pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): allow INITIAL_PASSWORD when updating first password

Browse Source
This commit is contained in:
jack
2026-03-12 17:00:01 +00:00
parent 1c10cfe4bc
commit daaa3a8782
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/app/api/settings/route.ts
View File

@@ -60,9 +60,13 @@ export async function PATCH(request) {
return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
}
} else {
// First time setting password, no current password needed
// Allow empty currentPassword or default "123456"
if (body.currentPassword && body.currentPassword !== "123456") {
// First-time password set (no DB hash yet).
// Accept empty current password, legacy default, or INITIAL_PASSWORD when configured.
const initialPassword = process.env.INITIAL_PASSWORD;
const currentPassword = body.currentPassword || "";
const allowedWithoutHash = ["", "123456", ...(initialPassword ? [initialPassword] : [])];
if (!allowedWithoutHash.includes(currentPassword)) {
return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
}
}