There is a serious security leak in the restful_authentication plugin regarding the activation of an account. You can use it to log in w/o user credentials or impersonate someone else.
The “activate” method of the controller accepts an empty activation code parameter like this (depending on your routes):
http://localhost:3006/user/activate or http://localhost:3006/activate/?activation_code=
Which will create this SQL:
SELECT * FROM users WHERE (users.`activation_code` IS NULL) LIMIT 1
An attacker will be able to log in w/o password and use the first account found with an empty activation_code (activated users)!
This works for everyone in and outside the app, because you’d normally have a skip_before_filter :login_required, :only => [:activate] in the controller. Even if you don’t (rarely), registered users can impersonate someone else!
The author has been informed, and thankfully reacted with a new version of the plugin, replace the first line of the method with this (depending on your model names):
self.current_user = params[:activation_code].blank? ? :false : User.find_by_activation_code(params[:activation_code])
