starred/motioneye

Fork 0

mirror of https://github.com/motioneye-project/motioneye.git synced 2026-03-02 22:57:06 -05:00

Exposing admin username in javascript could be a potential security risk #2098

New issue

Open

opened 2026-02-28 01:03:39 -05:00 by deekerman · 4 comments

deekerman commented

2026-02-28 01:03:39 -05:00

Owner

Originally created by @developerfromjokela on GitHub (Dec 28, 2021).

Hello!
motionEye seems to expose admin username in its HTML as javascript variable.
I think this is a potential security risk for brute-force and/or dictionary attacks towards the login system.

What was/is purpose of keeping that variable in HTML?

Originally created by @developerfromjokela on GitHub (Dec 28, 2021). Hello! motionEye seems to expose admin username in its HTML as javascript variable. I think this is a potential security risk for brute-force and/or dictionary attacks towards the login system. What was/is purpose of keeping that variable in HTML?

deekerman added the

question

enhancement

security

labels

2026-02-28 01:03:39 -05:00

deekerman commented

2026-02-28 01:03:43 -05:00

Author

Owner

@G2G2G2G commented on GitHub (Feb 4, 2022):

This has nothing to do with brute force or dictionary attacks in any way.
data logging/sniffing/reading sure

@G2G2G2G commented on GitHub (Feb 4, 2022): This has nothing to do with brute force or dictionary attacks in any way. data logging/sniffing/reading sure

deekerman commented

2026-02-28 01:03:43 -05:00

Author

Owner

@developerfromjokela commented on GitHub (Feb 4, 2022):

It has. If you don't expose your username, they cannot login even if they had correct password.

@developerfromjokela commented on GitHub (Feb 4, 2022): It has. If you don't expose your username, they cannot login even if they had correct password.

deekerman commented

2026-02-28 01:03:43 -05:00

Author

Owner

@developerfromjokela commented on GitHub (Feb 4, 2022):

It makes that job easier

@developerfromjokela commented on GitHub (Feb 4, 2022): It makes that job easier

deekerman commented

2026-02-28 01:03:43 -05:00

Author

Owner

@MichaIng commented on GitHub (Mar 18, 2022):

What was/is purpose of keeping that variable in HTML?

It is the way how it is passed from the backend to browser's JavaScript to check whether the current user is the admin user, to show/hide enable/disable certain GUI elements:

Set here via inline script, generated by backend: github.com/motioneye-project/motioneye@c7d86c6/motioneye/templates/main.html (L89)
Used for this function in main JavaScript, executed in browser: github.com/motioneye-project/motioneye@4249e44/motioneye/static/js/main.js (L398)

However, I agree this is not so awesome. The admin username cannot be changed via GUI, but at least manually via config file. Since it is not used anywhere else in the frontend, it makes more sense to pass an "isAdmin" flag instead of the name. Even smarter would be to apply an admin or non-admin class to admin-only HTML elements right with the backend to have them shown/hidden in the first place, without needing to toggle classes via JavaScript, making even passing this flag obsolete.

@MichaIng commented on GitHub (Mar 18, 2022): > What was/is purpose of keeping that variable in HTML? It is the way how it is passed from the backend to browser's JavaScript to check whether the current user is the admin user, to show/hide enable/disable certain GUI elements: - Set here via inline script, generated by backend: https://github.com/motioneye-project/motioneye/blob/c7d86c6/motioneye/templates/main.html#L89 - Used for this function in main JavaScript, executed in browser: https://github.com/motioneye-project/motioneye/blob/4249e44/motioneye/static/js/main.js#L398 However, I agree this is not so awesome. The admin username cannot be changed via GUI, but at least manually via config file. Since it is not used anywhere else in the frontend, it makes more sense to pass an "isAdmin" flag instead of the name. Even smarter would be to apply an admin or non-admin class to admin-only HTML elements right with the backend to have them shown/hidden in the first place, without needing to toggle classes via JavaScript, making even passing this flag obsolete.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/motioneye#2098

No description provided.

Rows
Columns