mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
21bd56a9f9
Every upstream release and this fork's up to v2.0.0 created the first user as admin/admin. The first-login password change only covered the password the panel generates itself (data/admin_password), so an upgraded installation whose admin never changed the default kept a working admin/admin login with no prompt, on the pages and through API tokens. Migration accounts.0013 marks a user named admin whose password is "admin" with must_change_password: the next login goes to the password change form, and the API refuses the user's tokens until then. Only that one name is checked, so the migration hashes one password at most. Found by upgrading an installation of the upstream release of September 2026 (installer and Docker) to this version: admin/admin still signed in. |
||
|---|---|---|
| .. | ||
| migrations | ||
| templates | ||
| templatetags | ||
| tests | ||
| __init__.py | ||
| apps.py | ||
| auth.py | ||
| checks.py | ||
| forms.py | ||
| lockout.py | ||
| middleware.py | ||
| models.py | ||
| otp.py | ||
| urls.py | ||
| utils.py | ||
| views.py | ||