[xwiki-users] Email notifications and security
Hello, I encountered an annoying situation and am wondering what I should do... As I wanted to enable email notifications of page updates, I entered our SMTP server information in the wiki preferences page. As it's needed by our server, I also entered my personal account credentials to be able to connect to the smtp server. The password field not being a "password" type field, it means everyone with admin rights in the wiki can have my password, but I can live with that for now. To see if it works, I now watch the whole wiki. I changed my password, so I updated the page, and gracefully received my old and new password in the notification email, in the page diff ... As well as the other admin. My question is : does notification process check for pages rights, meaning that if anyone registered to watch the whole wiki, did he receive my password through his notification emails as I did, or does he only receive notifications for updates on page he has rights on ? Thanks, Jeremie
On Wed, Jan 20, 2010 at 10:26, Jeremie BOUSQUET <[email protected]> wrote:
Hello,
I encountered an annoying situation and am wondering what I should do...
As I wanted to enable email notifications of page updates, I entered our SMTP server information in the wiki preferences page. As it's needed by our server, I also entered my personal account credentials to be able to connect to the smtp server.
The password field not being a "password" type field, it means everyone with admin rights in the wiki can have my password, but I can live with that for now. To see if it works, I now watch the whole wiki.
I changed my password, so I updated the page, and gracefully received my old and new password in the notification email, in the page diff ... As well as the other admin. My question is : does notification process check for pages rights, meaning that if anyone registered to watch the whole wiki, did he receive my password through his notification emails as I did, or does he only receive notifications for updates on page he has rights on ?
AFAIK user will only receive mail on page he has access to. About the filed itself, it look like a bug to me that it's not a password field type, could you report it on http://jira.xwiki.org ?
Thanks, Jeremie _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki). Jeremie
Hi Jeremie, On Wed, Jan 20, 2010 at 12:01 PM, Jeremie BOUSQUET < [email protected]> wrote:
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki).
Unfortunately I don't think it got corrected since. Guillaume
Jeremie _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Guillaume Lerouge Product Manager - XWiki SAS Skype: wikibc Twitter: glerouge http://guillaumelerouge.com/
On Wed, Jan 20, 2010 at 12:01, Jeremie BOUSQUET <[email protected]> wrote:
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki).
Note that i think it's possible you can change it yourself in the class even if it's not yet fixed in standard (which I doubt). Go to the preference class editor (/xwiki/bin/edit/XWiki/XWikiPreferences?editor=class), rename the current smtp_server_password field and create a new one as smtp_server_password but this time using Password as TYPE. Then you should have a password field where you can put your password for SMTP.
Jeremie _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
On Wed, Jan 20, 2010 at 12:34, Thomas Mortagne <[email protected]> wrote:
On Wed, Jan 20, 2010 at 12:01, Jeremie BOUSQUET <[email protected]> wrote:
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki).
Note that i think it's possible you can change it yourself in the class even if it's not yet fixed in standard (which I doubt).
Not very clear: "which I doubt" meaning i doubt it's fixed ;)
Go to the preference class editor (/xwiki/bin/edit/XWiki/XWikiPreferences?editor=class), rename the current smtp_server_password field and create a new one as smtp_server_password but this time using Password as TYPE. Then you should have a password field where you can put your password for SMTP.
Jeremie _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
-- Thomas Mortagne
On 01/20/2010 12:34 PM, Thomas Mortagne wrote:
On Wed, Jan 20, 2010 at 12:01, Jeremie BOUSQUET <[email protected]> wrote:
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki).
Note that i think it's possible you can change it yourself in the class even if it's not yet fixed in standard (which I doubt).
Go to the preference class editor (/xwiki/bin/edit/XWiki/XWikiPreferences?editor=class), rename the current smtp_server_password field and create a new one as smtp_server_password but this time using Password as TYPE. Then you should have a password field where you can put your password for SMTP.
Very important: the storage type for this field MUST be "clear", since otherwise the mailsender won't be able to read the password. -- Sergiu Dumitriu http://purl.org/net/sergiu/
Hello 2010/1/20 Sergiu Dumitriu <[email protected]>:
On 01/20/2010 12:34 PM, Thomas Mortagne wrote:
On Wed, Jan 20, 2010 at 12:01, Jeremie BOUSQUET <[email protected]> wrote:
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki).
Note that i think it's possible you can change it yourself in the class even if it's not yet fixed in standard (which I doubt).
Go to the preference class editor (/xwiki/bin/edit/XWiki/XWikiPreferences?editor=class), rename the current smtp_server_password field and create a new one as smtp_server_password but this time using Password as TYPE. Then you should have a password field where you can put your password for SMTP.
Very important: the storage type for this field MUST be "clear", since otherwise the mailsender won't be able to read the password.
Could the mailsender used targeted user credencial or smtp_server_user/password properties in targeted user object? Arnaud.
-- Sergiu Dumitriu http://purl.org/net/sergiu/ _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
On 01/20/2010 02:43 PM, Arnaud bourree wrote:
Hello
2010/1/20 Sergiu Dumitriu<[email protected]>:
On 01/20/2010 12:34 PM, Thomas Mortagne wrote:
On Wed, Jan 20, 2010 at 12:01, Jeremie BOUSQUET <[email protected]> wrote:
Ok thanks, for the issue I will, but I want to check before that it's the case on a fresh 2.1.1 install (because mine is the result of numerous migrations, and I never re-imported the preferences page, so maybe it has been corrected meanwhile in xwiki).
Note that i think it's possible you can change it yourself in the class even if it's not yet fixed in standard (which I doubt).
Go to the preference class editor (/xwiki/bin/edit/XWiki/XWikiPreferences?editor=class), rename the current smtp_server_password field and create a new one as smtp_server_password but this time using Password as TYPE. Then you should have a password field where you can put your password for SMTP.
Very important: the storage type for this field MUST be "clear", since otherwise the mailsender won't be able to read the password.
Could the mailsender used targeted user credencial or smtp_server_user/password properties in targeted user object?
Out of the box, no, but you could adapt the code. -- Sergiu Dumitriu http://purl.org/net/sergiu/
participants (5)
-
Arnaud bourree -
Guillaume Lerouge -
Jeremie BOUSQUET -
Sergiu Dumitriu -
Thomas Mortagne