86029 - create permission restrictions for createaccount.cgi (prevent people from creating accounts)

Status: RESOLVED FIXED

(Bugzilla :: Administration, task, P3)

Description

[timeless]

How can I administer such that only the adminstrator can create user login
accounts ?
Vanilla bugzilla allows anyone to create a login account.

The following possibilities should probably exist:
a. allow account creation based on email request
b. allow account creation by guests who are not logged in
c. allow account creation by people who are logged in and have some privelege

while enabling b doesn't make much sense, it might not unreasonable to 
discourage people from creating multiple accounts.

c is probably what most people want. a is probably worthy of it's own bug.

The specific privelege for C is probably the most interesting question, should 
it be something you can control by adding people to a group, or like a checkbox 
in edit users, or ...

Comment 1

[Matthew Tuck [:CodeMachine]]

At the moment there's just an "administrator" group.  I'm not convinced we need
a separate group for account creation.  A more useful middle-ground might be to
restrict the email addresses that can be registered through the normal account
creation process.

Comment 2

[Matthew Tuck [:CodeMachine]]

*** Bug 75042 has been marked as a duplicate of this bug. ***

Comment 3

[Jacob Steenhagen]

You can already restrict the email addresses that can create accounts.  For
instance, if you only wanted people @netscape.com to be able to create accounts,
all you'd need to do is change the "emailregexp" param to:

^[^@, ]*@netscape\.com$

Comment 4

[Matthew Tuck [:CodeMachine]]

I said "restrict who can create accounts through the normal interface" not
"restrict who can have accounts".  AFAIK this currently can't be done.

Comment 5

[Dave Miller [:justdave]]

*** Bug 87589 has been marked as a duplicate of this bug. ***

Comment 6

[Matthew Tuck [:CodeMachine]]

This is fairly important for a certain class of customer, so I'll move this to 2.16.

Comment 7

[Andreas Franke (gone)]

-> Bugzilla product, Administration component, reassigning.

Comment 8

[Thomas Leufkes]

If you just do not want that new accounts are created by sending an email,
you have to modify a single line in CGI.PL. So every account has to be created 
by users with the "create user"-permission:

sub confirm_login {
    my ($nexturl) = (@_);

# Uncommenting the next line can help debugging...
#    print "Content-type: text/plain\n\n";

    ConnectToDatabase();
    # I'm going to reorganize some of this stuff a bit.  Since we're adding
    # a second possible validation method (LDAP), we need to move some of this
    # to a later section.  -Joe Robins, 8/3/00
    my $enteredlogin = "";
    my $realcryptpwd = "";
    if (defined $::FORM{"Bugzilla_login"} &&
        defined $::FORM{"Bugzilla_password"}) {

       $enteredlogin = $::FORM{"Bugzilla_login"};
       my $enteredpwd = $::FORM{"Bugzilla_password"};
       CheckEmailSyntax($enteredlogin);

       $realcryptpwd  = PasswordForLogin($::FORM{"Bugzilla_login"});

       if (defined $::FORM{"PleaseMailAPassword"}) {
         my $realpwd;
         if ($realcryptpwd eq "") {

>>>
#          $realpwd = InsertNewUser($enteredlogin, "");     
           $realpwd = "\n\no account created!\n\n please contact the webmaster";
<<<

         } else {
           SendSQL("select password from profiles where login_name = " .
                   SqlQuote($enteredlogin));
           $realpwd = FetchOneColumn();
         }
         print "Content-type: text/html\n\n";
         PutHeader("Password has been emailed");
         MailPassword($enteredlogin, $realpwd);
         PutFooter();
         exit;
       }

Comment 9

[Dave Miller [:justdave]]

We are currently trying to wrap up Bugzilla 2.16.  We are now close enough to
release time that anything that wasn't already ranked at P1 isn't going to make
the cut.  Thus this is being retargetted at 2.18.  If you strongly disagree with
this retargetting, please comment, however, be aware that we only have about 2
weeks left to review and test anything at this point, and we intend to devote
this time to the remaining bugs that were designated as release blockers.

Comment 10

[Matthew Tuck [:CodeMachine]]

*** Bug 140678 has been marked as a duplicate of this bug. ***

Comment 11

[Matthew Tuck [:CodeMachine]]

This should work as follows:

- have a parameter that contains the createemailregexp.
- some special value or another parameter will block creation entirely, removing
account creation links and locking off the CGI.
- if you try to create an account the matches emailregexp but not
createemailregexp it should give a message saying only administrators can create
an account with this address.

Comment 12

[Joel Peshkin]

Attachment: The patch

Comment 13

[Joel Peshkin]

-->me

Comment 14

[Tobias Burnus]

Comment on attachment 107661 [details] [diff] [review]
The patch

r=burnus

user-error.html.tmpl
>+    
Nit: Remove those four spaces.

Comment 15

[Joel Peshkin]

checked in