cphipps/changedetection.io
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security update - Password could be unset from settings form unexpectedly (#808)

Browse Source
This commit is contained in:
dgtlmoon
2022-08-05 00:05:43 +02:00
committed by GitHub
parent e318253f31
commit 6f072b42e8
2 changed files with 43 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
changedetectionio/__init__.py
View File

@@ -703,7 +703,14 @@ def changedetection_app(config=None, datastore_o=None):
return redirect(url_for('settings_page'))
if form.validate():
datastore.data['settings']['application'].update(form.data['application'])
# Don't set password to False when a password is set - should be only removed with the `removepassword` button
app_update = dict(deepcopy(form.data['application']))
# Never update password with '' or False (Added by wtforms when not in submission)
if 'password' in app_update and not app_update['password']:
del (app_update['password'])
datastore.data['settings']['application'].update(app_update)
datastore.data['settings']['requests'].update(form.data['requests'])
if not os.getenv("SALTED_PASS", False) and len(form.application.form.password.encrypted_password):