SECURITY issue about piwigo-social-connect

[mistic100]

Hello,

how exactly is this a security issue ? Neither the security of the gallery or the Google account of the user is compromised at any moment.

The only "problem" is that the administrator is not sure the provided email corresponds to the linked account. And in my opinion this is a good thing, the user must be able to authenticate with an external provider but do not give you his main email, he can choose what personnal information he gives to you *

You will also notice that in the the standard Piwigo authentication the email is not mandatory and is not verified.

* This is in accordance to the GDPR and any data protection laws.

[mistic100]

I must precise that the email is not used in the authentication process.

[timaschew]

But then I don't get the idea of permissions and groups, how can I add user to a group if I can't ensure the identity of that user? Which is usually given by the email address with either a activation link or via an external provider.

[timaschew]

The only "problem" is that the administrator is not sure the provided email corresponds to the linked account. And in my opinion this is a good thing, the user must be able to authenticate with an external provider but do not give you his main email, he can choose what personnal information he gives to you

That's exactly my point. I'm okay if you say the external provider should not give the email, but then you should not allow the user to specify any email address he wants, just disable that input field then.

But currently the email address is passed by the provider because the input field is prefilled with my address, but I can change it.