Fix hardcoded default credentials in Preferences#82
Conversation
- Removed hardcoded "admin" username and password from Preferences.java - Modified LoginController.java to detect missing credentials and enable "Create Account" mode - Updated login.fxml to inject loginButton for text updates - Added PreferencesTest.java to verify constructor and password logic - Added AlertMaker.java stub for testing purposes Co-authored-by: G30RG3-GJ <203693057+G30RG3-GJ@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
This PR addresses a security vulnerability where default administrative credentials ("admin"/"admin") were hardcoded in the
Preferencesclass.Changes:
src/library/assistant/ui/settings/Preferences.java: Removed the default username and password assignments from the constructor.src/library/assistant/ui/login/LoginController.java: Implemented logic to detect if the username is not set (indicating a fresh install). In this case, the login button text changes to "Create Account", and the entered credentials are saved as the new admin account. Passwords are now consistently hashed before storage to ensure compatibility with the login check.src/library/assistant/ui/login/login.fxml: Addedfx:idto the login button to allow programmatic text updates.test/library/assistant/ui/settings/PreferencesTest.java: Added unit tests to verify thatPreferencesinitializes without credentials and that password setting logic works as expected.test/stubs/library/assistant/alert/AlertMaker.java: Added a stub forAlertMakerto allow compilingPreferences(which depends on it) in a headless test environment without JavaFX dependencies.This ensures that new installations require the user to set up an admin account securely instead of relying on weak default credentials. Existing installations with a valid
config.txtare unaffected.PR created automatically by Jules for task 6856492211444846842 started by @G30RG3-GJ