mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
GRAB Racem
2aab3e8210
POST /api/auth/init accepted any caller while auth.password_hash was empty, so whoever reached port 8787 first could set the admin password and take the instance. When no password is set at startup, the server now generates a random one-time setup token and writes it to the server log. authInit compares it in constant time, rejects a missing or wrong token with 403, and clears it once the password is stored. The setup page has a field for the token and api.initPassword sends it. docker-compose publishes 8787 on 127.0.0.1 only, like 8788. README says where to find the token.