Logging out with no password set gets you locked out of the app about dmarc-srg HOT 7 CLOSED

one option to solve.. is on first run a password can be set that will append settings to config or store in db, that means encryption can be added so its not stored plaintext either, then password change is done through app or can be removed fully in emergencies to reset again? that would tick off a few things and add some nice security...

from dmarc-srg.

This was done for security reasons: the password with an empty string is always wrong.

from dmarc-srg.

I agree, but most people might not set a password and on first run they can access the webpage without changing anything. then if they logout for whatever reason they cant login again... so its a bug.

from dmarc-srg.

It's possible that I did not understand you, but... you will not able to access the web-interface with the default config if you do not change anything there. Or you were able to get the access with the default config?

from dmarc-srg.

I've re-tested and its actually due to changing the password when logged in to blank and logging out so expected behaviour my apologies, I'm putting your program through some interesting tasks, and not really real-world scenario anyways.

I still think its worth looking at not having plain text though (and maybe set a default password to 1234) and document in readme as its not obvious...

Thanks for creating this tool!

from dmarc-srg.

I still think its worth looking at not having plain text though (and maybe set a default password to 1234) and document in readme as its not obvious...

A hard-coded default password is a bad idea. It's the first thing a hacker checks, and a blank password is rejected not only on the server, but the web interface also explicitly rejects it. How exactly to disable the password is indicated in the comment.

from dmarc-srg.

Done: 84e2196

from dmarc-srg.