fix: return an empty profile page when not found #2680
Conversation
Signed-off-by: Mike Fiedler <[email protected]>
| try: | ||
| return super().get_object(queryset) | ||
| except Http404: | ||
| return AnonymousUser() |
There was a problem hiding this comment.
Would returning an anonymous user make it known that a user doesn't exist and the malicious actor could continue enumerating over usernames?
There was a problem hiding this comment.
Initially, yes - since the HTML contents used to include the user's name in the <title> tag - that's been removed in the template.
I examined the HTML output of an existing vs anonymous user to confirm that the only difference is in the actual URL requested - nothing else.
There was a problem hiding this comment.
I examined the HTML output of an existing vs anonymous user to confirm that the only difference is in the actual URL requested - nothing else.
non-blocking suggestion: If it's not too expensive in terms of effort, it would be good to add a test that does this.
|
I’m not positive we even need or use the public profile page. Removing unauthenticated access to this view entirely is likely the correct move. |
Description
Return an identical empty page to prevent user enumeration.