From b6a4fb1f27f4d894b384c0f3acacda276d1338a5 Mon Sep 17 00:00:00 2001 From: Henrique Dias Date: Sat, 28 Mar 2026 19:08:19 +0100 Subject: [PATCH] fix: self-registered users don't get execute perms --- http/auth.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/http/auth.go b/http/auth.go index d975beae..59f15a36 100644 --- a/http/auth.go +++ b/http/auth.go @@ -171,6 +171,12 @@ var signupHandler = func(_ http.ResponseWriter, r *http.Request, d *data) (int, // if that is the default permission. user.Perm.Admin = false + // Self-registered users should not inherit execution capabilities from + // default settings, regardless of what the administrator has configured + // as the default. Execution rights must be explicitly granted by an admin. + user.Perm.Execute = false + user.Commands = []string{} + pwd, err := users.ValidateAndHashPwd(info.Password, d.settings.MinimumPasswordLength) if err != nil { return http.StatusBadRequest, err