search

moqui / moqui-runtime

The default runtime directory for Moqui Framework
Other
37 stars 79 forks source link

Add ADMIN_ADV to EX_JOHN_DOE user #204

Closed acetousk closed 2 years ago

acetousk commented 2 years ago

Reasoning: If john.doe doesn't have a feature visible, it's not obvious if a feature exists in Moqui.

Might as well make it easy for local setups to be able to have john.doe see the groovy shell, and sql runner so that people know they exist and is easy to find on setup or demo.moqui.org

jonesde commented 2 years ago

We might as well... the demo server is another issue. Right now it's a big fat liability for the poor sap who runs it because anyone can put any data there, including illegal data. It gets cleaned out every day, but if anyone wanted to host anything there a little script that runs after the server update each day would get around that.

FWIW, at some point I'd like to do one or more of the following:

  1. make the demo server 100% read only (probably via artifact authc in a demo component)
  2. change the EX_JOHN_DOE and all other demo users to have more limited authz (system, tools, etc read only access) (in a demo component)
  3. disable all binary uploads (images, pdfs, etc)

There might be other mitigations that are less intrusive. If anything were to happen my first step would be shut down the demo server, and bring it up once some sort of read-only mode is ready. I've been tempted to do that just in case. Allowing more than that would be nice though...