***moderator reply***

Hello tabletennis,

normally i would have deleted this post and contacted you via email and asked you to send any suspected security vulnerabilities to the security@dotnetnuke.com email alias, as we discourage public talk about suspected issues (it only causes panic and gives potential hackers an opportunity to exploit real issues before we can arrange an update).

However, in this case this is not a vulnerability. For a number of years now (since the 2.0 release as far as I remember), DotNetNuke has supported the capability of having the same user in multiple portals. As long as the portals are all under the same host (i.e. either a child or parent portal) , if you create a user with the exact same username/password combination we allow the existing user to be used as the new member of the portal i.e. there is only 1 user record, and that userID is used in the two portals. This is purely a convenience, as all other elements are still seperated i.e. my permissions/roles on one portal do not apply to the other. This is behaviour by design and is often used so is unlikely to ever be changed.

Cathal

Not really tabletennis. That would require that when a user registers for one portal their registration automatically goes to all of the other portals on that install as I see it having to work (there's no way DNN can be sure when a user registered on portal A visits portal B). A couple of my portals have completely different content and target audience. It doesn't make sense that a user that registers on one of my sites to get my DNN modules/AD betas etc. automatically gets registered on a racing sim portal that they have no interest in or are even aware of and vice versa. I'm sure the 3000 users on the sim portal would scream bloody murder if they recieved an email about a DNN module or newsletter about something on the DNN site (That's just an example as I don't send them out nor does the admin of the sim site) especially as the URLs have nothing in common.