From 336574571f2ba87f98f98ae9f28e4a4301435e89 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sat, 11 Jul 2026 09:00:08 +0100
Subject: [PATCH] admin password: 24 hex chars instead of 12

---
 tools/nextwks.sh | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index cf013b6..0824f38 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -35,11 +35,14 @@ maybe_sudo() {
 }
 
 # --- Load existing env (if any), skip if unreadable ---
+# Temporarily disable -u because .env may contain $ signs (bcrypt hashes)
+set +u
 if [ -r "$BACKUP_DIR/.env" ]; then
     set -a; source "$BACKUP_DIR/.env"; set +a
 elif [ -r "$TARGET_DIR/.env" ]; then
     set -a; source "$TARGET_DIR/.env"; set +a
 fi
+set -u
 DOMAIN="${DOMAIN:-nextwks.eu}"
 
 echo "=== NextWorkspace ${MODE} ==="
@@ -94,7 +97,7 @@ if [ "$MODE" = "install" ]; then
     while echo "$TLS_EMAIL" | grep -qv '@'; do read -p "Invalid email: " TLS_EMAIL; done
     read -p "Admin username: " ADMIN_USERNAME
     while [ -z "$ADMIN_USERNAME" ]; do read -p "Admin username (required): " ADMIN_USERNAME; done
-    ADMIN_PASSWORD=$(openssl rand -hex 6)
+    ADMIN_PASSWORD=$(openssl rand -hex 12)   # 24 chars, hex only (no special chars)
 
     echo ""
     echo "========================================"
@@ -115,21 +118,21 @@ if [ "$MODE" = "install" ]; then
     read -p "IMAP host [imap.openxchange.eu]: " IMAP_HOST; IMAP_HOST="${IMAP_HOST:-imap.openxchange.eu}"
     read -p "IMAP port [993]: " IMAP_PORT; IMAP_PORT="${IMAP_PORT:-993}"
 
-    # Persist config to backup vault
+    # Persist config to backup vault (single-quote values to protect $ signs)
     maybe_sudo mkdir -p "$BACKUP_DIR"
-    maybe_sudo bash -c "cat > '$BACKUP_DIR/.env' <<EOF
+    maybe_sudo sh -c "cat > '$BACKUP_DIR/.env' <<'ENVEOF'
 # NextWorkspace Configuration — auto-generated by nextwks.sh --install
-DOMAIN=$DOMAIN
-TLS_EMAIL=$TLS_EMAIL
-ADMIN_USERNAME=$ADMIN_USERNAME
-ADMIN_PASSWORD=$ADMIN_PASSWORD
-SMTP_HOST=$SMTP_HOST
-SMTP_PORT=$SMTP_PORT
-SMTP_USER=$SMTP_USER
-SMTP_PASS=$SMTP_PASS
-IMAP_HOST=$IMAP_HOST
-IMAP_PORT=$IMAP_PORT
-EOF"
+DOMAIN='$DOMAIN'
+TLS_EMAIL='$TLS_EMAIL'
+ADMIN_USERNAME='$ADMIN_USERNAME'
+ADMIN_PASSWORD='$ADMIN_PASSWORD'
+SMTP_HOST='$SMTP_HOST'
+SMTP_PORT='$SMTP_PORT'
+SMTP_USER='$SMTP_USER'
+SMTP_PASS='$SMTP_PASS'
+IMAP_HOST='$IMAP_HOST'
+IMAP_PORT='$IMAP_PORT'
+ENVEOF"
     maybe_sudo chmod 600 "$BACKUP_DIR/.env"
 fi
 
@@ -261,9 +264,10 @@ if [ "$MODE" != "update" ]; then
     if [ -f "$BACKUP_DIR/.env" ]; then
         maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
     fi
-    maybe_sudo bash -c "echo 'JWT_SECRET=$JWT_SECRET' >> '$BACKUP_DIR/.env'"
-    maybe_sudo bash -c "echo 'SESSION_SECRET=$SESSION_SECRET' >> '$BACKUP_DIR/.env'"
-    [ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo 'ADMIN_PASSWORD_HASH=$ADMIN_PASSWORD_HASH' >> '$BACKUP_DIR/.env'"
+    # Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
+    maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
+    maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
+    [ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
     maybe_sudo chmod 600 "$BACKUP_DIR/.env"
 fi