bugGNU Health - Bugs: bug #46656, Demo users

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46656: Demo users

Submitted by:  Cédric Krier <cedk>
Submitted on:  Thu 10 Dec 2015 03:08:52 PM UTC  
 
Category:  Installation Severity:  6 - Security
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  Luis Falcon <meanmicio>
Open/Closed:  Open Release:  2.9.0
Module:  health

Mon 14 Mar 2016 11:57:30 AM UTC, comment #5:

Documentation updated :

https://en.wikibooks.org/wiki/GNU_Health/Installation#Disabling_demo_users_in_Production_environments

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Mon 14 Mar 2016 11:32:55 AM UTC, comment #4:

Good security practice should be secure by default at the installation because you can not guarantee between the moment you create the database that nobody did login using those demo users.

Cédric Krier <cedk>
Mon 14 Mar 2016 11:21:03 AM UTC, comment #3:

Agree.

Demo users should be deactivated in production environments.

I will update the documentation in the Wikibook

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Mon 14 Mar 2016 09:38:00 AM UTC, comment #2:

I raise it as security issue because we can even not change the password of those demo users. And so the only way is to inactivate them.
I really think such user should never be created by modules even in a health_demo module. The best is to create them with the demo script.

Cédric Krier <cedk>
Thu 10 Dec 2015 04:03:15 PM UTC, comment #1:

We then could create a module health_demo that holds the demo users and other info.

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Thu 10 Dec 2015 03:08:52 PM UTC, original submission:

I don't think it is correct to create some default user via XML in the standard installation.
Especially, since 3.8 where the user can no more deleted.

Cédric Krier <cedk>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by meanmicio (Posted a comment)
  • -email is unavailable- added by cedk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-03-14 meanmicio Assigned toNone => meanmicio
    2016-03-14 cedk Severity4 - Important => 6 - Security
    2015-12-10 meanmicio StatusNone => Need Info
        ReleaseNone => 2.9.0

    Back to the top


    Powered by Savane 3.3