From 1968527a8689f99152a3d72e716748ed4cc26a69 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 5 Oct 2026 21:13:52 +0200 Subject: [PATCH] R-763: wger closes its own sign-up and guest users (hidden app; 9202 stranger walk owed) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- onboarding/wger.md | 2 +- templates/wger/docker-compose.yml | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/onboarding/wger.md b/onboarding/wger.md index 6dd8e8c..1e05f9b 100644 --- a/onboarding/wger.md +++ b/onboarding/wger.md @@ -42,7 +42,7 @@ Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template ident 3.1 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — class 3, measured 3.2 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — default refused, generated signs in, wrong refused 3.3 | n/a | class 3: a known default login, not an open first-run screen -3.4 | open | after the setup a stranger signed up and signed in, and each anonymous visit to the dashboard made a guest account — `ALLOW_REGISTRATION` and `ALLOW_GUEST_USERS` default True (R-763; C8) +3.4 | open | after the setup a stranger signed up and signed in, and each anonymous visit to the dashboard made a guest account — `ALLOW_REGISTRATION` and `ALLOW_GUEST_USERS` default True (R-763; C8) — fix written 2026-10-05 (both set False in the compose); the stranger walk on 9202 is still owed 3.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — 92 stranger tries from the press: 90 no route, 1 the gate, then refused; never let in 3.6 | done | felhom.eu/documentation/audits/lockouts-2026-10-01/B/B5-wger-fix-5min.txt — only the name tried is locked, 5 min; the second member unaffected (`09` decision 58) 3.7 | open | not measured: changing the password and adding a family member; the template has no `add_people` text (R-759) diff --git a/templates/wger/docker-compose.yml b/templates/wger/docker-compose.yml index e73cd9f..a212d37 100644 --- a/templates/wger/docker-compose.yml +++ b/templates/wger/docker-compose.yml @@ -52,6 +52,12 @@ services: - AXES_LOCKOUT_PARAMETERS=username - AXES_COOLOFF_TIME=5 - AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler + # R-763 (2026-10-05): the image defaults both to True. After the install the admin exists (after_install sets its + # password), so nobody needs wger's own sign-up: a stranger could make an account through the front door, and every + # anonymous visit to the dashboard made a guest user row (wger's middleware create_temporary_user). Both read by + # settings/main.py as env.bool (wger 2.7 L179-180); the sign-up view then redirects to the features page. + - ALLOW_REGISTRATION=False + - ALLOW_GUEST_USERS=False - DJANGO_DB_ENGINE=django.db.backends.sqlite3 - DJANGO_DB_DATABASE=/home/wger/db/database.sqlite - DJANGO_DB_USER=wger