From 100a2d58f6aad880e2d35bda6c272c9fb55f0f00 Mon Sep 17 00:00:00 2001
From: bo0tzz <git@bo0tzz.me>
Date: Thu, 16 Jan 2025 11:59:19 +0100
Subject: [PATCH] fix: generate random admin password on quick setup

This should help mitigate issues like #3646
---
 cmd/root.go       |  7 ++++++-
 users/password.go | 17 +++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/cmd/root.go b/cmd/root.go
index 59329c5c..b421f771 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -378,7 +378,12 @@ func quickSetup(flags *pflag.FlagSet, d pythonData) {
 	password := getParam(flags, "password")
 
 	if password == "" {
-		password, err = users.HashPwd("admin")
+		pwd, err := users.RandomPwd()
+		checkErr(err)
+
+		log.Println("Generated random admin password for quick setup:", pwd)
+
+		password, err = users.HashPwd(pwd)
 		checkErr(err)
 	}
 
diff --git a/users/password.go b/users/password.go
index d7ef250a..3f5e1c6e 100644
--- a/users/password.go
+++ b/users/password.go
@@ -1,9 +1,14 @@
 package users
 
 import (
+	"crypto/rand"
+	"encoding/base64"
 	"golang.org/x/crypto/bcrypt"
 )
 
+// randomPasswordBytesCount is chosen to fit in a base64 string without padding
+const randomPasswordBytesCount = 9
+
 // HashPwd hashes a password.
 func HashPwd(password string) (string, error) {
 	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
@@ -15,3 +20,15 @@ func CheckPwd(password, hash string) bool {
 	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
 	return err == nil
 }
+
+func RandomPwd() (string, error) {
+	randomPasswordBytes := make([]byte, randomPasswordBytesCount)
+	var _, err = rand.Read(randomPasswordBytes)
+	if err != nil {
+		return "", err
+	}
+
+	// This is done purely to make the password human-readable
+	var randomPasswordString = base64.URLEncoding.EncodeToString(randomPasswordBytes)
+	return randomPasswordString, nil
+}