Stowage/rest-server
2
0
Fork 0
mirror of https://github.com/restic/rest-server.git synced 2025-10-19 07:33:21 +00:00
Code Issues Projects Releases Packages Wiki Activity

restrict umask of htpasswd file

Browse source
This commit is contained in:
Michael Eischer 2025-04-14 22:25:59 +02:00
parent 0ed9de379e
commit 95538fe956
2 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
changelog/unreleased/issue-318 Normal file
View file

@ -0,0 +1,13 @@
Security: Fix world-readable permissions on new `.htpasswd` files
On startup the rest-server Docker container creates an empty `.htpasswd` file
if none exists yet. This file was world-readable by default, which can be
a security risk, even though the file only contains hashed passwords.
This has been fixed such that new `.htpasswd` files are no longer world-readabble.
The permissions of existing `.htpasswd` files must be manually changed
if relevant in your setup.
https://github.com/restic/rest-server/issues/318
https://github.com/restic/rest-server/pull/340

2
docker/entrypoint.sh
View file

@ -6,7 +6,7 @@ if [ -n "$DISABLE_AUTHENTICATION" ]; then
OPTIONS="--no-auth $OPTIONS" OPTIONS="--no-auth $OPTIONS"
else else
if [ ! -f "$PASSWORD_FILE" ]; then if [ ! -f "$PASSWORD_FILE" ]; then
touch "$PASSWORD_FILE" ( umask 027 && touch "$PASSWORD_FILE" )
fi fi
if [ ! -s "$PASSWORD_FILE" ]; then if [ ! -s "$PASSWORD_FILE" ]; then