This bug is a security risk in that information may be given to the anonymous users in global fashion.

Patch needs ported to 6.x-2.x as well.

CommentFileSizeAuthor
#17 xmlsitemap-view_user_profiles.patch1.57 KBAnonymous (not verified)
#15 xmlsitemap-view_user_profiles.patch890 bytesAnonymous (not verified)
#12 xmlsitemap-view_user_profiles.patch2.55 KBAnonymous (not verified)
#10 xmlsitemap-view_user_profiles.patch2.55 KBAnonymous (not verified)
#8 xmlsitemap-view_user_profiles.patch2.2 KBAnonymous (not verified)
#6 xmlsitemap-view_user_profiles.patch1.58 KBAnonymous (not verified)
xmlsitemap-view_user_profiles.patch890 bytesAnonymous (not verified)
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Active » Needs review

Here test bot.

Dave Reid’s picture

Dave Reid
he/him
Primary language English
Location Nebraska USA
CreditAttribution: Dave Reid commented

See xmlsitemap_user_requirements(). It's pointless to enable the module if you don't have the 'access user profiles' permission enabled. I don't consider this a security risk as disabling xmlsitemap_user should be done at that point as it's not needed.

Status: Needs review » Needs work

The last submitted patch, xmlsitemap-view_user_profiles.patch, failed testing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented

It's pointless to enable the module if you don't have the 'access user profiles' permission enabled

I agree it is "pointless" but as "pointless" as it is the module should check the access and not list them in the sitemap.xml file making the associated requirement meaningful instead of meaningless.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented

I'm not certain that the test failure here is a result of my patching or a result of the test needing modified because of the patch. I don't see how this patch would cause a testBlockedUser() test to fail unless something else is wrong.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs work » Needs review
FileSize
xmlsitemap-view_user_profiles.patch1.58 KB

Does this help?

Status: Needs review » Needs work

The last submitted patch, xmlsitemap-view_user_profiles.patch, failed testing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs work » Needs review
FileSize
xmlsitemap-view_user_profiles.patch2.2 KB

One more time

Status: Needs review » Needs work

The last submitted patch, xmlsitemap-view_user_profiles.patch, failed testing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs work » Needs review
FileSize
xmlsitemap-view_user_profiles.patch2.55 KB

Ok, why doesn't simpletest know about 'view user profiles'. Let's try this one.

Status: Needs review » Needs work

The last submitted patch, xmlsitemap-view_user_profiles.patch, failed testing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs work » Needs review
FileSize
xmlsitemap-view_user_profiles.patch2.55 KB

Typo in last patch.

Status: Needs review » Needs work

The last submitted patch, xmlsitemap-view_user_profiles.patch, failed testing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs work » Needs review

So it isn't "view user profiles" it is "access user profiles" with a title of "View user profiles" just to make it confusing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
FileSize
xmlsitemap-view_user_profiles.patch890 bytes

With the file this time.

Status: Needs review » Needs work

The last submitted patch, xmlsitemap-view_user_profiles.patch, failed testing.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs work » Needs review
FileSize
xmlsitemap-view_user_profiles.patch1.57 KB

I finally figured out what I needed to change in xmlsitemap_user.test. Running core simpletest takes ~30 minutes on my WAMP just for this module and this is my first experience with simpletest. But this file should pass testbot now.

Dave Reid’s picture

Dave Reid
he/him
Primary language English
Location Nebraska USA
CreditAttribution: Dave Reid commented
Priority: Critical » Normal

Again I don't understand why this is necessary. We throw a big requirements check in xmlsitemap_user_requirements() for this. If we store access as 0 until the admin turns on the correct permission, we'd have to do a full rebuild of all user links. Without this patch, that would not be necessary.

interlated’s picture

interlated CreditAttribution: interlated commented

In 7.x-2.0-rc2 I enabled xmlsitemap_user. Index user profiles was turned off but the error 'view user profiles' came up. I think this is dangerous as someone just responding to the error message would enable 'view user profiles' in response to the error message and not think about the implications.

I think it should only check for this permission when someone has asked for user profiles to be indexed.

Chris Matthews’s picture

Chris Matthews CreditAttribution: Chris Matthews commented
Issue summary: View changes

The 7 year old patch in #17 to xmlsitemap_user.module and xmlsitemap_user.test applied cleanly to the latest xmlsitemap 7.x-2.x-dev and if still applicable needs review.

Checking patch xmlsitemap_user/xmlsitemap_user.module...
Hunk #1 succeeded at 151 (offset 5 lines).

Checking patch xmlsitemap_user/xmlsitemap_user.test...
Hunk #1 succeeded at 59 (offset 30 lines).

Applied patch xmlsitemap_user/xmlsitemap_user.module cleanly.
Applied patch xmlsitemap_user/xmlsitemap_user.test cleanly.