incubator-jspwiki-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Andrew Jaquith (JIRA)" <j...@apache.org>
Subject [jira] Commented: (JSPWIKI-268) Changing your name deactivates group membership until logout/login
Date Wed, 02 Jul 2008 03:18:44 GMT

    [ https://issues.apache.org/jira/browse/JSPWIKI-268?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12609783#action_12609783
] 

Andrew Jaquith commented on JSPWIKI-268:
----------------------------------------

Terry -- the ability to change the login name was a feature that users asked for. For that
reason, it is not a feature I'd feel comfortable removing. The feature we introduced in the
2.7 cycle (the UID property of UserProfile) addresses the uniqueness issue you were looking
for in [JSPWiki-267].

With respect to the specific bug you cited  -- group memberships vanishing -- I could not
reproduce the issue in 2.8.0-Alpha.

Here are the steps I took to attempt to reproduce:

- Created new user account with login name 'arj', full name 'Andrew Jaquith'.
- Using Group.jsp, created new group called 'Test,' with member 'Andrew Jaquith'.
- Clicked 'My Prefs' link. Changed login name from 'arj' to 'andrew', and saved profile.
- Clicked 'My Prefs' again. Group 'Test' appeared in list of groups user belongs to, as expected.
- Clicked 'My Prefs' link. Changed login name back to 'arj' from 'andrew', and saved profile.
- Clicked 'My Prefs' again. Group 'Test' appeared in list of groups user belongs to, as expected.
- Logged out.

Conclusion: could not reproduce.

Test #2, this time using the login name rather than full name:

- Logged in using account with login name 'arj' (previously created).
- Using Group.jsp, created new group called 'Test2,' with member 'arj'.
- Clicked 'My Prefs' link. Changed login name from 'arj' to 'andrew', and saved profile.
- Clicked 'My Prefs' again. Group 'Test2' appeared in list of groups user belongs to, as expected.

Conclusion: could not reproduce.

Quite a few things changed "under the hood" for security in the 2.7 branch, so I suspect this
bug got fixed in that branch -- in other words, after 2.6.2.

Could you please try testing 2.8.0-Alpha, and see if you can reproduce the issue? I'd like
to mark this bug as fixed.

> Changing your name deactivates group membership until logout/login
> ------------------------------------------------------------------
>
>                 Key: JSPWIKI-268
>                 URL: https://issues.apache.org/jira/browse/JSPWIKI-268
>             Project: JSPWiki
>          Issue Type: Bug
>          Components: Authentication&Authorization
>    Affects Versions: 2.6.2
>         Environment: All
>            Reporter: Terry Steichen
>            Assignee: Andrew Jaquith
>            Priority: Minor
>             Fix For: 2.8.1
>
>
> If a user changes their name, when you check your group memberships again, there are
none.  If you logout and then login again, the group memberships are restored.  (However,
the membership is now based on the new name.)  This, in and of itself, is a minor annoyance.
 However, I believe it's related to JSPWIKI-267- if this is resolved so that users can not
change their login name, then the logic that ends up changing the group membership name will
presumably be dropped and this issue will probably disappear.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message