[medium] Open registration by default; first-user admin logic re-promotes #12

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: medium
Affects: main

Files: lib/fuzzy_catalog/admin_settings.ex:77 (registration_enabled default true), lib/fuzzy_catalog/accounts.ex:151-163
A freshly deployed instance lets anyone register, and the first registrant becomes admin. ensure_first_user_is_admin runs on every registration and re-promotes the oldest user if an admin demoted them. The email-registration path promotes an unconfirmed user.
Fix: only promote when the user count is 1, inside the insert transaction; consider defaulting registration off (env var REGISTRATION_ENABLED, settings UI as fallback).

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** medium **Affects:** main Files: lib/fuzzy_catalog/admin_settings.ex:77 (registration_enabled default true), lib/fuzzy_catalog/accounts.ex:151-163 A freshly deployed instance lets anyone register, and the first registrant becomes admin. ensure_first_user_is_admin runs on every registration and re-promotes the oldest user if an admin demoted them. The email-registration path promotes an unconfirmed user. Fix: only promote when the user count is 1, inside the insert transaction; consider defaulting registration off (env var REGISTRATION_ENABLED, settings UI as fallback). --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

security

main

medium

labels

2026-10-18 15:51:55 +00:00

~~jfro referenced this issue 2026-10-18 17:22:25 +00:00~~

fix: make only the very first user admin, add REGISTRATION_ENABLED #38

jfro referenced this issue from a commit

2026-10-18 17:22:26 +00:00

fix: make only the very first user admin, add REGISTRATION_ENABLED

jfro referenced this issue from a pull request that will close it,