AllBugsFeaturesChangelogSearchNew post
Sign in with Fluxer
Bugs

New accounts on a self-hosted dev instance are flagged as staff

(#1050) Bug Needs triage security self-hosting
by RexSystem edited originally by @Basti032002 on GitHub

Problem

For now, i set up an devenv for selfhost for testing. i tried to mess around a bit. and found out that if im registering a second account for testing, this account is automatically flagged as a staff member, i dont know if that is because of dev environment and if that is no longer the case if the environment is set at production.

Proposed solution

Everyone who registers should not be flagged as staff
  1. Rex changed the status from Shipped to Fixed

2 comments

Sign in with Fluxer to comment and vote.
Comment by Rex
RexSystem 1 vote
Status changed from Fixed to Needs triage
Reopened because it was closed only to ask for an issue and the problem was never looked at.
Permalink
Comment by @Divij-Bhoj
RexSystem 1 vote originally by @Divij-Bhoj on GitHub
Users who register through the normal registration process should not be automatically flagged as staff members. The default behavior should be: is_staff = False is_superuser = False Standard user role assigned by default Staff privileges granted only manually by an administrator This ensures proper role separation and prevents unintended privilege escalation.
Permalink