fix: [website] fix IS_DEVELOPMENT rebind so dev admin password generates - #876
Open
elhoim wants to merge 1 commit into
Open
fix: [website] fix IS_DEVELOPMENT rebind so dev admin password generates#876elhoim wants to merge 1 commit into
elhoim wants to merge 1 commit into
Conversation
run_dev() imported IS_DEVELOPMENT via `from app.utils import IS_DEVELOPMENT` and then wrote `IS_DEVELOPMENT = True`, which only rebinds the local name in main.py. The module-level flag that gen_admin_password() actually reads (app.utils.utils.IS_DEVELOPMENT) stayed False, so running the dev server never triggered the auto-generated admin password path, silently leaving the admin account without a printed credential. The fix targets app.utils.utils rather than the app.utils package: the package re-exports IS_DEVELOPMENT via a from-import into its own namespace, which is a separate copy from the submodule global that gen_admin_password's function scope resolves against, so rebinding the package attribute would not have reached the function either. Verified with py_compile on the changed file and the full pytest suite against a live misp-modules server on port 6765: 161 passed, 4 skipped, 5 subtests passed, matching baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
website/main.py'srun_dev()did:from app.utils import IS_DEVELOPMENTbinds a local nameIS_DEVELOPMENTinmain.py's own module namespace. The followingIS_DEVELOPMENT = Trueonly rebinds that local — it never touches the module-level globalIS_DEVELOPMENTinapp/utils/utils.py, which is the onegen_admin_password()actually reads (if IS_DEVELOPMENT:atapp/utils/utils.py:84). Sincegen_admin_passwordis defined insideapp/utils/utils.py, its global scope resolves against that submodule's__dict__, not againstapp.utils's re-exported copy — so evenapp.utils.IS_DEVELOPMENT = Truewould not have worked either, since that's a separate binding created byapp/utils/__init__.py's ownfrom .utils import IS_DEVELOPMENT.Impact: Running the MISP modules website in dev mode (
run_dev()) with noADMIN_PASSWORDenv var set is supposed to auto-generate and print a development admin password. Because of this rebind bug,gen_admin_password()always seesIS_DEVELOPMENTasFalse, so no password is ever generated or printed — an operator standing up a local dev instance gets no way to log in as admin.Fix: Import the submodule directly —
import app.utils.utils as utils— and setutils.IS_DEVELOPMENT = True, so the assignment lands on the actual global thatgen_admin_password()reads. Thedebug=kwarg passed toapp.run()is updated to referenceutils.IS_DEVELOPMENTsince the old local name no longer exists.Behaviour change: This restores the code's evident intent rather than introducing new behaviour — the
IS_DEVELOPMENTflag exists solely to trigger this auto-generate-password path, and the change is scoped entirely torun_dev(), which is never invoked in production.Verification
website/has no automated test coverage in this repository. Verification was:python -m py_compile website/main.py: clean161 passed, 4 skipped, 5 subtests passed in 25.71sFound during a review of the repository; other findings are being submitted as separate PRs.
🤖 Generated with Claude Code
https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8