Add command-line password reset for locked-out admins - #5
Merged
Conversation
There was no working way to reset an admin's password without SMTP configured for the email-code "forgot password" flow. Adds a `--reset-password` CLI mode to the backend app: prompts for the account's email and a new password, then reuses the same UserManager.RemovePasswordAsync/AddPasswordAsync + session-revocation logic AuthController.ResetPassword already uses for the email flow. The app exits via Environment.Exit right after this runs, before app.Run() would bind a port, so it can run as a second process alongside an already-running instance sharing the same database without a port conflict. Wraps it for both deployment methods: - standalone/reset-password.sh, .ps1, .bat - reuse standalone.env credentials the same way start.sh/start.ps1 do, and require the instance to already be running. Added to release.yml's packaging steps so they actually ship in releases. - Docker: `docker compose exec app /app/RustRconServerManager.Backend --reset-password` against the already-running container. Documented in docs/DOCKER_DEPLOYMENT.md and standalone/README.md. Also falls back to plain (unmasked) input for the password prompt when stdin isn't a real console (e.g. `docker exec` without -it, piped input) - Console.ReadKey throws an unhandled exception otherwise instead of failing gracefully. Verified end-to-end in a throwaway Docker stack: created an admin account, reset its password via `docker compose exec`, confirmed the old password is rejected and the new one logs in.
Xenne93
added a commit
that referenced
this pull request
Aug 16, 2026
* Fix GitHub Code Scanning alerts (Security and quality) - Add explicit permissions blocks to build-check.yml and remove-old-packages.yml workflows (actions/missing-workflow-permissions) - Add missing admin check to PanelSettingsController.PurgeData, which previously let any authenticated user (including moderators) purge all logged data including audit logs - Add path-containment validation to MapStorageService (GetServerImageFilePath) using Path.GetFullPath + base-directory prefix check, closing an unauthenticated arbitrary-file-read via PublicImagesController's fast disk-read path using an unvalidated instanceHash route parameter (cs/path-injection) - Harden Discord webhook URL validation in ServerWebhookController.TestWebhook to check uri.Host/AbsolutePath explicitly instead of a raw substring .Contains() match - Clean up RconController.DeleteServer to return NotFound on a missing/ non-owned server instead of relying on a NullReferenceException falling through to a broad catch block - Add a shared LogSanitizer helper and use it to strip CR/LF from every user-controlled string value before it reaches a logger call across 18 files (cs/log-forging), converting any remaining string-interpolated log calls to structured logging with named placeholders along the way - Replace User.GetEmail() with a non-PII user identifier (resolved user object's Id, or the NameIdentifier claim) in every log call that previously logged the user's email address (cs/exposure-of-sensitive-information) - Mask the recipient address in EmailService's log calls instead of logging it in full - Dismiss 4 alerts confirmed as false positives via the Code Scanning API, each with a documented reason (cs/cleartext-storage-of-sensitive-information #7, cs/user-controlled-bypass #4, #5, #6) * test: inline Replace() sanitizer instead of helper method to validate CodeQL barrier recognition * Replace LogSanitizer helper with inline .Replace() calls CodeQL's cs/log-forging barrier recognition requires the sanitizing .Replace() call to appear directly in the tainted expression, not routed through a custom static helper method - validated empirically via a live re-scan (helper-based fix cleared only 1/65 alerts, one inlined call site cleared immediately). Converted every remaining call site accordingly and removed the now-dead LogSanitizer helper. * Fix remaining 4 alerts: sanitize steamId logging, drop email from EmailService diagnostics - PanelSettingsController: sanitize steamId in VAC-ban override log calls (cs/log-forging) - EmailService: stop logging even a masked form of the recipient address, since CodeQL treats any value derived from the tainted parameter as still-sensitive regardless of transformation (cs/exposure-of-sensitive-information); removed the now-unused MaskEmail helper
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a --reset-password CLI mode to the backend, plus standalone (reset-password.sh/.ps1/.bat) and Docker (docker compose exec app ... --reset-password) wrappers, for admins locked out with no SMTP configured.
Verified end-to-end in a throwaway Docker stack: created an admin account, reset its password, confirmed old password rejected / new password works.