password reset?

[obermotz]

Is there a way to reset the password of the only user of this app? Found the pw hash in the SQLite DB but have no idea how to change/reset it.

[basnappl]

I figured out how to do this. Here is where the hash function is defined:

https://github.com/sysadminsmedia/homebox/blob/4e260c5a8b63/backend/pkgs/hasher/password.go#L21

So, it is 14 rounds of BCrypt. Go here:

https://gchq.github.io/CyberChef/#recipe=Bcrypt(14)

Type your desired password into the input box (e.g. "password") and copy the output (e.g., "$2a$14$Md4yuy6MYjjWmZf5a.p3XejJ2YUM/YWErxiX9/y.mG1OGj7xrjJ8.").

Now, follow these instructions to update your user (e.g., "user@domain.com")'s password:

/data $ sqlite3 homebox.db
SQLite version 3.44.2 2023-11-24 11:41:44
Enter ".help" for usage hints.
# Select from the users table to find passwords
sqlite> SELECT * FROM users;
redacted-id|2023-12-24 00:52:30.631113005 +0000 UTC m=+416.141669318|2023-12-24 00:52:30.631122795 +0000 UTC m=+416.141679108|Username|user@domain.com|$2THISISYOURPASSWORDHASHRIGHTHERE|0|0|owner||redacted-id
sqlite> UPDATE users
SET password = '$2a$14$Md4yuy6MYjjWmZf5a.p3XejJ2YUM/YWErxiX9/y.mG1OGj7xrjJ8.'
WHERE email = 'user@domain.com';
.quit