Patch #27009: Clarify consequences of disabling the login_required setting - Redmine

Actions

Copy link

Patch #27009

closed

Clarify consequences of disabling the login_required setting

Added by Holger Just over 5 years ago. Updated almost 5 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Go MAEDA

Category:

Target version:

4.0.0

Start date:

Due date:

% Done:

Estimated time:

Description

When an administrator disabled the login_required setting and/or sets projects as public, this can have grave consequences for the protection of the data in-house projects. If this is done carelessly, confidential data might be exposed to undesired audiences (e.g. the global unauthenticated internet).

The attached patches try to make the consequences of these settings clearer by making them more prominent and explain their consequences to the user. This helps admins and project managers make the correct decisions.

We use these patches on Planio where all accounts require authentication by default. But even for "older" Redmine installations which might have some internal public projects it might still be surprising that they are suddenly public when not enforcing authentication anymore.

Files

Download all files

0001-Clarify-consequences-of-disabling-the-login_required.patch (2.79 KB) 0001-Clarify-consequences-of-disabling-the-login_required.patch		Holger Just, 2017-09-15 16:35
0002-Clarify-consequences-of-setting-a-project-as-public.patch (2.69 KB) 0002-Clarify-consequences-of-setting-a-project-as-public.patch		Holger Just, 2017-09-15 16:35
0001-Clarify-consequences-of-disabling-the-login_required.patch (2.72 KB) 0001-Clarify-consequences-of-disabling-the-login_required.patch		Holger Just, 2018-04-20 15:13
0002-Clarify-consequences-of-setting-a-project-as-public.patch (2.66 KB) 0002-Clarify-consequences-of-setting-a-project-as-public.patch		Holger Just, 2018-04-20 15:13

Related issues

Actions

Copy link

Updated by Jan from Planio www.plan.io over 5 years ago

Description updated (diff)
Target version set to Candidate for next minor release

Actions

Copy link

Updated by Go MAEDA over 5 years ago

Target version changed from Candidate for next minor release to 4.1.0

I think this patch is very valuable because sometimes I find a Redmine instance which unintentionally exposes internal projects on the internet. This patch can prevent users from making such inappropriate settings.

I am setting target version to 4.1.0.

Actions

Copy link

Updated by Toshi MARUYAMA over 5 years ago

Description updated (diff)

Actions

Copy link

Updated by Go MAEDA almost 5 years ago

I think we should slightly change messages in the patch, replace the word "Internet" with "network" because Redmine may be deployed on intranets.

text_login_required_html:
When not requiring authentication, public projects and their contents are openly available on the ~~Internet~~ network.
text_project_is_public_anonymous:
Public projects and their contents are openly available on the ~~Internet~~ network.