From b055612e3c7f05a2c5d0e2c2f300ab9c6a710596 Mon Sep 17 00:00:00 2001
From: Eric Mc Sween <eric.mcsween@overleaf.com>
Date: Wed, 18 Dec 2019 04:25:51 -0500
Subject: [PATCH] Removal of default API passwords (#2422)

GitOrigin-RevId: d831adcf2fb8bec8792dda624c255474480bb897
---
 services/web/app.js                                    |  5 +++++
 services/web/config/settings.defaults.coffee           |  7 ++++---
 .../web/test/acceptance/config/settings.test.coffee    | 10 ++++++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/services/web/app.js b/services/web/app.js
index 374cf7cb4a..f95d5f8e77 100644
--- a/services/web/app.js
+++ b/services/web/app.js
@@ -35,6 +35,11 @@ const port = Settings.port || Settings.internal.web.port || 3000
 const host = Settings.internal.web.host || 'localhost'
 if (!module.parent) {
   // Called directly
+
+  // We want to make sure that we provided a password through the environment.
+  if (!process.env['WEB_API_USER'] || !process.env['WEB_API_PASSWORD']) {
+    throw new Error('No API user and password provided')
+  }
   Server.server.listen(port, host, function() {
     logger.info(`web starting up, listening on ${host}:${port}`)
     logger.info(`${require('http').globalAgent.maxSockets} sockets enabled`)
diff --git a/services/web/config/settings.defaults.coffee b/services/web/config/settings.defaults.coffee
index 8c3220bb22..f757bc164d 100644
--- a/services/web/config/settings.defaults.coffee
+++ b/services/web/config/settings.defaults.coffee
@@ -8,10 +8,11 @@ minutes = 60 * seconds
 
 # These credentials are used for authenticating api requests
 # between services that may need to go over public channels
-httpAuthUser = process.env['WEB_API_USER'] or "sharelatex"
-httpAuthPass = process.env['WEB_API_PASSWORD'] or "password"
+httpAuthUser = process.env['WEB_API_USER']
+httpAuthPass = process.env['WEB_API_PASSWORD']
 httpAuthUsers = {}
-httpAuthUsers[httpAuthUser] = httpAuthPass
+if httpAuthUser and httpAuthPass
+	httpAuthUsers[httpAuthUser] = httpAuthPass
 
 sessionSecret = process.env['SESSION_SECRET'] or "secret-please-change"
 
diff --git a/services/web/test/acceptance/config/settings.test.coffee b/services/web/test/acceptance/config/settings.test.coffee
index b550da5627..e6b81a2763 100644
--- a/services/web/test/acceptance/config/settings.test.coffee
+++ b/services/web/test/acceptance/config/settings.test.coffee
@@ -3,10 +3,20 @@ v1Api =
 	user: 'overleaf'
 	pass: 'password'
 
+httpAuthUser = "sharelatex"
+httpAuthPass = "password"
+httpAuthUsers = {}
+httpAuthUsers[httpAuthUser] = httpAuthPass
+
 module.exports =
 	enableSubscriptions: true
 
+	httpAuthUsers: httpAuthUsers
+
 	apis:
+		web:
+			user: httpAuthUser
+			pass: httpAuthPass
 		v1:
 			url: v1Api.url
 			user: v1Api.user