usmannasir / cyberpanel

Cyber Panel - The hosting control panel for OpenLiteSpeed
GNU General Public License v3.0
1.49k stars 582 forks source link

[ Security ] Insecure password generation #1126

Closed Lvl4Sword closed 10 months ago

Lvl4Sword commented 10 months ago

https://github.com/usmannasir/cyberpanel/blob/stable/plogical/randomPassword.py uses random, which the documentation ( https://docs.python.org/3/library/random.html ) specifically states not to do so for this purpose:

Warning

The pseudo-random generators of this module should not be used for security purposes. For security or cryptographic uses, see the secrets module.

The fix here would be something like:

import secrets

alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
the_password = [secrets.choice(alphabet) for x in range(14)]
print(''.join(the_password))
usmannasir commented 10 months ago

I will go through this.

usmannasir commented 10 months ago

Fixed.