Repository navigation
fix: strip the development forum's accounts and sessions from the Flarum seed - #9127
Conversation
…rum seed bin/forum/flarum.sql was dumped from a development forum and still held its member accounts, login sessions, visit logs with IP addresses, and an API key that the dashboard's forum sign-up sent. Give the seeded accounts placeholder emails and no password, drop the sessions, the API key and the visit log, and clear the posts' IP addresses. Sign-up does not need the key: the seed already allows open sign-up, so the key only let FlarumService.register skip Flarum's CSRF check. bin/extend.php exempts the sign-up route instead, and both install scripts copy it into the forum.
github-actions
Bot
added
ddl-change
Automated Reviewer SuggestionsBased on the
|
Yicong-Huang
added
release/v1.3
Backport auto-label reportThis
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9127 +/- ##
============================================
+ Coverage 91.87% 92.80% +0.92%
- Complexity 5049 6309 +1260
============================================
Files 1265 1278 +13
Lines 54915 67060 +12145
Branches 6940 9349 +2409
============================================
+ Hits 50453 62233 +11780
- Misses 2769 2982 +213
- Partials 1693 1845 +152
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
🟡 Changes recommended
Freshly seeded forums have no usable administrator, and neither installer provisions a replacement.
No open issues 🎉
What changed in this PR
This PR sanitizes the development Flarum seed while preserving Texera’s optional forum integration and existing posts.
Changes:
- Removes seeded credentials, sessions, visit logs, and post IP addresses.
- Replaces API-key-based registration with a signup-route CSRF exemption installed by both setup scripts.
- Updates the registration test and documents the new extender file.
| File | Description |
|---|---|
frontend/src/app/dashboard/service/user/flarum/flarum.service.ts |
Removes the hard-coded registration authorization header. |
frontend/src/app/dashboard/service/user/flarum/flarum.service.spec.ts |
Checks that registration sends no authorization header. |
bin/README.md |
Lists the Flarum extender file. |
bin/forum/ubuntu-install.sh |
Copies the extender into Ubuntu installations. |
bin/forum/macos-install.sh |
Copies the extender into macOS installations. |
bin/forum/flarum.sql |
Sanitizes accounts and removes authentication and IP data. |
bin/extend.php |
Exempts the signup route from CSRF checks. |
Review effort: Balanced
|
| config | throughput | MB/s | latency | max Δ latest / 7d | |
|---|---|---|---|---|---|
| 🟢 | bs=10 sw=10 sl=64 | 563 | 0.343 | 16,777/23,319/23,319 us | 🟢 -5.4% / 🔴 +63.8% |
| 🔴 | bs=100 sw=10 sl=64 | 1,217 | 0.743 | 81,208/102,627/102,627 us | 🔴 +6.3% / 🟢 -8.7% |
| 🔴 | bs=1000 sw=10 sl=64 | 1,374 | 0.838 | 717,755/826,779/826,779 us | 🔴 +8.5% / 🟢 -17.8% |
Baseline details
Latest main 98c6337 from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---|---|---|---|---|
| bs=10 sw=10 sl=64 | throughput | 563 tuples/sec | 554 tuples/sec | 879.16 tuples/sec | +1.6% | -36.0% |
| bs=10 sw=10 sl=64 | MB/s | 0.343 MB/s | 0.338 MB/s | 0.537 MB/s | +1.5% | -36.1% |
| bs=10 sw=10 sl=64 | p50 | 16,777 us | 17,731 us | 11,504 us | -5.4% | +45.8% |
| bs=10 sw=10 sl=64 | p95 | 23,319 us | 24,279 us | 14,234 us | -4.0% | +63.8% |
| bs=10 sw=10 sl=64 | p99 | 23,319 us | 24,279 us | 17,338 us | -4.0% | +34.5% |
| bs=100 sw=10 sl=64 | throughput | 1,217 tuples/sec | 1,222 tuples/sec | 1,147 tuples/sec | -0.4% | +6.1% |
| bs=100 sw=10 sl=64 | MB/s | 0.743 MB/s | 0.746 MB/s | 0.7 MB/s | -0.4% | +6.1% |
| bs=100 sw=10 sl=64 | p50 | 81,208 us | 80,508 us | 88,987 us | +0.9% | -8.7% |
| bs=100 sw=10 sl=64 | p95 | 102,627 us | 96,524 us | 96,473 us | +6.3% | +6.4% |
| bs=100 sw=10 sl=64 | p99 | 102,627 us | 96,524 us | 102,791 us | +6.3% | -0.2% |
| bs=1000 sw=10 sl=64 | throughput | 1,374 tuples/sec | 1,395 tuples/sec | 1,182 tuples/sec | -1.5% | +16.3% |
| bs=1000 sw=10 sl=64 | MB/s | 0.838 MB/s | 0.851 MB/s | 0.721 MB/s | -1.5% | +16.2% |
| bs=1000 sw=10 sl=64 | p50 | 717,755 us | 716,550 us | 872,751 us | +0.2% | -17.8% |
| bs=1000 sw=10 sl=64 | p95 | 826,779 us | 761,914 us | 910,151 us | +8.5% | -9.2% |
| bs=1000 sw=10 sl=64 | p99 | 826,779 us | 761,914 us | 941,479 us | +8.5% | -12.2% |
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,355.52,200,128000,563,0.343,16777.43,23319.21,23319.21
1,100,10,64,20,1643.91,2000,1280000,1217,0.743,81207.69,102627.22,102627.22
2,1000,10,64,20,14559.44,20000,12800000,1374,0.838,717755.28,826779.49,826779.49
What changes were proposed in this PR?
bin/forum/flarum.sqlwas dumped from a development forum and still held its member accounts, login sessions, visit logs with IP addresses, and an API key that the dashboard's forum sign-up sent.flarum.sql: the three seeded accounts get placeholder emails (@example.com) and no password, so their posts stay but nobody can sign in as them. The sessions, the API key and the visit log are dropped, and the posts' IP addresses are cleared.allow_sign_up = 1), so the key only letFlarumService.registerskip Flarum's CSRF check. The newbin/extend.phpexempts the sign-up route instead (by default Flarum exempts only login), and both install scripts copy it into the forum.Any related issues, documentation, discussions?
Closes #9126. Independent of #9005, which is under discussion in #9006.
How was this PR tested?
flarum.service.spec.tsnow checks that sign-up sends noAuthorizationheader. It passes, and fails against the old service.extend.php, sign-up is rejected by the CSRF check without it, and the seeded accounts cannot sign in.Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (claude-opus-5-5)