Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug]: Admin account username and password can be changed on dev demo server

Abierto
  • ¿Algo no está bien?
#4,754 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
58/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
php
Área
authorization, backend

Línea de trabajo

Start in app/Controllers/Employees.php at postSave(), where the username is copied from POST input and the DISALLOW_PASSWORD_CHANGE check gates password changes. Find where person ID 1 (the demo admin) can be identified, then add a guard that rejects username and password changes for that account using the existing Employees.error_updating_demo_admin and Employees.error_password_change_disallowed strings in app/Language/*/Employees.php. Done means both changes are refused for the demo admin while other employees can still be edited.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

🐛 Bug Description

On the dev demo server (https://dev.opensourcepos.org), users logged in as the default user (admin) are able to modify both the username and the password of the account.

Because the server is publicly accessible for testing and evaluation using well-known default credentials (admin / pointofsale), allowing these fields to be updated allows any visitor to lock everyone else out of the demo environment until the container is reset.

✅ Expected Behavior

On demo deployments (or when lockdown flags are enabled):

  • The default demo admin account credentials should be protected from modification.
  • Changes to the demo admin's username should be blocked (or the username field rendered readonly/disabled).
  • Password changes on the demo admin account should be blocked (e.g. returning Employees.error_updating_demo_admin or Employees.error_password_change_disallowed).

📊 Additional AI Generated Information & Code Analysis

Missing Username Restriction:
In app/Controllers/Employees.php, postSave() unconditionally updates $employeeData['username'] from POST input. Even if password changes are restricted, there is currently no check preventing changing the username of person ID 1 / demo admin.

Demo Environment Flag Status:
In app/Controllers/Employees.php, DISALLOW_PASSWORD_CHANGE only gates password changes if the environment variable is explicitly set to true:

if (!empty($this->request->getPost('password')) && ENVIRONMENT != 'testing' && filter_var(getenv('DISALLOW_PASSWORD_CHANGE'), FILTER_VALIDATE_BOOLEAN)) {
    return $this->response->setJSON([
        'success' => false,
        'message' => lang('Employees.error_password_change_disallowed'),
        'id'      => $employeeId
    ]);
}

On dev.opensourcepos.org, this variable either is not set or set to false, allowing password updates to succeed.

Existing Unused Language Strings:
The language files in app/Language/*/Employees.php already contain localized strings designed for this protection that are currently unused in the controller:

'error_updating_demo_admin' => 'You can not change the demo admin user.'
'error_deleting_demo_admin' => 'You can not delete the demo admin user.'
'error_password_change_disallowed' => 'Password changes are disabled in this demo.'

Lenguaje dominante
PHP
Estrellas
4.4k
Forks
2.6k
Merge medio
3 d 2 h
PR fusionados (30 d)
29

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de opensourcepos/opensourcepos

Todos los issues de opensourcepos/opensourcepos

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.