Change the default Admin password

[cryptonomicon314]

I think that setting the defaults admin password to a constant in the code is an unnecessary potential security risk. I don't like the fact that until I change the password the user can tamper with my (admitedlly empty) database. I'd rather have either:

1. an admin creation script in which I can set the password (this seems better)
2. the option to specify the admin password in a file admin-password.txt whose contents would be used as the default admin password. That file could be deleted after the database is created for the first time (to avoid having a plaintext password stored on disk)

[dpgaspar]

I agree, option 1 is better. this was proposed on issue #74.

a manager script could:

• Insert your first admin user.
• create a skeleton project.
• drop/create db.
• ...

[cryptonomicon314]

I did read issue #74, but I am not familiar with what a LADP server is, and I was not sure whether the problem you were discussing was exactly the same.

Of all the actions you mention, clearly the most important is the creation of the first admin user.

Creating a skeleton project doesn't seem that useful. to me, especially because we can just git clone your Flask-Appbuilder-Skeletion and change the defaults.

Drop/create db: that one is tricky because of the differences between DB engines... I don't think SQLAlchemy can start or stop a PostgreSQL or MySQL server, and you'd end up writing a lot of backend specific code. I use subprocess.call to start/stop a PostgreSQL server and to drop/create DBs.

I think we should restrict the scope of the script to adding a first admin user, and you should think about bundling it with the Flask-Appbuilder-Skeleton repo, not with Flask-Appbuilder. From looking at the code it doesn't seem to hard, does it? You'd have to stop creating a default admin user, and the script could do something like this:

from app import db
password = raw_input()
admin = User(name=..., role=app.sm.auth_role_admin(), password=password)
db.add(admin)
db.commit()

[dpgaspar]

New version 1.3.0 will have a command line utility to create the first admin user. No automatic creation.

[datatalking]

What is the username and password for the test account on http://flaskappbuilder.pythonanywhere.com/login/?