admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Part C: R-644, R-763, R-764 closed (wger's fixes proven on 9202), R-762/R-717 stopped with reasons; STATUS, CONTEXT, REPORT (142 -> 137; 0 opened, 5 closed)
gates / gates (push) Successful in 2m43s
Details

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-06 14:03:28 +02:00
parent a29ee9dd33
commit 01d5dbd3e0
10 changed files with 280 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/backlog/CLOSED-ITEMS.md
+9
View File
@@ -26,6 +26,15 @@
---
## 2026-10-06 (afternoon) — wger's two fixes proven on 9202
The full text of every row below: `git show a29ee9dd33:documentation/backlog/OPEN-ITEMS.md`.
| Row | What | Closed | Evidence |
|---|---|---|---|
| **R-764** | **[P3-LOW] wger sends no mail: its mail backend is the console, so a password-reset mail never leaves the box, and the template maps no SMTP.** (P4) | CLOSED 2026-10-06 — PROVEN ON 9202 (the fix pushed 2026-10-05, catalog `db88ee9`) | Mail OFF (a fresh install): healthy, 0 restarts, console backend, ENABLE_EMAIL False. Mail ON (the toggle's injection, ENABLE_EMAIL=True + EMAIL_HOST, in the running wger): settings load, smtp backend, port 2526, TLS off — `audits/r890-instructions-2026-10-06/C/wger.txt`. Not measured: a reset mail through a real relay (9202 has no app-mail). |
| **R-763** | **[P2-MEDIUM] On wger a stranger can make an account after the household's setup, and every anonymous visit to the dashboard creates a guest account.** (P3) | CLOSED 2026-10-06 — PROVEN ON 9202 (the fix pushed 2026-10-05, catalog `1968527`) | wger installed fresh on 9202 (drill = live + un-hidden): wger's own process reads ALLOW_REGISTRATION False, ALLOW_GUEST_USERS False; straight at the app a stranger's sign-up GET and a CSRF-valid POST both redirect to /en/software/features (control: the same CSRF passes on the login form), three anonymous dashboard visits redirect to login, users 1 before and after (was 2 -> 4 before the fix) — `audits/r890-instructions-2026-10-06/C/wger.txt`. Family-member adding (checklist 3.7) not measured: R-759. wger stays hidden (R-762). |
## 2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the ladder
The full text of every row below: `git show 7d0dffcf34:documentation/backlog/OPEN-ITEMS.md`.