diff options
| author | Simon McVittie <smcv@debian.org> | 2014-09-15 21:39:18 +0100 |
|---|---|---|
| committer | Simon McVittie <smcv@debian.org> | 2014-09-15 21:39:18 +0100 |
| commit | a1614ba8c5397a7342cc72cbd104db00122662e5 (patch) | |
| tree | 099446697f831b296272ddebf9a2180a0bd8d85a | |
| parent | c1b80c54fa4915bb7174dd4333e9ced40dfee770 (diff) | |
| parent | ff5198fb476f41a04f420d03bfdc5da997485d76 (diff) | |
| download | ikiwiki-a1614ba8c5397a7342cc72cbd104db00122662e5.tar ikiwiki-a1614ba8c5397a7342cc72cbd104db00122662e5.tar.gz | |
Merge branch 'master' of ssh://ikiwiki.branchable.com
| -rw-r--r-- | doc/bugs/notifyemail_fails_with_some_openid_providers.mdwn | 6 | ||||
| -rw-r--r-- | doc/news/openid.mdwn | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/doc/bugs/notifyemail_fails_with_some_openid_providers.mdwn b/doc/bugs/notifyemail_fails_with_some_openid_providers.mdwn index dd5016619..c4542c8d0 100644 --- a/doc/bugs/notifyemail_fails_with_some_openid_providers.mdwn +++ b/doc/bugs/notifyemail_fails_with_some_openid_providers.mdwn @@ -89,3 +89,9 @@ Any other ideas? --[[anarcat]] >>> willing to send notifications to a verified address? >>> >>> --[[smcv]] +>>> +>>>> hmm... true, that is a problem, especially for hostile wikis. but then any hostile site could send you such garbage - they would be spammers then. otherwise, you could ask the site manager to disable that account... +>>>> +>>>> this doesn't seem to be a very big security issue that would merit implementing a new verification mechanism, especially since we don't verify email addresses on accounts right now. what we could do however is allow password authentication on openid accounts, and allow those users to actually change settings like their email addresses. however, I don't think this should be blocking that functionality right now. --[[anarcat]] +>>>> +>>>> besides, the patch I am proposing doesn't make the vulnerability worse at all, it exists right now without the patch. my patch only allows users that **don't** have an email set (likely because their openid provider is more discreet) to set one... --[[anarcat]] diff --git a/doc/news/openid.mdwn b/doc/news/openid.mdwn index c158ec3f9..03fca5567 100644 --- a/doc/news/openid.mdwn +++ b/doc/news/openid.mdwn @@ -10,4 +10,4 @@ log back in, try out the OpenID signup process if you don't already have an OpenID, and see how OpenID works for you. And let me know your feelings about making such a switch. --[[Joey]] -[[!poll 76 "Accept only OpenID for logins" 21 "Accept only password logins" 49 "Accept both"]] +[[!poll 76 "Accept only OpenID for logins" 21 "Accept only password logins" 50 "Accept both"]] |