From daaa3a8782dc54ce60a31e3a48737c05dfd6d2b8 Mon Sep 17 00:00:00 2001 From: jack Date: Thu, 12 Mar 2026 17:00:01 +0000 Subject: [PATCH] fix(auth): allow INITIAL_PASSWORD when updating first password --- src/app/api/settings/route.ts | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/app/api/settings/route.ts b/src/app/api/settings/route.ts index cb0511c6d8..bcfa59445d 100644 --- a/src/app/api/settings/route.ts +++ b/src/app/api/settings/route.ts @@ -60,9 +60,13 @@ export async function PATCH(request) { return NextResponse.json({ error: "Invalid current password" }, { status: 401 }); } } else { - // First time setting password, no current password needed - // Allow empty currentPassword or default "123456" - if (body.currentPassword && body.currentPassword !== "123456") { + // First-time password set (no DB hash yet). + // Accept empty current password, legacy default, or INITIAL_PASSWORD when configured. + const initialPassword = process.env.INITIAL_PASSWORD; + const currentPassword = body.currentPassword || ""; + const allowedWithoutHash = ["", "123456", ...(initialPassword ? [initialPassword] : [])]; + + if (!allowedWithoutHash.includes(currentPassword)) { return NextResponse.json({ error: "Invalid current password" }, { status: 401 }); } }