fix SSH MITM, file permissions, pin dependencies (#440)

gui/views.py

@@ -2788,7 +2788,8 @@ def get_channeldb_file_size():
             try:
                 # Create SSH client
                 ssh = paramiko.SSHClient()
-                ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())  # Automatically add host keys
+                ssh.load_system_host_keys()
+                ssh.set_missing_host_key_policy(paramiko.RejectPolicy())
 
                 # Connect to the remote host (eg 10.1.1.2, lnd, 22)
                 ssh.connect(hostname=host_value, username=user_value, port=port)

initialize.py

@@ -1,4 +1,4 @@
-import os, secrets, argparse, django
+import os, stat, secrets, argparse, django
 from pathlib import Path
 from django.core.management import call_command
 from django.contrib.auth import get_user_model
@@ -339,10 +339,11 @@ def initialize_django(adminuser, adminpw):
                 admin.save()
                 if adminpw is None:
                     try:
-                        Path(os.path.join(DATA_DIR, 'lndg-admin.txt')).touch()
+                        Path(os.path.join(DATA_DIR, 'lndg-admin.txt')).touch(mode=0o600)
                         f = open('data/lndg-admin.txt', 'w')
                         f.write(login_pw)
                         f.close()
+                        os.chmod('data/lndg-admin.txt', stat.S_IRUSR | stat.S_IWUSR)
                     except Exception as e:
                         print('Error writing password file:', str(e))
                     print('FIRST TIME LOGIN PASSWORD:' + login_pw)

requirements.txt

@@ -1,12 +1,12 @@
-Django
-djangorestframework
-django-filter
-grpcio
-protobuf
-pytz
-pandas
-requests
+Django>=4.2,<5.0
+djangorestframework>=3.14
+django-filter>=23.0
+grpcio>=1.60
+protobuf>=4.25
+pytz>=2023.3
+pandas>=2.0
+requests>=2.31
 asyncio
 bech32
-cryptography
-paramiko
+cryptography>=41.0
+paramiko>=3.4