From 4b6e577dfbebc90f105d0d2f730a94a579f18ab4 Mon Sep 17 00:00:00 2001 From: Guoguo Date: Tue, 28 Apr 2026 19:06:11 -0700 Subject: [PATCH] fix: correct init-db hashPassword call for bcrypt migration hashPassword now uses bcrypt (single arg), not SHA-256 (password+salt). The old call silently ignored the salt param but was misleading. --- server/scripts/init-db.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/server/scripts/init-db.js b/server/scripts/init-db.js index 21fc5a3..338f0a0 100644 --- a/server/scripts/init-db.js +++ b/server/scripts/init-db.js @@ -23,11 +23,10 @@ async function main() { const [rows] = await conn.execute('SELECT admin_id FROM admin_accounts WHERE username = ?', [config.admin.username]) if (rows.length === 0) { - const salt = randomHex(16) - const passwordHash = hashPassword(config.admin.password, salt) + const passwordHash = hashPassword(config.admin.password) await conn.execute( 'INSERT INTO admin_accounts (username, password_hash, password_salt, real_name, role, status) VALUES (?, ?, ?, ?, ?, 1)', - [config.admin.username, passwordHash, salt, '管理员', 'admin'] + [config.admin.username, passwordHash, '', '管理员', 'admin'] ) }