Forum OpenACS Q&A: Security Issue: User ID 0 Becomes Member of Registered Users

With a freshly installed system, group memberships look like this:

openacs4=# select * from groups;
 group_id |    group_name    | join_policy
----------+------------------+-------------
       -1 | The Public       | open
       -2 | Registered Users | open
(2 rows)
                                                                                
openacs4=# select * from group_member_map;
 group_id | member_id | rel_id | container_id |    rel_type
----------+-----------+--------+--------------+----------------
       -1 |         0 |      5 |           -1 | membership_rel
       -2 |       313 |    314 |           -2 | membership_rel
       -1 |       313 |    314 |           -2 | membership_rel
(3 rows)
                                                                               

Note that ID 0 is only a member of The Public (group -1). Now, without logging in, hit /register/user-join?group_id=-2

group memberships now look like this:

openacs4=# select * from group_member_map;
 group_id | member_id | rel_id | container_id |    rel_type
----------+-----------+--------+--------------+----------------
       -1 |         0 |      5 |           -1 | membership_rel
       -2 |       313 |    314 |           -2 | membership_rel
       -1 |       313 |    314 |           -2 | membership_rel
       -2 |         0 |    315 |           -2 | membership_rel
       -1 |         0 |    315 |           -2 | membership_rel

Now note that ID 0 is a member of Registered Users (-2). I'm not familiar with the ramifications of this, but I think the unregistered user should not become registered.

Can someone in the know say how bad this is?

Randy

I've fixed this by making the join policy for "The Public" and "Registered Users" closed rather than open.  The user registration ignores these constraints, using the registration option parameters instead so new users can still register.

You can change your existing site the same way my new upgrade script works:

update groups set join_policy = 'closed' where group_id in (-1,-2);

After dropping and reinstalling, I applied:

    update groups set join_policy = 'closed' where group_id in (-1,-2);

BTW, I started with a fresh CVS checkout from 4.6 tip. I checked after initial install and the join_policy on -1 and -2 was 'open', so it looks like your fix was not applied to 4.6 CVS.