danolo
/
rss-bridge
mirror of https://github.com/danoloan10/rss-bridge
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: disallow usage of default password (#3284)

This commit is contained in:
Dag 2023-03-06 20:43:44 +01:00 committed by GitHub
parent f0e5ef0fc5
commit a01c1f6ab0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config.default.ini.php
View File

@ -75,8 +75,8 @@ enable = false
username = "admin"
; This default password is public knowledge. Replace it.
password = "7afbf648a369b261"
; The password cannot be the empty string if authentication is enabled.
password = ""
; This will be used only for actions that require privileged access
access_token = ""

7
lib/AuthenticationMiddleware.php
View File

@ -14,6 +14,13 @@
final class AuthenticationMiddleware
{
public function __construct()
{
if (Configuration::getConfig('authentication', 'password') === '') {
throw new \Exception('The authentication password cannot be the empty string');
}
}
public function __invoke(): void
{
$user = $_SERVER['PHP_AUTH_USER'] ?? null;

2
lib/RssBridge.php
View File

@ -63,8 +63,8 @@ final class RssBridge
// Consider: ini_set('error_reporting', E_ALL & ~E_DEPRECATED);
date_default_timezone_set(Configuration::getConfig('system', 'timezone'));
$authenticationMiddleware = new AuthenticationMiddleware();
if (Configuration::getConfig('authentication', 'enable')) {
$authenticationMiddleware = new AuthenticationMiddleware();
$authenticationMiddleware();
}