Revert "security(demo): deactivate default-credential demo users on production install + drop Production/Stable (#341)" - #515
Merged
Conversation
…roduction install + drop Production/Stable (#341)" This reverts commit 2bc37da from the batch-3 staging branch. The merge-turn adversarial review found the gate signal wrong in both directions: the archive keys on ir_module_module.demo, which is always False on OpenSPP's own stack (docker/odoo.conf.template sets without_demo = True), so every evaluation instance loses its demo personas, while a stock Odoo production install has demo data on by default and keeps sppadmin/demo live. The forced -u spp_demo also reloads a noupdate=0 data file that rewrites the demo logins and resets their passwords on every upgrade. The fix will be redesigned around an explicit opt-in config parameter plus a password scrub on archive, and re-landed in batch 4 together with #356, which was already sequenced behind it. Reviewed heads of the other seven batch-3 PRs are untouched.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 19.0-staging-sec-batch3 #515 +/- ##
===========================================================
- Coverage 74.52% 74.49% -0.03%
===========================================================
Files 624 624
Lines 43955 43928 -27
===========================================================
- Hits 32758 32725 -33
- Misses 11197 11203 +6
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts #341's squash commit
2bc37daaon the batch-3 staging branch. Verified mechanically: the revert diff is the byte-exact inverse of the squash (index lines aside). Nothing else in the batch touchesspp_demoorspp_farmer_registry_demo, so the other seven reviewed heads are unaffected.Why
The merge-turn adversarial review (record in the internal plans folder,
batch3-merge-turn-review.md) found the gate signal wrong in both directions, and each claim was verified by hand:ir_module_module.demo.docker/odoo.conf.template:101setswithout_demo = Truefor every instance we ship, so the flag is always False and every evaluation instance loses all nine demo personas at install (the TCPP demo script logs in asmanager/officer).odoo-bin -d prod -i …has demo data on by default, sodemo=Trueandsppadmin/demostays live on a real production DB — the exact attack the PR set out to close.-u spp_demo, which reloadsspp_demo/data/users_data.xml(noupdate="0",<field name="password">demo</field>inline). That overwritesspp_farmer_registry_demo'snoupdate="1"login overrides (manager→demo_manager, observed in today's upgrade gate) and resets the passwords on every upgrade, undoing any rotation and restoring the well-known secret under the archive.What happens next
The fix is redesigned around an explicit, auditable opt-in (
ir.config_parameter, default off) instead of the demo flag, plus a password scrub on archive so unarchiving does not restoredemo. It re-lands in batch 4 together with #356, which was already sequenced behind #341. The tracking issue stays open.Squash-merge into
19.0-staging-sec-batch3; recorded in the batch manifest as a revert row.