From 77853ffe3704b6dd2c614de024acc75ab709746e Mon Sep 17 00:00:00 2001 From: MickLesk <47820557+MickLesk@users.noreply.github.com> Date: Mon, 9 Nov 2026 15:15:09 +0100 Subject: [PATCH] fix(filebrowser): generate the admin password instead of a public one The addon, filebrowser-quantum and the FileBrowser option of homeassistant and podman-homeassistant created admin with the password community-scripts.org, on a service that runs as root over the whole filesystem. A new install now gets a random password in ~/filebrowser.creds or ~/filebrowser-quantum.creds, and an update replaces the public password on existing installs. Quantum only keeps adminPassword in its config until the admin exists, since it resets the password on every start. The Home Assistant options run the addon instead of their own copy pinned to FileBrowser 2.23.0, the service no longer forces the listen address back to 0.0.0.0, and the no-authentication prompt says what it exposes. --- ct/homeassistant.sh | 27 +---------------------- ct/podman-homeassistant.sh | 28 +----------------------- tools/addon/filebrowser-quantum.sh | 35 ++++++++++++++++++++++++++++-- tools/addon/filebrowser.sh | 27 ++++++++++++++++++----- 4 files changed, 57 insertions(+), 60 deletions(-) diff --git a/ct/homeassistant.sh b/ct/homeassistant.sh index 7d30d82e4..68e59eaa3 100644 --- a/ct/homeassistant.sh +++ b/ct/homeassistant.sh @@ -70,32 +70,7 @@ function update_script() { exit fi if [ "$UPD" == "4" ]; then - msg_info "Installing FileBrowser" - RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g') - $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin - $STD filebrowser config init -a '0.0.0.0' - $STD filebrowser config set -a '0.0.0.0' - $STD filebrowser users add admin community-scripts.org --perm.admin - msg_ok "Installed FileBrowser" - - msg_info "Creating Service" - service_path="/etc/systemd/system/filebrowser.service" - echo "[Unit] -Description=Filebrowser -After=network-online.target -[Service] -User=root -WorkingDirectory=/root/ -ExecStart=/usr/local/bin/filebrowser -r / -[Install] -WantedBy=default.target" >$service_path - - $STD systemctl enable --now filebrowser - msg_ok "Created Service" - - msg_ok "Completed successfully!\n" - echo -e "FileBrowser should be reachable by going to the following URL. - ${BL}http://$LOCAL_IP:8080${CL} admin|community-scripts.org\n" + bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)" exit fi } diff --git a/ct/podman-homeassistant.sh b/ct/podman-homeassistant.sh index a3a569dab..552fc2393 100644 --- a/ct/podman-homeassistant.sh +++ b/ct/podman-homeassistant.sh @@ -66,33 +66,7 @@ function update_script() { exit fi if [ "$UPD" == "3" ]; then - msg_info "Installing FileBrowser" - $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash - $STD filebrowser config init -a '0.0.0.0' - $STD filebrowser config set -a '0.0.0.0' - $STD filebrowser users add admin community-scripts.org --perm.admin - msg_ok "Installed FileBrowser" - - msg_info "Creating Service" - cat </etc/systemd/system/filebrowser.service -[Unit] -Description=Filebrowser -After=network-online.target - -[Service] -User=root -WorkingDirectory=/root/ -ExecStart=/usr/local/bin/filebrowser -r / - -[Install] -WantedBy=default.target -EOF - systemctl enable -q --now filebrowser - msg_ok "Created Service" - - msg_ok "Completed successfully!\n" - echo -e "FileBrowser should be reachable by going to the following URL. - ${BL}http://$LOCAL_IP:8080${CL} admin|community-scripts.org\n" + bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)" exit fi if [ "$UPD" == "4" ]; then diff --git a/tools/addon/filebrowser-quantum.sh b/tools/addon/filebrowser-quantum.sh index 6db8e401b..97737bb0e 100644 --- a/tools/addon/filebrowser-quantum.sh +++ b/tools/addon/filebrowser-quantum.sh @@ -140,6 +140,23 @@ if [[ -f "$INSTALL_PATH" ]]; then echo -n "${TAB}Update ${APP}? (y/N): " read -r update_prompt if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then + # Older installs kept the public password in the config, which resets it on every start + if grep -qE '^\s*adminPassword:\s*"?community-scripts\.org"?\s*$' "$CONFIG_PATH" 2>/dev/null; then + msg_info "Replacing the default admin password" + ADMIN_PASS=$(random_password 20) + sed -i -E "s|^(\s*adminPassword:).*|\1 ${ADMIN_PASS}|" "$CONFIG_PATH" + chmod 600 "$CONFIG_PATH" + if [[ "$OS" == "Debian" ]]; then systemctl restart filebrowser.service; else rc-service filebrowser restart &>/dev/null; fi + fq_port=$(awk '/^http:/{h=1} h && /^ port:/{print $2; exit}' "$CONFIG_PATH") + for _ in {1..30}; do + [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${fq_port:-8080}/health")" == "200" ]] && break + sleep 1 + done + sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH" + echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds + chmod 600 ~/filebrowser-quantum.creds + msg_ok "Replaced the default admin password (saved in ~/filebrowser-quantum.creds)" + fi if check_for_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser"; then msg_info "Updating ${APP}" if ! command -v curl &>/dev/null; then $STD $PKG_MANAGER curl; fi @@ -189,6 +206,8 @@ chown root:root /usr/local/community-scripts chmod 755 /usr/local/community-scripts msg_ok "Directory prepared" +ADMIN_PASS=$(random_password 20) +msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file." echo -n "${TAB}Use No Authentication? (y/N): " read -r noauth_prompt @@ -234,9 +253,12 @@ server: - neverWatchPath: "/lost+found" auth: adminUsername: admin - adminPassword: community-scripts.org + adminPassword: ${ADMIN_PASS} EOF - msg_ok "Configured with default admin (admin / community-scripts.org)" + chmod 600 "$CONFIG_PATH" + echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds + chmod 600 ~/filebrowser-quantum.creds + msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)" fi msg_info "Creating service" @@ -276,4 +298,13 @@ EOF fi msg_ok "Service created successfully" + +# auth.adminPassword resets the password on every start, so it stays only until the admin exists +if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then + for _ in {1..30}; do + [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break + sleep 1 + done + sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH" +fi msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}" diff --git a/tools/addon/filebrowser.sh b/tools/addon/filebrowser.sh index 9f54ea311..cd4399a96 100644 --- a/tools/addon/filebrowser.sh +++ b/tools/addon/filebrowser.sh @@ -87,6 +87,20 @@ if [ -f "$INSTALL_PATH" ]; then read -r -p "Would you like to update ${APP}? (y/N): " update_prompt if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then + # Older installs created admin with the public password community-scripts.org + fb_port=$(grep -oP '(?<=-p )[0-9]+' "$SERVICE_PATH" 2>/dev/null | head -n1) + fb_db=$(grep -oP '(?<=-d )\S+' "$SERVICE_PATH" 2>/dev/null | head -n1) + [[ -n "$fb_db" ]] || fb_db="$(grep -oP '(?<=^WorkingDirectory=)\S+' "$SERVICE_PATH" 2>/dev/null || echo /root)/filebrowser.db" + if [[ "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"username":"admin","password":"community-scripts.org","recaptcha":""}' "http://127.0.0.1:${fb_port:-8080}/api/login")" == "200" ]]; then + msg_info "Replacing the default admin password" + ADMIN_PASS=$(random_password 20) + if [[ "$OS" == "Debian" ]]; then systemctl stop filebrowser; else rc-service filebrowser stop &>/dev/null; fi + $STD filebrowser users update admin --password "$ADMIN_PASS" --database "$fb_db" + if [[ "$OS" == "Debian" ]]; then systemctl start filebrowser; else rc-service filebrowser start &>/dev/null; fi + echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds + chmod 600 ~/filebrowser.creds + msg_ok "Replaced the default admin password (saved in ~/filebrowser.creds)" + fi if check_for_gh_release "filebrowser" "filebrowser/filebrowser"; then msg_info "Updating ${APP}" fetch_and_deploy_gh_release "filebrowser" "filebrowser/filebrowser" "prebuild" "latest" "/opt/filebrowser-dist" "linux-$(arch_resolve)-filebrowser.tar.gz" @@ -125,6 +139,8 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then chmod 644 "$DB_PATH" msg_ok "Directory created successfully" + ADMIN_PASS=$(random_password 20) + msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file." read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then msg_info "Configuring No Authentication" @@ -133,16 +149,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" $STD filebrowser config set --auth.method=noauth --database "$DB_PATH" if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then - $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH" + $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH" fi msg_ok "No Authentication configured" else - msg_info "Setting up default authentication" + msg_info "Setting up authentication" cd /usr/local/community-scripts $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" - $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH" - msg_ok "Default authentication configured (admin:community-scripts.org)" + $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH" + echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds + chmod 600 ~/filebrowser.creds + msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)" fi msg_info "Creating service" @@ -156,7 +174,6 @@ After=network-online.target User=root WorkingDirectory=/usr/local/community-scripts ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db -ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT} Restart=always