall from the svn trunk removed some of the changes I'd made.
I've submitted reports to the issue tracker for those.  Hopefully
others can confirm them.

- eric
Return to date view: threaded or flat