Not possible to obtain elevated session when impersonating an unverified user
Open
Nobody has claimed this yet.
bug
severity:minor
user management :innocent:
- Dominant language
- PHP
- Stars
- 3.6k
- Forks
- 705
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 134
Description
Steps to reproduce
- Create a new user with permission to register users, but don’t activate their account or set a password
- Impersonate them
- While logged in as the new user, attempt to register a new user
When the password modal opens, used to create an elevated session, you won’t be able to continue, as the new user doesn’t have a password yet. If you enter a random password, an internal error will occur, due to yii\base\Security::validatePassword() getting called with $hash = null.
Additional info
- Craft version: 3.0.22
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at yii\base\Security::validatePassword() and trace the elevated-session/password-modal flow used during impersonation. Reproduce the steps with an unactivated user that has no password; done means the attempted registration no longer produces an internal error and the elevated-session flow behaves correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100