GlcoinCore/lnbits
1
0
Fork 0
mirror of https://github.com/lnbits/lnbits.git synced 2026-08-20 13:37:35 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix: /first_install new superuser may duplicate an username (#3787)

Browse source
This commit is contained in:
dni ⚡ 2026-02-13 15:44:52 +01:00
parent 05769240d3
commit 4894b70bad
No known key found for this signature in database
GPG key ID: D1F416F29AD26E87
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lnbits/core/views/auth_api.py
View file

@ -511,15 +511,21 @@ async def update_ui_customization(
async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
if not settings.first_install:
raise HTTPException(HTTPStatus.FORBIDDEN, "This is not your first install")
if settings.first_install_token:
if not data.first_install_token:
raise HTTPException(HTTPStatus.UNAUTHORIZED, "Missing first_install_token.")
if settings.first_install_token != data.first_install_token:
raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid first_install_token.")
account = await get_account_by_username(data.username, False)
if account:
raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.")
account = await get_account(settings.super_user)
if not account:
raise HTTPException(HTTPStatus.INTERNAL_SERVER_ERROR, "Superuser not found.")
account.username = data.username
account.extra = account.extra or UserExtra()
account.extra.provider = "lnbits"