From df240c0b877667a115bfa686471c25fa2580f048 Mon Sep 17 00:00:00 2001 From: fusion44 Date: Sun, 16 Aug 2026 11:56:09 +0200 Subject: [PATCH] fix(system): quote the password type in the shell calls `type` is interpolated into the blitz.passwords.sh command string. It is already constrained to a|b|c before use, so this is defence in depth rather than a fix for a reachable bug -- but the quoting should not depend on a check several lines away. Co-Authored-By: Claude Fable 5 --- app/system/impl/raspiblitz.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/app/system/impl/raspiblitz.py b/app/system/impl/raspiblitz.py index d15f68b..4020c77 100644 --- a/app/system/impl/raspiblitz.py +++ b/app/system/impl/raspiblitz.py @@ -289,7 +289,7 @@ class RaspiBlitzSystem(SystemBase): # first check if old password is correct result = await exec_bash_command( - f'/home/admin/config.scripts/blitz.passwords.sh check {type} "{old_password}"', # noqa: E501 + f'/home/admin/config.scripts/blitz.passwords.sh check "{type}" "{old_password}"', # noqa: E501 sensitive=True, ) data = {} @@ -306,7 +306,8 @@ class RaspiBlitzSystem(SystemBase): # second set new password script_call = ( - f'/home/admin/config.scripts/blitz.passwords.sh set {type} "{new_password}"' + "/home/admin/config.scripts/blitz.passwords.sh " + f'set "{type}" "{new_password}"' ) if type == "c": # will set password c of both lnd & core lightning if installed/activated