starred/nginx-ui

Fork 0

mirror of https://github.com/0xJacky/nginx-ui.git synced 2026-04-25 08:45:58 +03:00

[GH-ISSUE #852] admin:admin cannot be deactivated #4879

New issue

Closed

opened 2026-03-01 15:36:57 +03:00 by kerem · 12 comments

kerem commented

2026-03-01 15:36:57 +03:00

Owner

Originally created by @soekdd on GitHub (Feb 6, 2025).
Original GitHub issue: https://github.com/0xJacky/nginx-ui/issues/852

Description

The standard-user 'admin' cannot ba deleted (because its an inital user, ok), cannot be modfifed or deactivated (because of demo-mode). But the demo mode is not actived:

app.ini

[node]
Name                 =
SkipInstallation     = false
Demo                 = false
ICPNumber            =
PublicSecurityNumber =

Info:

Server OS: Debian GNU/Linux 12 (bookworm)
Nginx UI Version: v2.0.0-rc.1
Your Browser: Chrome

Originally created by @soekdd on GitHub (Feb 6, 2025). Original GitHub issue: https://github.com/0xJacky/nginx-ui/issues/852 **Description** The standard-user 'admin' cannot ba deleted (because its an inital user, ok), cannot be modfifed or deactivated (because of demo-mode). But the demo mode is not actived: app.ini ``` ini [node] Name = SkipInstallation = false Demo = false ICPNumber = PublicSecurityNumber = ``` **Info:** - Server OS: Debian GNU/Linux 12 (bookworm) - Nginx UI Version: v2.0.0-rc.1 - Your Browser: Chrome

kerem

2026-03-01 15:36:57 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-01 15:36:57 +03:00

Author

Owner

@soekdd commented on GitHub (Feb 6, 2025):

Demo                 = 0

doesnt work either...

@soekdd commented on GitHub (Feb 6, 2025): ``` Demo = 0 ``` doesnt work either...

kerem commented

2026-03-01 15:36:57 +03:00

Author

Owner

@soekdd commented on GitHub (Feb 6, 2025):

c.ModifyHook(func(c *cosy.Ctx[model.User]) {
		c.BeforeDecodeHook(func(ctx *cosy.Ctx[model.User]) {
			if ctx.ID == 1 {
				ctx.AbortWithError(user.ErrChangeInitUserPwdInDemo)
			}
		})
		c.BeforeDecodeHook(encryptPassword)
	})

Unfortunately I'm not common with go. But it looks like you dont check for demo mode.

@soekdd commented on GitHub (Feb 6, 2025): ``` c.ModifyHook(func(c *cosy.Ctx[model.User]) { c.BeforeDecodeHook(func(ctx *cosy.Ctx[model.User]) { if ctx.ID == 1 { ctx.AbortWithError(user.ErrChangeInitUserPwdInDemo) } }) c.BeforeDecodeHook(encryptPassword) }) ``` Unfortunately I'm not common with go. But it looks like you dont check for demo mode.

kerem commented

2026-03-01 15:36:57 +03:00

Author

Owner

@0xJacky commented on GitHub (Feb 6, 2025):

Thank you for the report, i will fix it later.

@0xJacky commented on GitHub (Feb 6, 2025): Thank you for the report, i will fix it later.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@0xJacky commented on GitHub (Feb 6, 2025):

Fixed in 7049599, please reinstall the latest version of v2.0.0-rc.1.

@0xJacky commented on GitHub (Feb 6, 2025): Fixed in [7049599](https://github.com/0xJacky/nginx-ui/commit/70495999223c0f437be41aa7d69ace5480342f4d), please reinstall the latest version of v2.0.0-rc.1.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@soekdd commented on GitHub (Feb 6, 2025):

Great job!

@soekdd commented on GitHub (Feb 6, 2025): Great job!

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@soekdd commented on GitHub (Feb 6, 2025):

Sorry, I'll have to ask you to open the ticket again:
I have installed your new version: Change password responds with a success message, but it does not change the password. So admin:admin remains active. Changing the passwords of all other users also fails.

BTW: I wish you would not transmit the password (either when logging in or when changing the password) unencrypted.

@soekdd commented on GitHub (Feb 6, 2025): Sorry, I'll have to ask you to open the ticket again: I have installed your new version: Change password responds with a success message, but it does not change the password. So admin:admin remains active. Changing the passwords of all other users also fails. BTW: I wish you would not transmit the password (either when logging in or when changing the password) unencrypted.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@0xJacky commented on GitHub (Feb 6, 2025):

Oops, I will fix it again later. By the way, this is the autocomplete function of the browser, and it is not nginx-ui to change the password unencrypted.

@0xJacky commented on GitHub (Feb 6, 2025): Oops, I will fix it again later. By the way, this is the autocomplete function of the browser, and it is not nginx-ui to change the password unencrypted.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@soekdd commented on GitHub (Feb 6, 2025):

Nope, the passwords are in plain text in your web service calls:

{
    "name": "soek",
    "password": "0xJacky!sTheB3st",
    "otp": "",
    "recovery_code": ""
}

@soekdd commented on GitHub (Feb 6, 2025): Nope, the passwords are in plain text in your web service calls: ``` { "name": "soek", "password": "0xJacky!sTheB3st", "otp": "", "recovery_code": "" } ```

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@0xJacky commented on GitHub (Feb 6, 2025):

Currently, it will be encrypted when it's stored to the database, but the request was made without encryption. I will try to enhance this.

@0xJacky commented on GitHub (Feb 6, 2025): Currently, it will be encrypted when it's stored to the database, but the request was made without encryption. I will try to enhance this.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@0xJacky commented on GitHub (Feb 6, 2025):

Please reinstall the latest rc.1, the password changing issue has been resolved.

@0xJacky commented on GitHub (Feb 6, 2025): Please reinstall the latest rc.1, the password changing issue has been resolved.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@soekdd commented on GitHub (Feb 6, 2025):

Check it, works! Thank you very much for you exemplary response! Greatings from Dresden/Germany.

@soekdd commented on GitHub (Feb 6, 2025): Check it, works! Thank you very much for you exemplary response! Greatings from Dresden/Germany.

kerem commented

2026-03-01 15:36:58 +03:00

Author

Owner

@0xJacky commented on GitHub (Feb 7, 2025):

Nope, the passwords are in plain text in your web service calls:
{
    "name": "soek",
    "password": "0xJacky!sTheB3st",
    "otp": "",
    "recovery_code": ""
}

Recently, we used the RSA algorithm to encrypt the payload of login/install requests, this change will be released in the next RC version. Thanks for your suggestion!

@0xJacky commented on GitHub (Feb 7, 2025): > Nope, the passwords are in plain text in your web service calls: > > ``` > { > "name": "soek", > "password": "0xJacky!sTheB3st", > "otp": "", > "recovery_code": "" > } > ``` Recently, we used the RSA algorithm to encrypt the payload of login/install requests, this change will be released in the next RC version. Thanks for your suggestion!