Contrib.social

Should not be able to bypass sitewide user form

Open on Drupal.org →
Created on 18 July 2025, 9 days ago

Problem/Motivation

The sitewide user form can be bypassed by calling the submission route and passing a query parameter.

Proposed resolution

The user account form and the sitewide account form should have separate submission routes, each with their own permission requirements. this way no one can bypass by passing a query parameter to the route.

🐛 Bug report
Status

Active

Version

3.0

Component

Code

Created by

🇺🇸United States MegaKeegMan

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024