fixed: password is set in the clear on create using CLI #67

plainblack · Mar 12, 2024 · 48d022c · 48d022c
1 parent 482b789
commit 48d022c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/docs/change-log.md b/docs/change-log.md
@@ -3,4 +3,5 @@ outline: deep
 ---
 # Change Log
 
-TODO: Once we start doing relases I'll add that here.
+## 2024-03-12
+* Fixed a security bug where passwords created via the CLI were stored incorrectly.
diff --git a/ving/cli/user.mjs b/ving/cli/user.mjs
@@ -68,10 +68,11 @@ export default defineCommand({
                 username: args.add,
                 realName: args.add,
                 email: args.email,
-                password: args.password,
                 admin: args.admin,
             });
             await user.insert();
+            await user.setPassword(args.password);
+            await user.update();
             formatList([user]);
         }
         else if (args.modify) {