From d169b85f54321f41c11d6c81497ef2de48d23592 Mon Sep 17 00:00:00 2001 From: Dillard Blom Date: Tue, 14 Jul 2026 15:58:47 +0200 Subject: [PATCH] Fold email columns into init.sql, drop the admin/admin demo mention Fresh installs (docker compose up -d --build, exactly what the README tells a new self-hoster to run) never got the email/must_set_email/ self_registered_at columns added in migration 006 - only init.sql runs automatically, migrations always need a manual step, and this one never got folded into the base schema. A genuine first-time clone would have broken immediately on login. Verified with a real fresh volume: seed superadmin now correctly walks through forced password change -> forced email set -> dashboard, no manual migration needed. Also: qr.ensembia.com's README/About text still pointed at the shared admin/admin demo login - replaced with a link to register.php now that self-registration is live (the shared account has been removed from the live instance). --- README.md | 4 ++-- db/init.sql | 12 +++++++++--- src/about.php | 5 +++-- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index c98ba9d..328bb03 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,8 @@ of the original [PHP Dynamic Qr code](https://github.com/giandonatoinverso/PHP-D project by Giandonato Inverso, built on [AdminLTE](https://adminlte.io/). - **Try it free:** [qr.ensembia.com](https://qr.ensembia.com) - fully functional OSS test - instance. Self-service signup isn't live yet, so log in with the temporary shared demo - account `admin` / `admin` in the meantime. + instance. [Register your own free account](https://qr.ensembia.com/register.php) + (email + a self-hosted CAPTCHA, no third-party service) - no shared demo login needed. - **Commercial VIP edition:** the ability to give sub-users the ability to create QR codes as well, from their own (sub)account. If you have a bigger organisation, having more users being able to create new QR codes delegates your workload. To diff --git a/db/init.sql b/db/init.sql index 0969941..44027ab 100644 --- a/db/init.sql +++ b/db/init.sql @@ -19,14 +19,20 @@ CREATE TABLE IF NOT EXISTS `users` ( `can_view_static` tinyint(1) NOT NULL DEFAULT 0, `can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0, `owner_admin_id` int(25) DEFAULT NULL, + `email` varchar(255) DEFAULT NULL, + `must_set_email` tinyint(1) NOT NULL DEFAULT 0, + `self_registered_at` datetime DEFAULT NULL, PRIMARY KEY (`id`), - UNIQUE KEY `username` (`username`) + UNIQUE KEY `username` (`username`), + UNIQUE KEY `email` (`email`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ; -- Default super admin account. Credentials: superadmin / superadmin -- must_change_password=1 forces a password change on first login (see Fase 1 hardening). -INSERT INTO `users` (`id`, `username`, `password`, `series_id`, `remember_token`, `expires`, `type`, `must_change_password`, `password_changed_at`) VALUES -(1, 'superadmin', '$2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG', NULL, NULL, NULL, 'super', 1, NULL); +-- must_set_email=1: no email yet, so login falls back to username until it's set (same +-- one-time interstitial pre-migration accounts get - see set_email.php). +INSERT INTO `users` (`id`, `username`, `password`, `series_id`, `remember_token`, `expires`, `type`, `must_change_password`, `password_changed_at`, `must_set_email`) VALUES +(1, 'superadmin', '$2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG', NULL, NULL, NULL, 'super', 1, NULL, 1); CREATE TABLE IF NOT EXISTS `dynamic_qrcodes` ( `id` int(10) NOT NULL AUTO_INCREMENT, diff --git a/src/about.php b/src/about.php index 9e4f0c5..75861f9 100644 --- a/src/about.php +++ b/src/about.php @@ -51,8 +51,9 @@ require_once BASE_PATH . '/includes/auth_validate.php'; This is the free, open-source (MIT) edition of QRForge. It runs unmodified as a live, fully functional try-out at qr.ensembia.com - - self-service signup isn't live yet, so log in with the temporary shared - demo account admin / admin in the meantime. + register your + own free account there (email + a self-hosted CAPTCHA, no third-party + service).

The commercial VIP edition (paid create-rights and logo-embedded QR codes)