From d6b8f95049570976be439e1876044316d0c32e02 Mon Sep 17 00:00:00 2001
From: MickaelK <mickael@kerjean.me>
Date: Tue, 28 Apr 2026 12:46:26 +1000
Subject: [PATCH] chore (maintenance): address points in filestash_001

---
 server/common/config_state.go            | 15 +++++++++++++--
 server/plugin/plg_backend_local/index.go | 15 ++++++++-------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/server/common/config_state.go b/server/common/config_state.go
index 25c8a74c..f49353df 100644
--- a/server/common/config_state.go
+++ b/server/common/config_state.go
@@ -30,7 +30,7 @@ func LoadConfig() ([]byte, error) {
 	file, err := os.OpenFile(GetAbsolutePath(CONFIG_PATH, "config.json"), os.O_RDONLY, os.ModePerm)
 	if err != nil {
 		if os.IsNotExist(err) {
-			os.MkdirAll(GetAbsolutePath(CONFIG_PATH), os.ModePerm)
+			os.MkdirAll(GetAbsolutePath(CONFIG_PATH), 0770)
 			return []byte(""), nil
 		}
 		return nil, err
@@ -69,7 +69,7 @@ func LoadConfig() ([]byte, error) {
 }
 
 func SaveConfig(v []byte) error {
-	file, err := os.Create(GetAbsolutePath(CONFIG_PATH, "config.json"))
+	file, err := os.OpenFile(GetAbsolutePath(CONFIG_PATH, "config.json"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0660)
 	if err != nil {
 		return fmt.Errorf(
 			APPNAME+" needs to be able to create and edit its configuration, but it currently cannot. "+
@@ -111,3 +111,14 @@ func SaveConfig(v []byte) error {
 	}
 	return file.Close()
 }
+
+func init() {
+	Hooks.Register.Onload(func() {
+		if err := os.Chmod(GetAbsolutePath(CONFIG_PATH), 0770); err != nil && os.IsNotExist(err) == false {
+			Log.Warning("common::config_state::onload cannot chmod config directory: %s", err.Error())
+		}
+		if err := os.Chmod(GetAbsolutePath(CONFIG_PATH, "config.json"), 0660); err != nil && os.IsNotExist(err) == false {
+			Log.Warning("common::config_state::onload cannot chmod config file: %s", err.Error())
+		}
+	})
+}
diff --git a/server/plugin/plg_backend_local/index.go b/server/plugin/plg_backend_local/index.go
index a4b00b99..e8a0a05e 100644
--- a/server/plugin/plg_backend_local/index.go
+++ b/server/plugin/plg_backend_local/index.go
@@ -9,20 +9,21 @@ import (
 )
 
 func init() {
-	Backend.Register("local", &Local{})
+	Backend.Register("local", &Local{os.Getenv("LOCAL_BACKEND_SECRET")})
 }
 
-type Local struct{}
+type Local struct {
+	secret string
+}
 
 func (this Local) Init(params map[string]string, app *App) (IBackend, error) {
-	backend := &Local{}
-	if params["password"] == Config.Get("general.secret_key").String() {
-		return backend, nil
-	} else if err := bcrypt.CompareHashAndPassword(
+	if err := bcrypt.CompareHashAndPassword(
 		[]byte(Config.Get("auth.admin").String()),
 		[]byte(params["password"]),
 	); err == nil {
-		return backend, nil
+		return &Local{}, nil
+	} else if this.secret != "" && params["password"] == this.secret {
+		return &Local{}, nil
 	}
 	return nil, ErrAuthenticationFailed
 }