Allow change of account email addresses in a secure way!

[bkosanovic]

Reproduced on https://public.tenant.kiwitcms.org!

Description of problem

User cannot change email address in the profile. Also, admin cannot change email address of any user. Also, when adding a user, the email address cannot be entered.

Version or commit hash (if applicable)

v12.2 and v12.3 both have this problem while v12.1 works fine. Tested on all three.

Steps to Reproduce

1. Just try adding a user and try entering e-mail address
2. Alternatively go to your own profile and try changing your e-mail

It will not be possible to do it.

Actual results

Cannot change email address of any user and cannot enter email for new user.

Expected results

It should be possible to edit email, etc. It works on v12.1

Additional info

Tested it both with Firefox and Chrome browsers.

[somenewacc]

Intentional change.
GHSA-7x6q-3v3m-cwjg

[somenewacc]

But I think that you have to be able to enter email on creation, or you will get emailess user:

[bkosanovic]

You are right. I "should" be able to enter e-mail on creation, but I cannot. I am indeed getting the email-less users. I cannot click or tab to Email address so it could be entered.

[bkosanovic]

That intentional change is bad. We have approach where the people who will have access to Kiwi TCMS system will not be allowed to register themselves (we disabled it in configuration). The users of Kiwi TCMS would be added to the system by an admin. So, that change is preventing us from using Kiwi TCMS in our environment. We may need to drop it completely from consideration.

If we do not trust admins who are we supposed to trust?

At the minimum, admins should be allowed to change email addresses for any of the accounts, and/or to enter it during manual user creation.

[atodorov]

This is indeed a deliberate change because the email change functionality that currently exists opens up security issues. Keeping this issue open for considering how to redesign this functionality so that it could be safe again after which we can enabled it/

The users of Kiwi TCMS would be added to the system by an admin. So, that change is preventing us from using Kiwi TCMS in our environment.

As a workaround you can register users with the email addresses they want to actually use so that they don't have to change them. That sounds like an easy workaround, no ?

If we do not trust admins who are we supposed to trust?

This doesn't hold true is all organizations and Kiwi TCMS tries to error on the side of being more secure when not sure!

[bkosanovic]

As a workaround you can register users with the email addresses they want to actually use so that they don't have to change them. That sounds like an easy workaround, no ?

It is not about all users having ability to change email addresses. You may even restrict that nobody can change the address. But, you may at least allow admins to set initial email address during creation of a user.

Right now I do not see a way for email address to be set nor changed. I can only create email-less users. That's it. Nobody has email address. No way to set it. (since we cannot let arbitrary people to "self-register" via landing page link which had to be disabled.)

Atlassian and other vendors of similar tools allow you to invite users to join instead of letting arbitrary people to do it as they please. You specify email address within the invitation which results in registration email being sent. That is probably the secure way you are looking for. I have not seen that you have that available in Kiwi.

In other words, your "Add user" dialog should provide email address box to specify email and when you save it you can send the invite email to the user. Once the user replies you may change state to "registered" and allow admin to do additional configuration. For example assigning user to some groups, etc. Until the user "confirmed / accepted" registration you may block any further editing of a user apart from being able to delete them.

Anyway, these are some hopefully constructive ideas for you to consider.

Ideally, you can keep both options to enable landing page link and at the same time allow admins to send invite to users by specifying their email address during initial creation.

[tomasbkk]

I've run into the same exact issue. I've created users but no way to set emails for them. Now I'm stuck.
I don't see why admin cannot set the email when creating a user, it's fine not to be able to change email after user creation but admin needs to be able to set it when creating a new user.

[mlongmiresqa]

Admins, at the very least, need to have a way to add and change emails for a user without the need to edit the database manually.