Skip to content

Respect provided live-view credentials #243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aryanputta wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Respect provided live-view credentials #243

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions images/chromium-headful/client/src/components/connect.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,8 +102,13 @@
displayname = this.$accessor.displayname || usr
}

// KERNEL: auto-login
this.$accessor.login({ displayname: 'kernel', password: 'admin' })
// KERNEL: auto-login, but respect caller-supplied credentials first.
Copy link
Copy Markdown

@cursor cursor Bot May 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

URL usr param ignored when persisted displayname exists

High Severity

The pwd and usr URL parameters are handled inconsistently. For pwd, the URL param unconditionally overrides the persisted this.$accessor.password. But for usr, line 102 does displayname = this.$accessor.displayname || usr, meaning the persisted displayname takes precedence and the URL usr value is silently discarded. Before this PR the inconsistency was harmless because both values were thrown away. Now that the login call actually uses them, a credential-bearing embed link like ?usr=bob&pwd=secret will authenticate with the correct password but the wrong username whenever a persisted displayname exists.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1b7411d. Configure here.

// This keeps the legacy fallback for existing deployments while allowing
// embeds and links that provide explicit credentials to work as intended.
this.$accessor.login({
displayname: displayname || 'kernel',
password: password || 'admin',
})
this.autoPassword = null
}

Expand Down