vh/rest-server
1
0
Fork 0
mirror of https://github.com/restic/rest-server.git synced 2025-12-07 01:26:18 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

restrict umask of htpasswd file

Browse Source
This commit is contained in:
Michael Eischer
2025-04-14 22:25:59 +02:00
parent 0ed9de379e
commit 95538fe956
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
changelog/unreleased/issue-318 Normal file
View File

@@ -0,0 +1,13 @@
Security: Fix world-readable permissions on new `.htpasswd` files
On startup the rest-server Docker container creates an empty `.htpasswd` file
if none exists yet. This file was world-readable by default, which can be
a security risk, even though the file only contains hashed passwords.
This has been fixed such that new `.htpasswd` files are no longer world-readabble.
The permissions of existing `.htpasswd` files must be manually changed
if relevant in your setup.
https://github.com/restic/rest-server/issues/318
https://github.com/restic/rest-server/pull/340