Security Question on User Portlet

[gruenewa]

Hi Developers and Community,

i tested JBoss Portal 2.2. I created a new account and logged in. Then i recognized that i could change the profiles of other users using the User Portlets "List of all users"-page. So it was possible to change the password of the administrator for instance. Is there a way to prevent portal users from doing so? Is it possibly a bug?

Thanks,
Alexander

[julien1]

yes by default the user portlet should allow that only for administrators.

we will work on a fix shortly.

[anson.smith]

Hi..I just noticed this behavior today, I really need this user portlet to work,
Do you have any timeframe for when this issue will be resolved?
Thanks alot
Anson Smith

[julien1]

it is fixed in 2.2.1RC1 that we have just released.

[anson.smith]

Thanks for the quick response we actually just figured it out for ourselves.
It really is a great product