May 14th, 2013 : want to see the future? Have a go on AjaXplorer 5 rc4 now!
Welcome to AjaXplorer Forum. Please read the following post before posting : Before Posting
[solved] User "guest" with ALLOW_GUEST_BROWSING disabled
  • Vote Up0Vote Down ToP December 2011
    Hello,

    I use AjaXplorer 4.0 (great work!).

    I have disabled guest browsing in core.auth. (I don't want any kind of guest browsing).
    In data/plugins/conf.serial/plugins_configs.ser is ALLOW_GUEST_BROWSING=""
    (ALLOW_GUEST_BROWSING";s:0:"";)

    Then I share a folder and choose "Create a temporary user" and enter the user name "guest" and a password.

    After this, everyone can login with the user "guest" and ANY password or WITHOUT a password and access the shared folder.

    Also the user "guest" is not visible on the "Shared Users" screen and not associated to the repository on the "Shared Repositories" screen.

    The user guest is created in the "data/plugins/auth.serial/users.ser" and the folder "data/plugins/auth.serial/guest"

    The user name "guest" should act like any other user name, if ALLOW_GUEST_BROWSING is disabled, shouldn't it?

    My users doesn't know anything about this special behaviour of the user name "guest" and could accidentally open a private folder for the whole world, so it may be security problem.

    Any hints how to change this?

    Thanks for help!
  • 4 Answers sorted by
  • Vote Up0Vote Down charles December 2011
    Hi
    Thanks for reporting, very interesting problem indeed! I'll check how to fix it easily, but I think the quick fix will be more on the "forbidding guest user" side.
    Charles
  • Vote Up0Vote Down charles December 2011
    Hi
    I've commited a fix for this, can you retest? (make sure the guest user is totally removed, by editing the user.ser file in data/plugins/auth.serial)
    Grab the latest version of the two following files on the SVN : http://ajaxplorer.svn.sourceforge.net/viewvc/ajaxplorer/trunk/core/src/
    Files :
    + core/classes/class.AuthService.php
    + plugins/action.share/class.ShareCenter.php

    Will be in the next bugfix release anyway

    Charles
  • Vote Up0Vote Down ToP December 2011
    Hi Charles,

    thanks for the real quick fix :-)
    It works, I can't create the user "guest" any more (User exists).
    Perfect!

    Happy Xmas!
    Theo
  • Vote Up0Vote Down charles January 2012
    should be fixed in 4.0.1
Add a Comment
Happy with the support?By donating, even a small amount, you are ensuring the project's durability.

WTF?

  • Clearing the server cache
    Delete the two files data/cache/plugins_*.ser
  • Clearing the client cache
    Delete your browser navigation data (cache, cookies, etc).
  • It's a PHP config
    A configuration that AjaXplorer cannot update directly, but that is set in the php.ini file. Some configs must be changed directly inside this file, other can be overriden by an .htaccess file inside the AjaXplorer folder.
  • Where is the FAQ ?
    It's here

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Categories

Tagged