alex/dwroller
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

security: remove hardcoded database credentials and auth secrets

Browse Source 
- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD
- Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET
- Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD
- Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD
- Update .env.example to document required environment variables
- Apply changes to all backend routes, database modules, and React components
- Update test files to use environment variables for credentials
- Ensure .env remains in .gitignore for production safety

This fix addresses critical security vulnerabilities where database
credentials and authentication secrets were exposed in source code.
This commit is contained in:
alexpolo1
2026-03-01 09:24:24 +01:00
parent 35335a32d3
commit bf98d44a45
23 changed files with 92 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
tests/gmtest.test.js
View File

@@ -4,7 +4,8 @@ const { execSync } = require('child_process');
describe('GM flow (create / update / login / delete)', () => {
const name = 'gmtest';
const baseURL = process.env.API_BASE || 'http://localhost:5000';
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_PASSWORD || 'bongo'}"`;
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_SECRET || 'defaultsecret'}"`;
const testPassword = process.env.PLAYER_PASSWORD || 'defaultpassword';
const curl = (method, url, data = null, headers = '') => {
const command = `curl -X ${method} ${headers} -H "Content-Type: application/json" ${data ? `-d '${JSON.stringify(data)}'` : ''} ${url}`;
@@ -36,7 +37,7 @@ describe('GM flow (create / update / login / delete)', () => {
}
// create
const createRes = curl('POST', `${baseURL}/api/players`, { name, rp: 10, pw: '1234' }, gmHeaders);
const createRes = curl('POST', `${baseURL}/api/players`, { name, rp: 10, pw: testPassword }, gmHeaders);
expect(createRes.status).toBe(201);
expect(createRes.data.name).toBe(name);

9
tests/playertest.test.js
View File

@@ -5,7 +5,8 @@ describe('Player flow (login, update sheet, gear/spend RP)', () => {
const name = 'testplayer';
const baseURL = process.env.API_BASE || 'http://localhost:5000';
let sessionId;
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_PASSWORD || 'bongo'}"`;
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_SECRET || 'defaultsecret'}"`;
const testPassword = process.env.PLAYER_PASSWORD || 'defaultpassword';
const curl = (method, url, data = null, headers = '') => {
const command = `curl -X ${method} ${headers} -H "Content-Type: application/json" ${data ? `-d '${JSON.stringify(data)}'` : ''} ${url}`;
@@ -37,12 +38,12 @@ describe('Player flow (login, update sheet, gear/spend RP)', () => {
}
// create test player
const create = curl('POST', `${baseURL}/api/players`, { name, rp: 10, pw: '1234' }, gmHeaders);
const create = curl('POST', `${baseURL}/api/players`, { name, rp: 10, pw: testPassword }, gmHeaders);
expect(create.status).toBe(201);
expect(create.data.name).toBe(name);
// login as player
const login = curl('POST', `${baseURL}/api/players/login`, { name, password: '1234' });
const login = curl('POST', `${baseURL}/api/players/login`, { name, password: testPassword });
expect(login.status).toBe(200);
expect(login.data.sessionId).toBeTruthy();
sessionId = login.data.sessionId;

2
tests/rules.test.js
View File

@@ -4,7 +4,7 @@ const path = require('path');
describe('Rules endpoints', () => {
const baseURL = process.env.API_BASE || 'http://localhost:5000';
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_PASSWORD || 'bongo'}"`;
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_SECRET || 'defaultsecret'}"`;
const curl = (method, url, data = null, headers = '') => {
const command = `curl -s -X ${method} ${headers} -H "Content-Type: application/json" ${data ? `-d '${JSON.stringify(data)}'` : ''} ${url}`;

2
tests/shop.test.js
View File

@@ -3,7 +3,7 @@ const { execSync } = require('child_process');
describe('Shop endpoints (public and protected)', () => {
const baseURL = process.env.API_BASE || 'http://localhost:5000';
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_PASSWORD || 'bongo'}"`;
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_SECRET || 'defaultsecret'}"`;
const mockPlayer = 'shoptestplayer';
const curl = (method, url, data = null, headers = '') => {