3 ms·

If you're going to hardcode a password like this (and I think this is one of the rare situations where it could actually make sense to do it) you need to also e

If you're going to hardcode a password like this (and I think this is one of the rare situations where it could actually make sense to do it) you need to also ensure that this hardcoded password: 1. Can't be used to login, ever. 2. Can't be used as an actual password.

diarrhea 5y ago
Then what’s the use of the password?
- mikeryan 5y ago
  It looks like it was used for tests. I don't know how it would escalate to use on a production system, but the commit for the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/e2fb87ec5d4e235d6b83454980cec9c049849a1c#5c0ba240988a5482dcc1747338da4852f51c668a https://gitlab.com/gitlab-org/gitlab/-/commit/e2fb87ec5d4e23...
  - mikeryan 5y ago
    Oh someone used the test fixture in lib/gitlab/auth/o_auth/user.rb
    - bspammer 5y ago
      This is why test code should be impossible to import in non-test code. It should be part of the build infrastructure for the language.
- jaywalk 5y ago
  From what I gathered, it was used as a placeholder for user accounts that were created via federated login. So the user would never actually be logging in to Gitlab directly with a password.
  - cortesoft 5y ago
    Why not just randomly generate it each time, then?
    - leaflets2 5y ago
      Maybe there are auto tests, which would have been simpler to create, if the password was static