Default admin account in Sqlite database
- Dominant language
- Shell
- Stars
- 769
- Forks
- 168
- PR merge metrics
- No merged PRs in 30d
Description
I set up a wallabag instance using docker-compose with an sqlite database. I then found that there was an admin account automatically created with 'wallabag' as its username as well as its password. I couldn't find anything about that in the documentation. So if I hadn't already had some experience with wallabag before, I might not have known that there must be an admin account. And after finding it, I had to guess its password to be able to access it.
As this poses a security risk, I think there should be a prominent disclaimer about that in the installation instructions, so people know about it and change the password right away.
It would be even better if you could set up the admin account yourself after installing or using environment variables.
On another note, I also think, it should be advised more prominently that the ENV_SECRET variable should be set to a random string isntead of leaving it to the default.
I hope my perspecitve helps, cheers.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.