Actually, this is not a security issue at all.  The list of roles is readily available from a simple database query.  Given the current architecture, there is no way to prevent a module that wants this information from obtaining it.  This is more a concern since it is a change in the behavior of the API which might break modules which were designed to take advantage of the previous exception.

EDIT:  After re-reading the original post.  This is certainly something we will want to fix.   I will raise this with the security team.

---

Joe Brinkman
DNN Corp.

I'll admit there is a behaviour change here.

However, from a core security perspective, there are no security implications as the core security method PortalSecurity.IsInRoles(roles) requires an authenticated user, and checks explicitly the roles of that authenticated user.

The only possibility for security issues to appear in 4.3.3 (that are not there in earlier versions) is if a module developer uses their own security checks (based on the results of the GetRolesByUser method) rather than the core methods - PortalSecurity.IsInRoles(roles).

Hope this clarifies things.

---

Charles Nurse Chief Architect Evoq Content Team Lead, DNN Corp. Want to contribute to the Platform project? - See here

MVP (ASP.NET) and ASPInsiders Member