search

SpectrumIM / spectrum2

Spectrum 2 IM transports
https://spectrum.im
408 stars 91 forks source link

Reject empty password and "test" for the webinterface. #459

Closed coldtobi closed 1 year ago

coldtobi commented 1 year ago

Well, this is aimed to protect the unaware or the dontcare for inadvertently opening up their spectrum2 webinterface to the world, creating all sorts of security issues on the way…

(I'm using this patch for the Debian package for a hardened default setup; when the user installs the webinterface package, this will automatically also start it, so this is needed for an secure user experience…)

vitalyster commented 1 year ago

This will break Docker Compose example, as it uses different config copy - https://github.com/SpectrumIM/spectrum2/tree/master/tests/xmpp/configuration

coldtobi commented 1 year ago

@vitalyster commited a proposal for a random password generation.