admin
56d6de9808
gates / gates (push) Successful in 26s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
19 lines
1.5 KiB
Python
19 lines
1.5 KiB
Python
"""loginproof.py <app> <sub> <email> — decision 45 proof on a FRESH install of a BookStack-shaped app (a Laravel
|
|
login form): the known default fails, the generated first password read from the app page works, a wrong one fails.
|
|
The value is never printed."""
|
|
import re, sys, html as H
|
|
import walk as w
|
|
app, sub, email, default = sys.argv[1:5]
|
|
w.login()
|
|
m = re.search(r'name="ADMIN_PASSWORD"[^>]*value="([^"]*)"', w.page(f"/stacks/{app}/deploy"))
|
|
gen = H.unescape(m.group(1)) if m else ""
|
|
print("app page shows a first password:", bool(gen))
|
|
info = w.page(f"/apps/{app}")
|
|
print("app page loaded:", len(info) > 20000, "| default-login card shown:", "Alapértelmezett belépés" in info, "| warning shown:", "known-login-line" in info)
|
|
fn = f'''J=/tmp/lp.$$; login() {{ rm -f $J; T=$(curl -sk -c $J -b $J -H "Host: {sub}.{w.DOMAIN}" https://127.0.0.1/login | grep -o 'name="_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"$//'); curl -sk -o /dev/null -w '%{{http_code}}->%{{redirect_url}}' -c $J -b $J -H "Host: {sub}.{w.DOMAIN}" -X POST --data-urlencode "_token=$T" --data-urlencode "email={email}" --data-urlencode "password=$1" https://127.0.0.1/login | sed "s|https\\?://[^/]*||"; }}'''
|
|
print(w.guest(fn + f'''
|
|
echo "NEGATIVE the known default {email} / {default}: $(login '{default}')"
|
|
echo "POSITIVE the generated first password: $(login '{gen}')"
|
|
echo "CONTROL wrong: $(login wrongxyz123)"; rm -f $J'''))
|
|
print(w.guest(f"grep -A3 '^after_install:' /opt/docker/stacks/{app}/app.yaml"))
|