bf98d44a45
- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD - Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET - Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD - Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD - Update .env.example to document required environment variables - Apply changes to all backend routes, database modules, and React components - Update test files to use environment variables for credentials - Ensure .env remains in .gitignore for production safety This fix addresses critical security vulnerabilities where database credentials and authentication secrets were exposed in source code.
32 lines
1006 B
JavaScript
32 lines
1006 B
JavaScript
const { db, playerHelpers } = require('./sqlite-db');
|
|
|
|
// Update all player passwords to environment default
|
|
function updateAllPasswords() {
|
|
try {
|
|
// First check the table structure
|
|
const columns = db.prepare("PRAGMA table_info(players)").all();
|
|
console.log('Table columns:', columns.map(c => c.name));
|
|
|
|
// Update only the pw column (pwHash might not exist)
|
|
const defaultPassword = process.env.PLAYER_PASSWORD || 'defaultpassword';
|
|
const updateStmt = db.prepare('UPDATE players SET pw = ?');
|
|
const result = updateStmt.run(defaultPassword);
|
|
|
|
console.log(`Updated ${result.changes} player passwords to environment default`);
|
|
|
|
// Verify the changes
|
|
const players = playerHelpers.getAll();
|
|
console.log('Current players:');
|
|
players.forEach(player => {
|
|
console.log(`- ${player.name}: pw="${player.pw}"`);
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Error updating passwords:', error);
|
|
} finally {
|
|
db.close();
|
|
}
|
|
}
|
|
|
|
updateAllPasswords();
|