mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-05-04 18:08:46 +03:00
Users can modify their profiles and pretend they're someone else #1266
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Irrational-NX on GitHub (Jul 19, 2019).
Originally assigned to: @ssddanbrown on GitHub.
Describe the bug
Any user can impersonate anyone else on the wiki.
A user (attacker) register using his own mail address, email confirmation is activated so he click on the link in a mail he received. He can then change his First Name, Last Name, profile picture to make it seems he's someone else... That far it's fine because we can still see his mail address.
But then... the user can change his mail and no mail confirmation is sent.
Because of that, an attacker can also use a mail that doesn't exist. My mail contains an "l" but the attacker can replace it by an "I" ("i" uppercase).
Moreover, the domain restriction doesn't apply when changing mail. I think this is expected behavior but this is still a problem in my opinion.
Which means the user can say he's the CEO...
Steps To Reproduce
Steps to reproduce the behavior:
Expected behavior
When changing mail, a mail confirmation should be sent no matter what.
Your Configuration (please complete the following information):
@ssddanbrown commented on GitHub (Aug 7, 2019):
Thank you very much for raising @Irrational-NX. Sorry for my late reply, Have had limited time in the last few weeks.
I have just deployed v0.26.4 to update the behaviour so that only users with the "Manage Users" permission can update user email addresses. This keeps control with only those that are trusted.
We'll see in the future if self-managed & verified email changes are requested and look to implement if there's a call for it but I'd imagine it's probably an infrequent scenario in the real world.
I did think about taking this further to prevent impostering by updating user-names to show email address as a tooltip on hover but I quickly realised there are too many privacy concerns there, since we currently only show email address in very limited areas, so that would need extra controls therefore not a quick update to make.
Thanks again!
@Irrational-NX commented on GitHub (Aug 7, 2019):
Thank you very much @ssddanbrown for fixing this!
I applied the new version this morning and can confirm this works as intended. :)
@timptner commented on GitHub (Jun 5, 2025):
I'm coming late to the party - but your mentioned scenario is where I am right now. My users aren't able to change their email address after registration some time ago. I see that it's quite an uncommon case to update the personal email address but it does happen for example when people do have a work and private email. Most often they create a second account before thinking about contacting admins to request the edit of their account. I think it would be a useful feature to allow people to set a new (and not already in use) email address, which they need to verify again.
Would probably be the best to create a new issue as feature request but I'm interested in your opinion first. @ssddanbrown
@ssddanbrown commented on GitHub (Jun 5, 2025):
@timptner Feel free to start a new feature request for that, but I'd want to proven wider demand before adding another option for that, and it would have to be an option somehow (or via some even more complex approval system) since otherwise the original issue reported here would exist again.
Based upon your request being the only one I can remember since this original change, I'm not sure the demand will be there.