bugGNU Health - Bugs: bug #46656, Demo users

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46656: Demo users

Submitted by:  Cédric Krier <cedk>
Submitted on:  Thu 10 Dec 2015 03:08:52 PM UTC  
 
Category: InstallationSeverity: 6 - Security
Item Group: NoneStatus: Need Info
Privacy: PublicAssigned to: Luis Falcon <meanmicio>
Open/Closed: OpenRelease: 2.9.0
Module: health

Mon 14 Mar 2016 11:57:30 AM UTC, comment #5:

Documentation updated :

https://en.wikibooks.org/wiki/GNU_Health/Installation#Disabling_demo_users_in_Production_environments

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Mon 14 Mar 2016 11:32:55 AM UTC, comment #4:

Good security practice should be secure by default at the installation because you can not guarantee between the moment you create the database that nobody did login using those demo users.

Cédric Krier <cedk>
Mon 14 Mar 2016 11:21:03 AM UTC, comment #3:

Agree.

Demo users should be deactivated in production environments.

I will update the documentation in the Wikibook

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Mon 14 Mar 2016 09:38:00 AM UTC, comment #2:

I raise it as security issue because we can even not change the password of those demo users. And so the only way is to inactivate them.
I really think such user should never be created by modules even in a health_demo module. The best is to create them with the demo script.

Cédric Krier <cedk>
Thu 10 Dec 2015 04:03:15 PM UTC, comment #1:

We then could create a module health_demo that holds the demo users and other info.

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Thu 10 Dec 2015 03:08:52 PM UTC, original submission:

I don't think it is correct to create some default user via XML in the standard installation.
Especially, since 3.8 where the user can no more deleted.

Cédric Krier <cedk>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by meanmicio (Posted a comment)
  • -unavailable- added by cedk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 14 Mar 2016 11:57:30 AM UTCmeanmicioAssigned toNone=>meanmicio
    Mon 14 Mar 2016 09:38:00 AM UTCcedkSeverity4 - Important=>6 - Security
    Thu 10 Dec 2015 04:03:15 PM UTCmeanmicioStatusNone=>Need Info
      ReleaseNone=>2.9.0

    Back to the top


    Powered by Savane 3.1-cleanup1