Commit Graph
2 Commits
Author SHA1 Message Date
706e87af9f fix(admin): stop silent superuser creation on auth probe and harden bootstrap (#18702)
Fix CWE-798/306 admin security: check_admin() silently created default admin accounts on any anonymous request. Now no longer creates accounts. Bootstrap uses env/random password. Login throttling added. Admin port bound to localhost. 

---------

Co-authored-by: jindou <jindou@local>
Co-authored-by: maoyifeng <myfbee5@163.com>
2026-08-28 17:44:52 +08:00
Harsh Kashyap 404a5cc33b fix(admin,api): honor STORAGE_IMPL when surfacing file_store backend (closes #17294) (#17441)
## Summary

When `STORAGE_IMPL=AWS_S3`, the Admin Service status page keeps showing
MinIO. Three things conspire:

1. `admin/server/config.py::load_configurations` only knows the
   `minio` and `minio_0` config keys. An `s3` block lands on the
   `case _:` branch and logs `Unknown configuration key: s3`
   (issue #17294).
2. `admin/server/services.py::ServiceMgr.get_all_services` filters
   retrieval services by `DOC_ENGINE` but has no equivalent filter
   for `file_store` services by `STORAGE_IMPL`. A stale MinIO block
   is returned regardless of the active backend.
3. The wired health check is hardcoded to `check_minio_alive`, which
   calls `settings.MINIO['host']`. With `STORAGE_IMPL=AWS_S3` that
   block is uninitialized, so the check always times out.


Fixes #17294
2026-07-29 11:13:20 +08:00