-
Notifications
You must be signed in to change notification settings - Fork 39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security issue with adding new users without LDAP #109
Comments
This sounds like a great addition. Can you create a pull request and I will merge it? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When using the admin CLI, one can only add a new user with a password given in the command line. This way the password is visible for all users in the process list (despite for only a short moment) and in my Bash command history.
I did a workaround of creating a 6-line NodeJS program which itself calls bcrypt and outputs the password hash. Then I was able to add this to
.users.json
. Afterwards I had the idea to refer to an input file which would contain the password. I added an option for this, see attached diff: admin.diff.txtThe text was updated successfully, but these errors were encountered: