GlcoinCore/blitz_api
1
0
Fork 0
mirror of https://github.com/fusion44/blitz_api.git synced 2026-08-20 12:57:23 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(system): quote the password type in the shell calls

Browse source 
`type` is interpolated into the blitz.passwords.sh command string. It is
already constrained to a|b|c before use, so this is defence in depth rather
than a fix for a reachable bug -- but the quoting should not depend on a check
several lines away.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
fusion44 2026-08-16 11:56:09 +02:00
parent d51b68fa5d
commit df240c0b87
No known key found for this signature in database
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/system/impl/raspiblitz.py
View file

@ -289,7 +289,7 @@ class RaspiBlitzSystem(SystemBase):
# first check if old password is correct
result = await exec_bash_command(
f'/home/admin/config.scripts/blitz.passwords.sh check {type} "{old_password}"', # noqa: E501
f'/home/admin/config.scripts/blitz.passwords.sh check "{type}" "{old_password}"', # noqa: E501
sensitive=True,
)
data = {}
@ -306,7 +306,8 @@ class RaspiBlitzSystem(SystemBase):
# second set new password
script_call = (
f'/home/admin/config.scripts/blitz.passwords.sh set {type} "{new_password}"'
"/home/admin/config.scripts/blitz.passwords.sh "
f'set "{type}" "{new_password}"'
)
if type == "c":
# will set password c of both lnd & core lightning if installed/activated