CERBERUS/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-05-13 05:51:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix silently ignored errors in password migration seeder (#4206)

Browse source 
The runSeeders function in database/db.go had three database operations
whose errors were silently ignored:

1. Pluck("seeder_name", &seedersHistory) - if this fails, the seeder
   might re-run and double-hash already bcrypt'd passwords, corrupting
   them
2. Find(&users) - if this fails, no users get migrated but the seeder
   still marks itself as complete
3. Update("password", hashedPassword) - if this fails for a user, their
   password silently remains in the old format

All three now properly check and return errors with descriptive messages.
This commit is contained in:
Qiaochu Hu 2026-05-10 20:46:42 +08:00 • committed by GitHub
parent 81b4ae5661
commit dee2525d5f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
database/db.go
View file

@ -89,11 +89,17 @@ func runSeeders(isUsersEmpty bool) error {
return db.Create(hashSeeder).Error
} else {
var seedersHistory []string
db.Model(&model.HistoryOfSeeders{}).Pluck("seeder_name", &seedersHistory)
if err := db.Model(&model.HistoryOfSeeders{}).Pluck("seeder_name", &seedersHistory).Error; err != nil {
log.Printf("Error fetching seeder history: %v", err)
return err
}
if !slices.Contains(seedersHistory, "UserPasswordHash") && !isUsersEmpty {
var users []model.User
db.Find(&users)
if err := db.Find(&users).Error; err != nil {
log.Printf("Error fetching users for password migration: %v", err)
return err
}
for _, user := range users {
hashedPassword, err := crypto.HashPasswordAsBcrypt(user.Password)
@ -101,7 +107,10 @@ func runSeeders(isUsersEmpty bool) error {
log.Printf("Error hashing password for user '%s': %v", user.Username, err)
return err
}
db.Model(&user).Update("password", hashedPassword)
if err := db.Model(&user).Update("password", hashedPassword).Error; err != nil {
log.Printf("Error updating password for user '%s': %v", user.Username, err)
return err
}
}
hashSeeder := &model.HistoryOfSeeders{