mirror of
https://github.com/Av0idD4rk/firegex.git
synced 2026-10-23 21:42:05 +00:00
2c3316b036
Rename the flag to --unsafe-disable-auth so the risk is visible at the call site, and close the ways the mode could outlive itself: - Keep an explicit -P/--startup-psw instead of dropping it. Without a password in the database, --no-unsafe-disable-auth brought firegex up in its initial-setup state, where anyone able to reach it could choose the password. - Refuse /api/login, /api/set-password and /api/change-password while authentication is disabled: an anonymous caller could otherwise plant a credential that kept working once authentication was turned back on. run.py config --password still works, writing to the database from the host. - Print a banner on every start/restart with authentication disabled. The flag is persisted in the config file, so a later bare `run.py start` inherits it. - Report the change in `run.py config --unsafe-disable-auth`, which claimed "No configuration changes specified" while persisting it, and stop that command from nulling the stored port and host on the way. - Expose the state as auth_disabled in /api/status and hide the logout button and the change-password entry, which were silent no-ops in this mode. Tests cover both directions of the toggle, the socket.io handler, the password endpoints and the -P handling.
28 lines
525 B
Python
28 lines
525 B
Python
from pydantic import BaseModel
|
|
|
|
class StatusMessageModel(BaseModel):
|
|
status:str
|
|
|
|
class StatusModel(BaseModel):
|
|
status: str
|
|
loggined: bool
|
|
version: str
|
|
auth_disabled: bool = False
|
|
|
|
class PasswordForm(BaseModel):
|
|
password: str
|
|
|
|
class PasswordChangeForm(BaseModel):
|
|
password: str
|
|
expire: bool
|
|
|
|
class ChangePasswordModel(BaseModel):
|
|
status: str
|
|
access_token: str|None = None
|
|
|
|
class IpInterface(BaseModel):
|
|
addr: str
|
|
name: str
|
|
|
|
class ResetRequest(BaseModel):
|
|
delete:bool |