mathben/erplibre
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
erplibre/test
History
Mathieu Benoit 3f97b0a49c [FIX] security: the KeePass password leaves the command line too 
Same exposure as the master password, same fix. kdbx_manager put the Odoo
password straight into the web_login command; /proc/<pid>/cmdline is
readable by every user on the machine, and no downstream filter reaches
that.

The command now carries the NAME of an environment variable, never the
value. One name per entry, because several credentials go out in a single
"parallel" call and a single variable could not tell them apart.
get_extra_command_user therefore returns (fragments, variables), and the
two call sites hand the variables to exec_command_live, which already
merged an environment.

Two things found on the way. web_login re-sent config.default_password_auth
when it retried after dismissing a modal, ignoring whatever the caller had
passed -- the retry silently fell back to "admin". And install_forgejo
printed the admin password back to the terminal, hence into the install log
and any CI capture; its own header already documents the default.

A test pins the guarantee: the fragment must not contain the password.

--- FR ---

Même exposition que pour le mot de passe maître, même correctif.
kdbx_manager mettait le mot de passe Odoo directement dans la commande
web_login ; /proc/<pid>/cmdline est lisible par tout utilisateur de la
machine, et aucun filtre en aval ne l'atteint.

La commande porte désormais le NOM d'une variable d'environnement, jamais
la valeur. Un nom par entrée, car plusieurs identifiants partent dans un
seul appel « parallel » et une variable unique ne saurait les distinguer.
get_extra_command_user rend donc (fragments, variables), et les deux
appelants confient les variables à exec_command_live, qui fusionnait déjà
un environnement.

Deux trouvailles en chemin. web_login renvoyait config.default_password_auth
à la reprise après une modale, ignorant ce que l'appelant avait fourni — la
reprise retombait en silence sur « admin ». Et install_forgejo réaffichait
le mot de passe administrateur, donc dans le journal d'installation et
toute capture de CI ; son propre en-tête documente déjà le défaut.

Un test verrouille la garantie : le fragment ne doit pas porter le secret.

Assisted-by: Claude Opus 5
2026-08-23 02:11:50 -04:00
..
code_generator [FIX] make test with coverage: missing coverage parameter 2023-03-04 23:34:37 -05:00
mail_sandbox.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_analyse_custom_field.py [ADD] analyse: inspect an Odoo database without restoring it 2026-08-10 03:10:50 -04:00
test_analyse_lib.py [ADD] analyse: inspect an Odoo database without restoring it 2026-08-10 03:10:50 -04:00
test_analyse_schema_size.py [ADD] analyse: inspect an Odoo database without restoring it 2026-08-10 03:10:50 -04:00
test_analyse_view_custom.py [ADD] analyse: diff each website copy against the view it shadows 2026-08-23 02:09:59 -04:00
test_auto_execute.py [ADD] migration: make Enter mean the answer you always give 2026-08-22 07:23:59 -04:00
test_check_addons_exist.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_check_filestore.py [ADD] filestore: purge once at the end, tidy at the restore, see the 30 MB 2026-08-23 02:09:59 -04:00
test_check_hidden_models.py [ADD] migration: repair DMS at the 13 bump, and catch the whole class 2026-08-22 07:24:00 -04:00
test_check_migration_quality.py [ADD] migration quality: lay OpenUpgrade's declared changes over the real ones 2026-08-22 07:24:00 -04:00
test_check_module_package.py [ADD] analyse: offer to install the suggested modules that are ready 2026-08-23 02:09:59 -04:00
test_check_stale_scss.py [FIX] migration: reset the stale SCSS after the bump, not before 2026-08-22 07:23:59 -04:00
test_code_generator_tools.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_config_file.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_database_cleanup.py [ADD] migration: « t » shows where the migration stands 2026-08-22 07:23:59 -04:00
test_database_tools.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_dms_access_repair.py [ADD] migration: repair DMS at the 13 bump, and catch the whole class 2026-08-22 07:24:00 -04:00
test_docker_update_version.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_error_retry_loop.py [ADD] migration: offer the theme uninstall where the theme is blamed 2026-08-22 07:24:00 -04:00
test_execute.py [FIX] todo: test menu, file browser and KeePass refusals 2026-08-16 03:56:34 -04:00
test_fix_view_type.py [ADD] migration: convert the <tree> tags Odoo 18 renamed to <list> 2026-08-22 07:24:00 -04:00
test_format_file_to_commit.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_git_tool.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_install_swig_compat.py [FIX] install : compiler pykcs11 avec SWIG 4.3 et au-delà 2026-08-23 02:11:50 -04:00
test_iscompatible.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_kdbx_manager.py [FIX] todo: test menu, file browser and KeePass refusals 2026-08-16 03:56:34 -04:00
test_kill_process_by_port.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00
test_mail_account_setup.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_accounts.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_charset.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_compose.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_crypto.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_imap_transport.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_live_server.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_menu.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_secrets.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_send.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_store.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_sync.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_account.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_help.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_layout.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_log.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_refresh.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_resize.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_splitter.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_mail_tui_text.py [ADD] mail: read and send email from the TODO CLI 2026-08-16 03:56:34 -04:00
test_master_password_retry.py [FIX] db_restore: ask the master password again instead of dying on a typo 2026-08-23 02:09:59 -04:00
test_migration_form_back.py [ADD] migration: offer « go back to a step » on the resume screen 2026-08-22 07:23:59 -04:00
test_migration_status.py [ADD] migration: repair views whose stored type contradicts their parent 2026-08-22 07:24:00 -04:00
test_migration_tools_i18n.py [FIX] migration: the COW tools speak the system language 2026-08-22 07:23:59 -04:00
test_mobile_bundle_transfer.py [ADD] make: une cible pour les tests unitaires, dépendance mobile déclarée 2026-08-23 02:11:50 -04:00
test_openupgrade_analysis.py [ADD] migration quality: lay OpenUpgrade's declared changes over the real ones 2026-08-22 07:24:00 -04:00
test_plan.base.md [ADD] test: add bilingual test plan with mmg 2026-03-11 23:07:01 -04:00
test_plan.fr.md [ADD] test: add bilingual test plan with mmg 2026-03-11 23:07:01 -04:00
test_plan.md [ADD] test: add bilingual test plan with mmg 2026-03-11 23:07:01 -04:00
test_prompt_defaults.py [ADD] migration: announce the countdown, and cycle three panel states 2026-08-22 07:23:59 -04:00
test_qemu_desktop_tools.py [FIX] script todo: régler l'écran de l'émulateur au lancement, densité comprise 2026-08-23 02:07:42 -04:00
test_qemu_emulator_menu.py [ADD] qemu : prendre le GPU de l'hôte, et régler le matériel des VM 2026-08-23 02:07:42 -04:00
test_qemu_forgejo.py [ADD] script todo: ouvrir l'écran d'une VM avec virt-viewer 2026-08-23 02:07:42 -04:00
test_qemu_gpu.py [ADD] qemu : régler le mode CPU, les écrans et le réseau d'une VM 2026-08-23 02:07:42 -04:00
test_qemu_install_summary.py [FIX] script todo: résumer les erreurs au lieu de chercher « error » 2026-08-23 02:07:42 -04:00
test_qemu_monitor_telemetry.py [ADD] script todo: dire depuis quand un journal d'installation est muet 2026-08-23 02:07:42 -04:00
test_qemu_motd.py [ADD] qemu guide: dire comment démarrer le bureau, sur les VM qui en ont un 2026-08-23 02:07:42 -04:00
test_qemu_tunnel_menu.py [ADD] script todo: ouvrir l'écran d'une VM avec virt-viewer 2026-08-23 02:07:42 -04:00
test_qemu_vm_table.py [IMP] script todo: RAM utilisée et uptime dans les infos avancées d'une VM 2026-08-23 02:07:42 -04:00
test_reset_stale_cow_prompt.py [ADD] migration: repair views whose stored type contradicts their parent 2026-08-22 07:24:00 -04:00
test_reset_stale_cow_tui.py [ADD] migration: repair views whose stored type contradicts their parent 2026-08-22 07:24:00 -04:00
test_script_permissions.py [FIX] test: check the exec bit git stores, not the mode umask decides 2026-08-22 07:23:59 -04:00
test_smoke_final_url.py [FIX] smoke: two sites still unpacked three fields from the failure tuple 2026-08-23 02:07:42 -04:00
test_smoke_internal_ui.py [FIX] smoke: judge the back office AFTER the repair, and say why it failed 2026-08-22 07:23:59 -04:00
test_smoke_public_url.py [FIX] smoke: name the URL that actually failed, keep the previous log 2026-08-23 02:07:42 -04:00
test_target_version_default.py [ADD] migration: an auto-run that takes the default after five seconds 2026-08-22 07:23:59 -04:00
test_theme_on_error.py [ADD] migration: offer the theme uninstall where the theme is blamed 2026-08-22 07:24:00 -04:00
test_todo.py [FIX] security: the KeePass password leaves the command line too 2026-08-23 02:11:50 -04:00
test_todo_file_browser.py [FIX] todo: test menu, file browser and KeePass refusals 2026-08-16 03:56:34 -04:00
test_todo_i18n.py [FIX] todo: test menu, file browser and KeePass refusals 2026-08-16 03:56:34 -04:00
test_todo_menu.py [ADD] test: apparier l'affichage et le dispatch du menu QEMU 2026-08-23 02:07:42 -04:00
test_todo_upgrade_archive.py [ADD] migration: keep the previous log when a run restarts 2026-08-17 01:25:23 -04:00
test_todo_upgrade_cow_prompt.py [ADD] migration: make Enter mean the answer you always give 2026-08-22 07:23:59 -04:00
test_todo_upgrade_steps.py [ADD] migration: offer « go back to a step » on the resume screen 2026-08-22 07:23:59 -04:00
test_tooling_requirements.py [ADD] test: what the tooling imports must be declared 2026-08-17 00:40:01 -04:00
test_uninstall_addons_theme.py [ADD] migration: make Enter mean the answer you always give 2026-08-22 07:23:59 -04:00
test_version.py [IMP] script: update copyright year to 2026 2026-03-11 23:16:05 -04:00