From 2b8cc94c928cb3e6bb4fb66bd3d4317d05471348 Mon Sep 17 00:00:00 2001 From: shaohuzhang1 Date: Fri, 28 Aug 2026 16:44:27 +0800 Subject: [PATCH] fix: hardcoded default Django SECRET_KEY allows offline forgery of signing-based tokens and unauthenticated file access --- apps/maxkb/settings/base/web.py | 6 ++++-- installer/start-maxkb.sh | 5 ++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/apps/maxkb/settings/base/web.py b/apps/maxkb/settings/base/web.py index 209ab8f91e5..e85ca5da1cb 100644 --- a/apps/maxkb/settings/base/web.py +++ b/apps/maxkb/settings/base/web.py @@ -18,8 +18,10 @@ # See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = CONFIG.get("SECRET_KEY") or 'django-insecure-zm^1_^i5)3gp^&0io6zg72&z!a*d=9kf9o2%uft+27l)+t(#3e' - +SECRET_KEY = CONFIG.get('SECRET_KEY') +if not SECRET_KEY: + raise RuntimeError( + "MAXKB_SECRET_KEY not configured, please provide it in the environment variable or configuration") # SECURITY WARNING: don't run with debug turned on in production! DEBUG = CONFIG.get_debug() diff --git a/installer/start-maxkb.sh b/installer/start-maxkb.sh index e8fe8fe0b19..dc9074c8899 100644 --- a/installer/start-maxkb.sh +++ b/installer/start-maxkb.sh @@ -23,5 +23,8 @@ if [ -d $_INIT_SHELL_DIR ]; then fi done fi - +if [ -z "$MAXKB_SECRET_KEY" ]; then + MAXKB_SECRET_KEY=$(python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())') +fi +export MAXKB_SECRET_KEY python /opt/maxkb-app/main.py start \ No newline at end of file