bf98d44a45
- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD - Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET - Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD - Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD - Update .env.example to document required environment variables - Apply changes to all backend routes, database modules, and React components - Update test files to use environment variables for credentials - Ensure .env remains in .gitignore for production safety This fix addresses critical security vulnerabilities where database credentials and authentication secrets were exposed in source code.
58 lines
1.5 KiB
JavaScript
58 lines
1.5 KiB
JavaScript
// Script to ensure GM user exists
|
|
const { db } = require('./sqlite-db');
|
|
|
|
function logToFile(...args) {
|
|
const msg = `[${new Date().toISOString()}] ` + args.map(a => (typeof a === 'object' ? JSON.stringify(a) : String(a))).join(' ') + '\n';
|
|
require('fs').appendFileSync(require('path').join(__dirname, 'backend.log'), msg, { encoding: 'utf8' });
|
|
}
|
|
|
|
// Check if GM user exists
|
|
const existingGm = db.prepare('SELECT * FROM players WHERE name = ?').get('gm');
|
|
|
|
if (!existingGm) {
|
|
// Create GM user with password from environment variable
|
|
const gmPassword = process.env.GM_PASSWORD || 'defaultpassword';
|
|
const stmt = db.prepare(`
|
|
INSERT INTO players (name, pw, pw_hash, tab_info)
|
|
VALUES (?, ?, ?, ?)
|
|
`);
|
|
|
|
stmt.run('gm', gmPassword, gmPassword, JSON.stringify({
|
|
rp: 999999,
|
|
inventory: [],
|
|
renown: 'None'
|
|
}));
|
|
|
|
logToFile('Created GM user');
|
|
console.log('Created GM user');
|
|
} else {
|
|
// Update GM user password if needed
|
|
const gmPassword = process.env.GM_PASSWORD || 'defaultpassword';
|
|
const stmt = db.prepare(`
|
|
UPDATE players
|
|
SET pw = ?, pw_hash = ?
|
|
WHERE name = 'gm'
|
|
`);
|
|
|
|
stmt.run(gmPassword, gmPassword);
|
|
|
|
logToFile('Updated GM user');
|
|
console.log('Updated GM user');
|
|
}
|
|
|
|
// Make sure GM has admin privileges
|
|
const stmt = db.prepare(`
|
|
UPDATE players
|
|
SET tab_info = ?
|
|
WHERE name = 'gm'
|
|
`);
|
|
|
|
stmt.run(JSON.stringify({
|
|
rp: 999999,
|
|
inventory: [],
|
|
renown: 'None'
|
|
}));
|
|
|
|
logToFile('GM privileges ensured');
|
|
console.log('GM privileges ensured');
|