josh/ytplayer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Admin login: ignore surrounding spaces/quotes in a pasted password; show-password toggle

Browse Source
This commit is contained in:
Jonathan Sykes
2026-10-15 11:52:41 +08:00
parent b6e019c352
commit 7ceefa3d6a
2 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/notes.js
View File

@@ -628,8 +628,9 @@ export function registerNoteRoutes(app, deps) {
if (fails.length >= 10) return c.json({ ok: false, error: 'too many attempts — try again later' }, 429);
let body = {};
try { body = await c.req.json(); } catch { /* treated as empty password */ }
const given = createHash('sha256').update(String(body.password || '')).digest();
const want = createHash('sha256').update(adminPassword).digest();
// A pasted password often carries a stray space or line break.
const given = createHash('sha256').update(String(body.password || '').trim()).digest();
const want = createHash('sha256').update(adminPassword.trim()).digest();
if (!timingSafeEqual(given, want)) {
fails.push(now);
failedLogins.set(ip, fails);