Skip to content

GUEST access acts as a backdoor?!? #534

@rodolfomatos

Description

@rodolfomatos

Hello.
First, let me congratulate you for this project. It is a very cool endeavour indeed, and it shows that it has a lot of work on it.
I've just installed it in a Linux Mint using git & pip et al.
The configuration did not gave me an problems, except that had to create 2 files from scratch:
/lib/systemd/system/calibre.service
/etc/init.d/calibre

After that, everything was going smoothly. Changed the admin password, started creating some new users, even started uploading some pdf's and epub's that I have.

Then I started checking the configuration of the users that I had created. And realized that they had "jumped" one...
"admin" is user 1. Ok. But my user "rodolfo" was number "3". I did not created ANY previous user. So I checked the code.
And to my surprise, in "cps/ub.py" there is code for the creation of a "Guest" user with a password hard-coded: xxx

xxx as a password?!?! And THAT is not visible anywhere in the configuration process?!?

And THAT user has access to list ALL my books?!? I think I don't like that very much...

Even so, it would be nice to disable that "feature" altogether, don't you think?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions