admin/app-catalog-felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-763: wger closes its own sign-up and guest users (hidden app; 9202 stranger walk owed)

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-05 21:13:52 +02:00
parent 51a3d81d55
commit 1968527a86
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
onboarding/wger.md
+1 -1
View File
@@ -42,7 +42,7 @@ Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template ident
3.1 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — class 3, measured
3.2 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — default refused, generated signs in, wrong refused
3.3 | n/a | class 3: a known default login, not an open first-run screen
3.4 | open | after the setup a stranger signed up and signed in, and each anonymous visit to the dashboard made a guest account — `ALLOW_REGISTRATION` and `ALLOW_GUEST_USERS` default True (R-763; C8)
3.4 | open | after the setup a stranger signed up and signed in, and each anonymous visit to the dashboard made a guest account — `ALLOW_REGISTRATION` and `ALLOW_GUEST_USERS` default True (R-763; C8) — fix written 2026-10-05 (both set False in the compose); the stranger walk on 9202 is still owed
3.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — 92 stranger tries from the press: 90 no route, 1 the gate, then refused; never let in
3.6 | done | felhom.eu/documentation/audits/lockouts-2026-10-01/B/B5-wger-fix-5min.txt — only the name tried is locked, 5 min; the second member unaffected (`09` decision 58)
3.7 | open | not measured: changing the password and adding a family member; the template has no `add_people` text (R-759)
templates/wger/docker-compose.yml
+6
View File
@@ -52,6 +52,12 @@ services:
- AXES_LOCKOUT_PARAMETERS=username
- AXES_COOLOFF_TIME=5
- AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler
# R-763 (2026-10-05): the image defaults both to True. After the install the admin exists (after_install sets its
# password), so nobody needs wger's own sign-up: a stranger could make an account through the front door, and every
# anonymous visit to the dashboard made a guest user row (wger's middleware create_temporary_user). Both read by
# settings/main.py as env.bool (wger 2.7 L179-180); the sign-up view then redirects to the features page.
- ALLOW_REGISTRATION=False
- ALLOW_GUEST_USERS=False
- DJANGO_DB_ENGINE=django.db.backends.sqlite3
- DJANGO_DB_DATABASE=/home/wger/db/database.sqlite
- DJANGO_DB_USER=wger