Repository navigation
fix(v1.3): strip the development forum's accounts and sessions from the Flarum seed - #9130
Conversation
…rum seed (#9127) ### What changes were proposed in this PR? `bin/forum/flarum.sql` was dumped from a development forum and still held its member accounts, login sessions, visit logs with IP addresses, and an API key that the dashboard's forum sign-up sent. - `flarum.sql`: the three seeded accounts get placeholder emails (`@example.com`) and no password, so their posts stay but nobody can sign in as them. The sessions, the API key and the visit log are dropped, and the posts' IP addresses are cleared. - Sign-up without the key: the seed already allows open sign-up (`allow_sign_up = 1`), so the key only let `FlarumService.register` skip Flarum's CSRF check. The new `bin/extend.php` exempts the sign-up route instead (by default Flarum exempts only login), and both install scripts copy it into the forum. ### Any related issues, documentation, discussions? Closes #9126. Independent of #9005, which is under discussion in #9006. ### How was this PR tested? - `flarum.service.spec.ts` now checks that sign-up sends no `Authorization` header. It passes, and fails against the old service. - On Flarum 1.8.5 (the seed's version) with the cleaned seed: the seed imports, sign-up then login works with `extend.php`, sign-up is rejected by the CSRF check without it, and the seeded accounts cannot sign in. ### Was this PR authored or co-authored using generative AI tooling? (backported from commit d108cc1) Generated-by: Claude Code (claude-opus-5-5)
|
Clean cherry-pick — nothing here was edited by hand. It applied to Close this PR and reopen it to start its required checks. This pull request was opened by After that: approve, and enable auto-merge if you would rather not come back when the checks finish. |
github-actions
Bot
added
ddl-change
Automated Reviewer SuggestionsBased on the
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release/v1.3 #9130 +/- ##
==================================================
- Coverage 94.10% 94.10% -0.01%
+ Complexity 4809 4808 -1
==================================================
Files 1194 1194
Lines 48625 48625
Branches 5864 5864
==================================================
- Hits 45758 45757 -1
Misses 1412 1412
- Partials 1455 1456 +1
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…forum-s-accounts-a-v1.3
|
| config | throughput | MB/s | latency | max Δ latest / 7d | |
|---|---|---|---|---|---|
| 🔴 | bs=10 sw=10 sl=64 | 345 | 0.21 | 28,449/37,136/37,136 us | 🔴 +25.5% / 🔴 +160.9% |
| 🔴 | bs=100 sw=10 sl=64 | 782 | 0.477 | 126,838/155,205/155,205 us | 🔴 +12.6% / 🔴 +60.9% |
| 🔴 | bs=1000 sw=10 sl=64 | 953 | 0.582 | 1,048,128/1,157,594/1,157,594 us | 🔴 +5.5% / 🔴 +27.2% |
Baseline details
Latest main d234118 from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---|---|---|---|---|
| bs=10 sw=10 sl=64 | throughput | 345 tuples/sec | 390 tuples/sec | 879.16 tuples/sec | -11.5% | -60.8% |
| bs=10 sw=10 sl=64 | MB/s | 0.21 MB/s | 0.238 MB/s | 0.537 MB/s | -11.8% | -60.9% |
| bs=10 sw=10 sl=64 | p50 | 28,449 us | 22,668 us | 11,504 us | +25.5% | +147.3% |
| bs=10 sw=10 sl=64 | p95 | 37,136 us | 40,997 us | 14,234 us | -9.4% | +160.9% |
| bs=10 sw=10 sl=64 | p99 | 37,136 us | 40,997 us | 17,338 us | -9.4% | +114.2% |
| bs=100 sw=10 sl=64 | throughput | 782 tuples/sec | 850 tuples/sec | 1,147 tuples/sec | -8.0% | -31.8% |
| bs=100 sw=10 sl=64 | MB/s | 0.477 MB/s | 0.519 MB/s | 0.7 MB/s | -8.1% | -31.9% |
| bs=100 sw=10 sl=64 | p50 | 126,838 us | 113,883 us | 88,987 us | +11.4% | +42.5% |
| bs=100 sw=10 sl=64 | p95 | 155,205 us | 137,817 us | 96,473 us | +12.6% | +60.9% |
| bs=100 sw=10 sl=64 | p99 | 155,205 us | 137,817 us | 102,791 us | +12.6% | +51.0% |
| bs=1000 sw=10 sl=64 | throughput | 953 tuples/sec | 950 tuples/sec | 1,182 tuples/sec | +0.3% | -19.4% |
| bs=1000 sw=10 sl=64 | MB/s | 0.582 MB/s | 0.58 MB/s | 0.721 MB/s | +0.3% | -19.3% |
| bs=1000 sw=10 sl=64 | p50 | 1,048,128 us | 1,054,024 us | 872,751 us | -0.6% | +20.1% |
| bs=1000 sw=10 sl=64 | p95 | 1,157,594 us | 1,097,221 us | 910,151 us | +5.5% | +27.2% |
| bs=1000 sw=10 sl=64 | p99 | 1,157,594 us | 1,097,221 us | 941,479 us | +5.5% | +23.0% |
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,580.43,200,128000,345,0.210,28448.87,37135.56,37135.56
1,100,10,64,20,2557.31,2000,1280000,782,0.477,126837.61,155204.53,155204.53
2,1000,10,64,20,20980.28,20000,12800000,953,0.582,1048128.06,1157594.12,1157594.12
What changes were proposed in this PR?
Automated backport of #9127 to
release/v1.3.Source: d108cc1 · automation run
Any related issues, documentation, discussions?
Backport of #9127. Originally linked #9126.
How was this PR tested?
The backported tree built green before #9127 merged. Release-branch CI runs on this PR once it is reopened — see the comment below.
Was this PR authored or co-authored using generative AI tooling?
No.