craftcms / craftcms/cms

Not possible to obtain elevated session when impersonating an unverified user

Open
#3,263 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity:minor user management :innocent:
Dominant language
PHP
Stars
3.6k
Forks
705
Avg merge
1d 5h
Merged PRs (30d)
134

Description

Steps to reproduce
  1. Create a new user with permission to register users, but don’t activate their account or set a password
  2. Impersonate them
  3. While logged in as the new user, attempt to register a new user

When the password modal opens, used to create an elevated session, you won’t be able to continue, as the new user doesn’t have a password yet. If you enter a random password, an internal error will occur, due to yii\base\Security::validatePassword() getting called with $hash = null.

Additional info
  • Craft version: 3.0.22

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at yii\base\Security::validatePassword() and trace the elevated-session/password-modal flow used during impersonation. Reproduce the steps with an unactivated user that has no password; done means the attempted registration no longer produces an internal error and the elevated-session flow behaves correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, authorization
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.