fix(portabase): meet the default admin password rules (#17384)

Portabase creates the default admin from AUTH_DEFAULT_PASSWORD and checks it
with assertValidPassword (src/utils/password.ts): at least 8 characters, an
uppercase letter, a lowercase letter, a number and a special character. The
generated password is alphanumeric only, so the first start fails with
"Password must contain at least 1 special character".

Generate until each class is present rather than appending fixed characters,
and leave #, $, quotes and backticks out of the charset, because the value is
written unquoted into .env.

Fixes #17370

Co-authored-by: Claude Opus 5 <claude-opus-5@anthropic.com>
This commit is contained in:
maksimtech
2026-09-21 15:45:35 +02:00
committed by GitHub
parent e24b690307
commit 84b272c6bc
+4 -1
View File
@@ -33,7 +33,10 @@ mv -f "/opt/tusd/tusd_linux_$(arch_resolve)/tusd" /opt/tusd/tusd
rm -rf "/opt/tusd/tusd_linux_$(arch_resolve)"
chmod +x /opt/tusd/tusd
PROJECT_SECRET=$(openssl rand -hex 32)
ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 16)
ADMIN_PASSWORD=""
until [[ "$ADMIN_PASSWORD" =~ [a-z] && "$ADMIN_PASSWORD" =~ [A-Z] && "$ADMIN_PASSWORD" =~ [0-9] && "$ADMIN_PASSWORD" =~ [^a-zA-Z0-9] ]]; do
ADMIN_PASSWORD=$(head -c 256 /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9@%+=_-' | head -c 16)
done
cat <<EOF >/opt/portabase/.env
LOG_LEVEL=info
DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}