mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-01-21 07:55:00 +00:00
7e599958fe
Closes: #2074 sunil's changes: - Ensure that secret is not asked for a second time after creating admin user and logging in (this happens due to discarding of old session and creating new one). - Ensure that this logic is not applied to user using FreedomBox images who are not required to input the first wizard secret. - Change the name of the session variable for readability. Tests performed: - Without the patch, start first boot wizard on the first browser on a FreedomBox image (or run the file `base64 < /dev/urandom | head -c 16 | sed -e 's+$+\n+' > /var/lib/plinth/firstboot-wizard-secret`). Finish the welcome step with first wizard secret. Then open a second browser or from another computer visit the web interface. The first wizard secret is not asked and user can create an admin account. - Repeat with fresh image again with the patch. To mimic fresh image, one may run `sudo rm -f /var/lib/plinth/plinth.sqlite3` and `echo "password" | | sudo /freedombox/actions/users remove-user tester`. This time when a different browser other than the one that provided the first wizard secret try to access the account creation page, a redirection will occur to welcome page. Providing the first wizard secret takes the user to account creation page. - Accessing network first wizard page or internal pages on second browser also takes one back to the welcome page. - Accessing help pages from second browser requires login. - Accessing account login page from second browser is allowed. After creating the account from first browser, second browser can login and continue the wizard. - Clearing cookies in the middle of the wizard takes the user back to welcome page. - Clear cookies in the middles of the wizard. Visit the wizard, go to first boot welcome page. Provide secret and the wizard will continue where it was left off. - Clear cookies in the middles of the wizard. Visit the wizard, go to first boot welcome page. Access login page, login as admin. Then first wizard secret is not asked. First wizard can be continued. - On a fresh image, simply complete the first wizard. No change to earlier flow is noticed. First wizard secret is only asked once at the beginning. - On a fresh image, remove the file /var/lib/plinth/firstboot-wizard-secret. First wizard can be completed without the secret. [sunil: improvements to original patch by Kirill Schmidt] Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org> Tested-by: Sunil Mohan Adapa <sunil@medhas.org>