I made my admin account, but I can still accept /setup which looks like it will allow any random user to make an admin account as well.
How do I fix this?
Edit: It turns out that creating the admin account doesn't work, even though the page is still there.
8 Comments
one_old_coder@piefed.social · 8 pts · 7d
Lemmy, PieFed, Mastodon?
vercetti@lemmy.world · 7 pts · 7d
This is for Lemmy.
one_old_coder@piefed.social · 10 pts · 7d
I don't see any guide talking about that. I would try some kind of Htaccess to prevent people from using
/setup.It feels like a bandaid, but on the other hand I have never seen a "server application" where URLs like /setup can selfdestruct after one use.
OpenStars@discuss.online · 0 pts · 7d
You might try PieFed's setup process also - its reputedly very streamlined.
Die4Ever@retrolemmy.com · 2 pts · 6d
I don't think it does anything once the first admin account is created
hexagonwin@lemmy.today · 2 pts · 6d
even lemmy.ml operated by its devs have /setup exposed and not working, i think its fine
if it bothers you block or redirect the url on your web server's config
frongt@lemmy.zip · 2 pts · 7d
Does it actually work?
vercetti@lemmy.world · 2 pts · 6d
Thanks. I just tried it out and it actually doesn't work. The page is still there which is annoying, but at least it can't be exploited to give random people admin accounts.