GUEST access acts as a backdoor?!?

[rodolfomatos]

Hello.
First, let me congratulate you for this project. It is a very cool endeavour indeed, and it shows that it has a lot of work on it.
I've just installed it in a Linux Mint using git & pip et al.
The configuration did not gave me an problems, except that had to create 2 files from scratch:
/lib/systemd/system/calibre.service
/etc/init.d/calibre

After that, everything was going smoothly. Changed the admin password, started creating some new users, even started uploading some pdf's and epub's that I have.

Then I started checking the configuration of the users that I had created. And realized that they had "jumped" one...
"admin" is user 1. Ok. But my user "rodolfo" was number "3". I did not created ANY previous user. So I checked the code.
And to my surprise, in "cps/ub.py" there is code for the creation of a "Guest" user with a password hard-coded: xxx

xxx as a password?!?! And THAT is not visible anywhere in the configuration process?!?

And THAT user has access to list ALL my books?!? I think I don't like that very much...

Even so, it would be nice to disable that "feature" altogether, don't you think?

[OzzieIsaacs]

Very stupid mistake, is fixed now.

@Technosoft2000, @CHBMB: There is a serious sequrity hole in all calibre-web versions. Everybody can login with a username guest and a very easy guessable password. I fixed it, and I want to encourage you to update the dockerversions if necessary. (I'm not sure if updating calibre-web in the docker container works?)
Special thanks to @rodolfomatos!

[saitoh183]

(I'm not sure if updating calibre-web in the docker container works?)

Yes it does

[Technosoft2000]

@OzzieIsaacs

Thanks for the info :)

[CHBMB]

@OzzieIsaacs No problem will get it sorted. Thanks for letting me know.