From 7303c94a3c0133a550d0f7e7ea1a28953f64556a Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sat, 11 Jul 2026 09:16:14 +0100
Subject: [PATCH] fix bcrypt hash corruption: avoid bash -c re-expanding $
 signs, auto-regenerate hash on update

---
 tools/nextwks.sh | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 5da96cb..211b023 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -267,11 +267,10 @@ sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
     -e "s|{SMTP_PASS}|$SMTP_PASS|g" \
     "$BUILD_DIR/config/authelia/configuration.yml" > "$GEN_DIR/configuration.yml"
 
-# Users database
-ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
-if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ]; then
-    ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
-fi
+    # Users database — regenerate hash if ADMIN_PASSWORD is available
+    if [ -n "${ADMIN_PASSWORD:-}" ]; then
+        ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "$ADMIN_PASSWORD_HASH")
+    fi
 sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
     -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
     "$BUILD_DIR/config/authelia/users_database.yml" > "$GEN_DIR/users_database.yml"
@@ -285,11 +284,11 @@ maybe_sudo cp "$GEN_DIR/users_database.yml" "$TARGET_DIR/config/authelia/users_d
 if [ -f "$BACKUP_DIR/.env" ]; then
     maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
 fi
-# Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
-maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
-maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
-maybe_sudo bash -c "echo \"STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'\" >> '$BACKUP_DIR/.env'"
-[ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
+# Use pipe to avoid bash -c re-expanding $ signs (bcrypt hashes contain $2a$10$...)
+echo "JWT_SECRET='$JWT_SECRET'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
+echo "SESSION_SECRET='$SESSION_SECRET'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
+echo "STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
+[ -n "$ADMIN_PASSWORD_HASH" ] && echo "ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
 maybe_sudo chmod 600 "$BACKUP_DIR/.env"
 
 # ============================================================