bugGNU Health - Bugs: bug #46656, Demo users

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46656: Demo users

Submitter:  Cédric Krier <cedk>
Submitted:  Thu 10 Dec 2015 03:08:52 PM UTC
 
Category:  Installation Severity:  6 - Security
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  meanmicio
Open/Closed:  Open Release:  2.9.0
Module:  health Component:  None

Mon 14 Mar 2016 11:57:30 AM UTC, comment #5: 
Luis Falcon <meanmicio>
Project Administrator
Mon 14 Mar 2016 11:32:55 AM UTC, comment #4: 

Good security practice should be secure by default at the installation because you can not guarantee between the moment you create the database that nobody did login using those demo users.

Cédric Krier <cedk>
Mon 14 Mar 2016 11:21:03 AM UTC, comment #3: 

Agree.

Demo users should be deactivated in production environments.

I will update the documentation in the Wikibook

Luis Falcon <meanmicio>
Project Administrator
Mon 14 Mar 2016 09:38:00 AM UTC, comment #2: 

I raise it as security issue because we can even not change the password of those demo users. And so the only way is to inactivate them.
I really think such user should never be created by modules even in a health_demo module. The best is to create them with the demo script.

Cédric Krier <cedk>
Thu 10 Dec 2015 04:03:15 PM UTC, comment #1: 

We then could create a module health_demo that holds the demo users and other info.

Luis Falcon <meanmicio>
Project Administrator
Thu 10 Dec 2015 03:08:52 PM UTC, original submission:  

I don't think it is correct to create some default user via XML in the standard installation.
Especially, since 3.8 where the user can no more deleted.

Cédric Krier <cedk>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by meanmicio (Posted a comment)
  • -email is unavailable- added by cedk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-03-14 meanmicio Assigned toNone meanmicio
    2016-03-14 cedk Severity4 - Important 6 - Security
    2015-12-10 meanmicio StatusNone Need Info
        ReleaseNone 2.9.0

    Back to the top


    Powered by Savane 3.9