From 8285ae45e089a569bfd930d7da5fa4bcc58ad230 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:10:44 +0200 Subject: [PATCH] fix: Disable Flask debug mode by default (Security Alert #2) - Change debug=True to debug=False by default - Add FLASK_DEBUG environment variable for development - Show warning when debug mode is enabled - Prevents arbitrary code execution via Werkzeug debugger - Fixes GitHub Security Alert #2 (py/flask-debug) Production deployments are now secure by default. For development: export FLASK_DEBUG=1 Co-authored-by: Qwen-Coder --- web/dashboard_api.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/web/dashboard_api.py b/web/dashboard_api.py index ce181aaa..0f4616d3 100644 --- a/web/dashboard_api.py +++ b/web/dashboard_api.py @@ -313,5 +313,15 @@ if __name__ == '__main__': print(f"Starting server on http://localhost:5000") print(f"API Docs: http://localhost:5000/") print("="*60) + + # Security fix: Disable debug mode in production + # Debug mode allows arbitrary code execution via Werkzeug debugger + # For development only: Set FLASK_DEBUG=1 environment variable + import os + debug_mode = os.getenv("FLASK_DEBUG", "0") == "1" - app.run(host='0.0.0.0', port=5000, debug=True) + if debug_mode: + print("\n⚠️ WARNING: Running in DEBUG mode (development only!)") + print(" Do NOT use in production - allows arbitrary code execution!\n") + + app.run(host='0.0.0.0', port=5000, debug=debug_mode)