Vote #78308
未完了RestAPI doesn't allow anonymous account registration but web interface does.
0%
説明
Rest API Rest_Users doesn't allow a the creation of a new user if no admin rights are provided but is it possible for non authenticated user to registers through web interface at http://redmine/account/register
Environment: Redmine version 2.5.2.devel Ruby version 2.1.5-p273 (2014-11-13) [x86_64-linux-gnu] Rails version 4.1.8 Environment production Database adapter Mysql2 SCM: Git 2.1.4 Filesystem Redmine plugins: no plugin installed
journals
--------------------------------------------------------------------------------
When @Self-registration@ value is not "disabled", the following Rest API POST request creates the account with locked or activated status as @text/html@ format.
!settings_self-registration_except_disabled.png!
<pre>
$ curl -i -H "Content-Type: application/json" -X POST http://localhost:3000/account/register.json \
-d '{"user": {"login": "XXXXX", "firstname": "YY", "lastname": "ZZZZZZ", "mail": "XXXXX@example.com", "password": "************"}}'
HTTP/1.1 302 Found
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Location: http://localhost:3000/my/account
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache
Set-Cookie: _redmine_session=********...; path=/; HttpOnly
X-Request-Id: ********...
X-Runtime: 0.027633
Content-Length: 98
<html><body>You are being <a href="http://localhost:3000/my/account">redirected</a>.</body></html>
</pre>
The following GET request also returns error message as @text/html@ format, so I think that both should return JSON format when specifying `/account/register.json`.
<pre>
$ curl -i -H "Content-Type: application/json" http://localhost:3000/account/register.json
HTTP/1.1 406 Not Acceptable
Content-Type: text/html; charset=utf-8
X-Request-Id: e0c96a76-32c6-44ce-afe7-066c86e218de
X-Runtime: 0.144548
Content-Length: 105021
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Action Controller: Exception caught</title>
:
</pre>
--------------------------------------------------------------------------------