hostapd.conf contains AP password. The file must not be world readable.

[vbotka]

Hi,

when browsing your code I fixed the permissions of etc/hostapd/hostapd.conf HTH

Cheers, -vlado

[letompouce]

First of all, thank you for taking the time to improve this point.

To explain how such things can happen, one need to understand the particular context in which these devices are deployed:

• first of all, no shell access is provided for end users, we are the only ones to possibly be able to read this file.
• if an attacker managed to get a shell, then we would have other worries than the leak of the Wifi hotspot password...
• which will end up written on the wall anyway (users need this password to access the device).

However we recognize that this is bad practice :-) Merged and cherry-picked to the oneUpdateFile branch.