From d9d5bd069b6b3964c96372ba9d81c2c7579ab340 Mon Sep 17 00:00:00 2001 From: reverse Date: Wed, 19 Aug 2026 00:42:10 +0000 Subject: [PATCH] =?UTF-8?q?filehost:=20refuse=20to=20sign=20upload=20token?= =?UTF-8?q?s=20when=20filehost=5Fjwt=5Fsecret=20is=20unset/empty/"changeme?= =?UTF-8?q?"=20=E2=80=94=20the=20default=20fell=20open,=20signing=20with?= =?UTF-8?q?=20a=20world-known=20key=20so=20anyone=20could=20forge=20a=20se?= =?UTF-8?q?rver-trusted=20upload=20authorization;=20now=20it=20fails=20clo?= =?UTF-8?q?sed=20and=20tells=20the=20user=20to=20fix=20the=20config?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/modules/filehost.rs | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/src/modules/filehost.rs b/src/modules/filehost.rs index ebad29a..e24d556 100644 --- a/src/modules/filehost.rs +++ b/src/modules/filehost.rs @@ -201,10 +201,20 @@ impl Command for FileHostCmd { } }; - let secret = s - .conf("filehost_jwt_secret") - .unwrap_or("changeme") - .to_string(); + // Fail closed: signing upload tokens with a missing/placeholder secret + // would let anyone forge a server-trusted upload authorization. + let secret = match s.conf("filehost_jwt_secret") { + Some(sec) if !sec.is_empty() && sec != "changeme" => sec.to_string(), + _ => { + note( + s, + uid, + "FILEHOST: file hosting is misconfigured (no upload secret set). \ + Please tell an operator.", + ); + return CmdResult::Fail; + } + }; let issuer = s .conf("filehost_jwt_issuer") .unwrap_or("FILEHOST")