From 60c9bde8a4c4d9707b1fb66d7fab8eb4fed8ae48 Mon Sep 17 00:00:00 2001 From: shaohuzhang1 Date: Fri, 28 Aug 2026 17:13:15 +0800 Subject: [PATCH] fix: hardcoded default Django SECRET_KEY allows offline forgery of signing-based tokens and unauthenticated file access --- apps/maxkb/settings/base/web.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/apps/maxkb/settings/base/web.py b/apps/maxkb/settings/base/web.py index e85ca5da1cb..ee2aa89d2f3 100644 --- a/apps/maxkb/settings/base/web.py +++ b/apps/maxkb/settings/base/web.py @@ -10,6 +10,7 @@ from ...const import CONFIG, PROJECT_DIR import os from django.utils.translation import gettext_lazy as _ +from django.core.management.utils import get_random_secret_key # Build paths inside the project like this: BASE_DIR / 'subdir'. BASE_DIR = Path(__file__).resolve().parent.parent.parent @@ -18,10 +19,7 @@ # See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = CONFIG.get('SECRET_KEY') -if not SECRET_KEY: - raise RuntimeError( - "MAXKB_SECRET_KEY not configured, please provide it in the environment variable or configuration") +SECRET_KEY = CONFIG.get('SECRET_KEY') or get_random_secret_key() # SECURITY WARNING: don't run with debug turned on in production! DEBUG = CONFIG.get_debug()