-
-
Notifications
You must be signed in to change notification settings - Fork 4.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add repair job that will ensure that secret and passwordsalt are set #35368
Conversation
/backport to stable25 |
ac717c9
to
612bd1a
Compare
The secret is generated during installation, isn't it? And for the ancient installations we already had a repair step somewhere. Was that dropped? If the secret was lost, then any encrypted values where the instance secret was used as password will not be recoverable. We have seen that a few times. So with the automatic regeneration we'll possibly cause that problem. So I'm thinking if the automatic recreation is really the best approach. The alternative could be to show a big error/warning on the setup page. Explain the situation and admins can first check if they have the secret in a config backup. Just an idea. Otherwise 👍 |
@CarlSchwan @juliushaertl wasnt that the idea in the first place? |
We already have a fallback in place where if a password hash or encrypted password was previously encrypted with an empty secret, we check first with the current secret and then with an empty secret. See 81f8719 |
Right. I also now saw the referenced ticket #34780. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🤞
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
612bd1a
to
5e725da
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍
Summary
Ensure that the secret and passwordsalt config are set