bugGNU Health - Bugs: bug #46656, Demo users

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46656: Demo users

Submitter:  Cédric Krier <cedk>
Submitted:  Thu 10 Dec 2015 03:08:52 PM UTC
   
 
Category:  Installation Severity:  6 - Security
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  meanmicio
Open/Closed:  Closed Release:  4.1.0
Module:  health Component:  Hospital Management

Jump to the original submission

Fri 31 Mar 2023 11:45:16 AM UTC, comment #8: 

Excellent, Gerald!
Closing the issue.
About the demo uses, we can always activate them on the xml for demos :)

ALl the best
Luis

Luis Falcon <meanmicio>
Group administrator
Thu 30 Mar 2023 01:57:40 PM UTC, comment #7: 

Demo users are deactivated now, thanks Luis.
Cédric even said they should never be created.
At least they are deactivated on creation if I understand right and we can guarantee that nobody did login using those demo users directly after installation.
Let's either close the bug or delete them, what do you think?

Gerald Wiese <gerald_wiese>
Group Member
Mon 26 Dec 2022 04:27:14 PM UTC, comment #6: 

I agree with Cedric.
Shouldn't we disable creating those demo users for 4.2?
Offering a script to create them might make sense.
However I agree that you should rather create the security issue by purpose instead of having it by default and then have to solve it.

Gerald Wiese <gerald_wiese>
Group Member
Mon 14 Mar 2016 11:57:30 AM UTC, comment #5: 
Luis Falcon <meanmicio>
Group administrator
Mon 14 Mar 2016 11:32:55 AM UTC, comment #4: 

Good security practice should be secure by default at the installation because you can not guarantee between the moment you create the database that nobody did login using those demo users.

Cédric Krier <cedk>
Mon 14 Mar 2016 11:21:03 AM UTC, comment #3: 

Agree.

Demo users should be deactivated in production environments.

I will update the documentation in the Wikibook

Luis Falcon <meanmicio>
Group administrator
Mon 14 Mar 2016 09:38:00 AM UTC, comment #2: 

I raise it as security issue because we can even not change the password of those demo users. And so the only way is to inactivate them.
I really think such user should never be created by modules even in a health_demo module. The best is to create them with the demo script.

Cédric Krier <cedk>
Thu 10 Dec 2015 04:03:15 PM UTC, comment #1: 

We then could create a module health_demo that holds the demo users and other info.


Luis Falcon <meanmicio>
Group administrator
Thu 10 Dec 2015 03:08:52 PM UTC, original submission:  

I don't think it is correct to create some default user via XML in the standard installation.
Especially, since 3.8 where the user can no more deleted.

Cédric Krier <cedk>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gerald_wiese (Posted a comment)
  • -email is unavailable- added by meanmicio (Posted a comment)
  • -email is unavailable- added by cedk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-03-31 meanmicio StatusNeed Info Fixed
        Open/ClosedOpen Closed
    2022-12-26 gerald_wiese Release2.9.0 4.1.0
        ComponentNone Hospital Management
    2016-03-14 meanmicio Assigned toNone meanmicio
    2016-03-14 cedk Severity4 - Important 6 - Security
    2015-12-10 meanmicio StatusNone Need Info
        ReleaseNone 2.9.0

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code