Problem/Motivation

A warning is shown on the /admin/config/security-review page, if:

  • "authenticated user" is checked under "Untrusted roles"
  • "Who can register accounts?" is set to "Administrators only" under /admin/config/people/accounts

The warning:

You have allowed anonymous users to create accounts without approval so the authenticated role defaults to untrusted.

Security Review warning

But this is not true.

Steps to reproduce

Get an erroneous warning message.

Proposed resolution

Update either the wording -- OR -- the check in src/Form/SettingsForm.php, so it matches the reality.

Remaining tasks

Figure out if the wording, or the code needs to be updated.

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#3 Sec-review-anon-warn.png56.34 KBressa

Issue fork security_review-3558486

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ressa created an issue. See original summary.

ritarshi_chakraborty’s picture

ritarshi_chakraborty commented

Hi @ressa, can you please share screenshot of the warning? Because I don't see any such warning on my system.

ressa’s picture

ressa
he/him
commented
Issue summary: View changes
StatusFileSize
new Sec-review-anon-warn.png56.34 KB

Sure, I have added it in the Issue Summary.

smustgrave made their first commit to this issue’s fork.

smustgrave opened merge request !93

smustgrave’s picture

smustgrave commented
Status: Active » Needs review

Think we can just drop most of this, seems to be leftover from a D8 port. Not even checking the setting

ritarshi_chakraborty’s picture

ritarshi_chakraborty commented

Yes @ressa, I see the message. Thank you @smustgrave for fixing it.

ritarshi_chakraborty’s picture

ritarshi_chakraborty commented
Status: Needs review » Reviewed & tested by the community

Moving this issue to RTBC.

ressa’s picture

ressa
he/him
commented
Related issues: +#3558703: Add account creation check

Thanks, great to get this cleaned up!

I think it's good practice to only allow administrator to create accounts, and looked around but couldn't find a check for this, so I created #3558703: Add account creation check .

  • smustgrave committed 9a416830 on 3.1.x 
    feat: #3558486 Improve wording for Untrusted roles warning, or update...
smustgrave’s picture

smustgrave commented
Status: Reviewed & tested by the community » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.