So if you do the Docker setup, obeying the instructions and substituting everything that needs to get substituted, but don’t proofread the files in detail and so miss that line 40 of docker-compose.yml doesn’t have the variable {{domain}} like in every other location you need to write your domain, but instead just says LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml and so you fail to change it away from lemmy.ml… then, everything will work, until you type in your admin password for the first time, at which point your browser will send a request to lemmy.ml which includes your admin username, your email address, and the admin password you’re trying to set. And, also, of course your IP address wherever you are sitting and setting up the server.
I have no reason at all to think the Lemmy devs have set their server up to log this information when it comes in. nginx will throw it away by default, of course, but it would be easy for them to have it save it instead, if they wanted to. And my guess is most people won’t use a different admin password once they figure out why creating their admin user isn’t working and fix it.
@[email protected] @[email protected] I think you should fix the docker-compose.yml file not to do this.
Edit: Just to increase the information-to-rudeness ratio of my post. The docs are at:
https://join-lemmy.org/docs/administration/install_docker.html
And they recommend using wget to download:
https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml
Which is pulled from:
https://github.com/LemmyNet/lemmy-docs/tree/main/assets
Which is what has the wrong line 40 in it.
Edit: They fixed it. Good stuff.
Within the last hour, dessalines has posted three things about communism that are longer than the fix for this issue.
Edit: Everyone’s got the right to do whatever they want to do. I’m not trying to accuse anyone of not spending enough time making software for me, just because occasionally they might want to do some other things with their life. The thing I’m trying to emphasize with this is how short the fix is. It’s seconds. It’s not one of those “but you have to recompile, what about this other branch” or anything like that. It’s literally a fairly critical security fix with 100% of the fix in a one-line change to a documentation file.
Wow you typed a LOT to defend not making a GitHub issue. That energy redirected to writing a GitHub issue would be stellar.
Go fix it yourself. You’re correct that’s the admin’s problem but if you’re so insistent that it takes a minute go submit a merge request real quick.
Also it’s only a security breach if you don’t change the admin password or your domain which should be standard for setting things up on the Internet anyway.
I would fix it if we had a link. This problem is not present in the main branch.
https://github.com/LemmyNet/lemmy/blob/main/docker/docker-compose.yml
environment: # this needs to match the hostname defined in the lemmy service - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536 # set the outside hostname here - LEMMY_UI_LEMMY_EXTERNAL_HOST=localhost:1236 - LEMMY_UI_HTTPS=false - LEMMY_UI_DEBUG=trueIt’s present in the link on:
https://join-lemmy.org/docs/administration/install_docker.html
Which refers people to download:
https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml
What you’re linking to is not what the live docs link to. I don’t know what main/docker is for, but the docs link to main/assets, not there.
You are right, that is sus. The main repo does not have this and the docs repo have the main as a sub module, but still have a folder named assets with a different docker-compose.yml.
Would have been nice with a link from the start.
Yeah, 100%. I edited the post to add more of the details.
That download to github assests is pointing to that file.
Maybe it’s already fixed.
See the edit to the post.
Ah. If someone has not fixed it yet I will submit a PR tonight.
Sounds great. Thank you, it sounds like a good idea.
Personally it’d be better if you just did it but as you said it’s a general security vulnerability and it would be better for the community if those did not exist.
Why don’t you a pull request and fix it yourself ? If you have the ability to recognize and know what to fix, and if you care, do it!
I know I’m too lazy to help them, what is your excuse ?
I swear, I might just get off the fence and help them myself on unrelated issues, it’s making me that unsettled