GlcoinCore/blitz_api
1
0
Fork 0
mirror of https://github.com/fusion44/blitz_api.git synced 2026-08-15 12:10:12 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
blitz_api/app/system/impl
History
fusion44 c4afca50e9
fix(system): stop leaking passwords via change-password endpoint 
The change-password endpoint accepted old_password/new_password as bare
str parameters, i.e. query parameters, so the passwords ended up in
access logs, proxy logs and browser history. Accept them in a
ChangePasswordInput request body instead.

Also mark the RaspiBlitz blitz.passwords.sh check/set invocations
sensitive=True so the plaintext passwords are not written to the debug
log, and guard against a missing password type (was an AttributeError
-> 500).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 21:42:25 +02:00
..
native_python.py feat: replace call_script func with better func 2025-05-06 09:16:46 +02:00
raspiblitz.py fix(system): stop leaking passwords via change-password endpoint 2026-07-03 21:42:25 +02:00
raspiblitz_utils.py #179 add identity_uri to ln_info_lite (#183) 2022-12-20 07:43:37 +01:00
README.md refactor: switch to domain driven directory layout 2022-10-03 20:22:00 +02:00
system_base.py feat: update Python and Devenv deps 2026-02-03 11:04:41 +01:00

README.md

System Implementation

APIPlatform RaspiBlitz

Get all necessary information from Redis

APIPlatform Native Python

Get all necessary from .env file and/or native python libraries