Spaces:

BitBasher
/

EduConnect

Sleeping

dtyago commited on Feb 12

Commit

843bda3

•

1 Parent(s): 10f29f7

Externalize admin password

Files changed (5) hide show

Dockerfile CHANGED Viewed

@@ -7,7 +7,8 @@ RUN useradd -m -u 1000 user
 # Set environment variables for the non-root user
 ENV HOME=/home/user \
     PATH=/home/user/.local/bin:$PATH \
-    NAME=EduConnect
 # Set the non-root user's home directory as the working directory
 WORKDIR $HOME

 # Set environment variables for the non-root user
 ENV HOME=/home/user \
     PATH=/home/user/.local/bin:$PATH \
+    NAME=EduConnect \
+    EC_ADMIN_PWD='$2b$12$zybxm7XMoGCVV3ovNDcXt.r2QJUhtj7miYfEfuBw9UGqViTIRFg72'
 # Set the non-root user's home directory as the working directory
 WORKDIR $HOME

app/admin/admin_functions.py CHANGED Viewed

@@ -1,24 +1,26 @@
 from fastapi import HTTPException, UploadFile, File, Form
 from typing import Optional
 import bcrypt
 # Admin Authentication
 def verify_admin_password(submitted_user: str, submitted_password: str) -> bool:
     """
     Verifies the submitted password against the stored hash.
     :param submitted_password: The password submitted by the user.
-    :param stored_password_hash: The hashed password retrieved from a secure store.
     :return: True if the password is correct, False otherwise.
     """
-    stored_password = b" "
     if submitted_user == "admin":
-        stored_password = b"welcome." # Later retrieve from secrets
-    stored_password_hash = bcrypt.hashpw(stored_password, bcrypt.gensalt())
-    return bcrypt.checkpw(submitted_password.encode('utf-8'), stored_password_hash.encode('utf-8'))
 # User Registration
 async def register_user(email: str, name: str, role: str, file: UploadFile = File(...)) -> Optional[str]:

 from fastapi import HTTPException, UploadFile, File, Form
 from typing import Optional
 import bcrypt
+import os
 # Admin Authentication
 def verify_admin_password(submitted_user: str, submitted_password: str) -> bool:
     """
     Verifies the submitted password against the stored hash.
+    :param submitted_user: The username submitted by the user.
     :param submitted_password: The password submitted by the user.
     :return: True if the password is correct, False otherwise.
     """
     if submitted_user == "admin":
+        # Retrieve the stored hash from environment variable
+        stored_password_hash = os.getenv("EC_ADMIN_PWD", "").encode('utf-8')
+        # Directly compare the submitted password with the stored hash
+        return bcrypt.checkpw(submitted_password.encode('utf-8'), stored_password_hash)
+    return False
 # User Registration
 async def register_user(email: str, name: str, role: str, file: UploadFile = File(...)) -> Optional[str]:

app/admin/templates/admin_login.html CHANGED Viewed

@@ -2,7 +2,7 @@
   <head>
     <title>EduConnect Administration- login page</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <link href="static/bootstrap.min.css" rel="stylesheet" media="screen">
   </head>
   <body>
     <div class="container">

   <head>
     <title>EduConnect Administration- login page</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link href="static/css/mvp.css" rel="stylesheet" media="screen">
   </head>
   <body>
     <div class="container">

app/admin/templates/user_registration.html CHANGED Viewed

@@ -2,6 +2,8 @@
 <html>
 <head>
     <title>User Registration</title>
 </head>
 <body>
     <h2>User Registration</h2>

 <html>
 <head>
     <title>User Registration</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link href="static/css/mvp.css" rel="stylesheet" media="screen">
 </head>
 <body>
     <h2>User Registration</h2>

requirements.txt CHANGED Viewed

@@ -10,4 +10,5 @@ python-multipart==0.0.5        # Necessary for form data handling, including fil
 numpy                          # Fundamental package for scientific computing.
 chromadb==0.4.22               # Vector database interaction libraries.
 keras-facenet==0.3.2           # For face recognition and embedding, used alongside MTCNN.
-jinja2==3.0.*                  # For Admin site redndering

 numpy                          # Fundamental package for scientific computing.
 chromadb==0.4.22               # Vector database interaction libraries.
 keras-facenet==0.3.2           # For face recognition and embedding, used alongside MTCNN.
+jinja2==3.0.*                  # For Admin site redndering
+bcrypt==4.1.*                  # For hashing secrets