Repository navigation
fix(v1.2): strip the development forum's accounts and sessions from the Flarum seed - #9131
Open
github-actions[bot] wants to merge 2 commits into
Open
github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
…rum seed (#9127) ### What changes were proposed in this PR? `bin/forum/flarum.sql` was dumped from a development forum and still held its member accounts, login sessions, visit logs with IP addresses, and an API key that the dashboard's forum sign-up sent. - `flarum.sql`: the three seeded accounts get placeholder emails (`@example.com`) and no password, so their posts stay but nobody can sign in as them. The sessions, the API key and the visit log are dropped, and the posts' IP addresses are cleared. - Sign-up without the key: the seed already allows open sign-up (`allow_sign_up = 1`), so the key only let `FlarumService.register` skip Flarum's CSRF check. The new `bin/extend.php` exempts the sign-up route instead (by default Flarum exempts only login), and both install scripts copy it into the forum. ### Any related issues, documentation, discussions? Closes #9126. Independent of #9005, which is under discussion in #9006. ### How was this PR tested? - `flarum.service.spec.ts` now checks that sign-up sends no `Authorization` header. It passes, and fails against the old service. - On Flarum 1.8.5 (the seed's version) with the cleaned seed: the seed imports, sign-up then login works with `extend.php`, sign-up is rejected by the CSRF check without it, and the seeded accounts cannot sign in. ### Was this PR authored or co-authored using generative AI tooling? (backported from commit d108cc1) Generated-by: Claude Code (claude-opus-5-5)
Contributor
Author
|
The cherry-pick conflicted and was committed with conflict markers. Resolve the conflicts on this branch, then mark this PR ready for review. Conflicting files:
|
mengw15
marked this pull request as ready for review
October 27, 2026 22:53
github-actions
Bot
added
ddl-change
Contributor
Author
Automated Reviewer SuggestionsBased on the
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release/v1.2 #9131 +/- ##
===============================================
Coverage 53.47% 53.47%
Complexity 2569 2569
===============================================
Files 1078 1078
Lines 42359 42358 -1
Branches 4563 4563
===============================================
Hits 22651 22651
+ Misses 18396 18395 -1
Partials 1312 1312
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this PR?
Automated backport of #9127 to
release/v1.2.Source: d108cc1 · automation run
Any related issues, documentation, discussions?
Backport of #9127. Originally linked #9126.
How was this PR tested?
Release-branch CI runs on this branch once the conflicts are resolved and this PR is marked ready for review.
Was this PR authored or co-authored using generative AI tooling?
No.