mirror of
https://github.com/fusion44/blitz_api.git
synced 2026-08-13 11:52:45 +02:00
c4afca50e9
The change-password endpoint accepted old_password/new_password as bare str parameters, i.e. query parameters, so the passwords ended up in access logs, proxy logs and browser history. Accept them in a ChangePasswordInput request body instead. Also mark the RaspiBlitz blitz.passwords.sh check/set invocations sensitive=True so the plaintext passwords are not written to the debug log, and guard against a missing password type (was an AttributeError -> 500). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api | ||
| apps | ||
| auth | ||
| bitcoind | ||
| external | ||
| lightning | ||
| setup | ||
| system | ||
| __init__.py | ||
| celery_app.py | ||
| logging.py | ||
| main.py | ||
| server.py | ||