Skip to content

Conversation

MichaelEischer
Copy link
Member

What does this PR change? What problem does it solve?

When rest-server is started without a htpasswd file, it creates an empty file. Make this file not world readable.

Was the change previously discussed in an issue or on the forum?

Fixes #318

Checklist

  • I have added tests for all code changes.
  • I have added documentation for relevant changes (in the manual).
  • There's a new file in changelog/unreleased/ that describes the changes for our users (see template).
  • I'm done! This pull request is ready for review.

@MichaelEischer MichaelEischer force-pushed the limit-htpasswd-perms branch from 2554832 to 984f65d Compare May 12, 2025 17:04
Copy link
Contributor

@rawtaz rawtaz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small nitpicks :D

@MichaelEischer MichaelEischer force-pushed the limit-htpasswd-perms branch from 984f65d to c711996 Compare May 15, 2025 17:56
@MichaelEischer MichaelEischer force-pushed the limit-htpasswd-perms branch from c711996 to 95538fe Compare May 15, 2025 17:56
Copy link
Member Author

@MichaelEischer MichaelEischer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@MichaelEischer MichaelEischer merged commit f018e99 into restic:master May 15, 2025
5 checks passed
@MichaelEischer MichaelEischer deleted the limit-htpasswd-perms branch May 15, 2025 18:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Potential security weakness: .htpasswd is global readable on docker image

2 participants