I made my admin account, but I can still accept /setup which looks like it will allow any random user to make an admin account as well.
How do I fix this?
Edit: It turns out that creating the admin account doesn’t work, even though the page is still there.
even lemmy.ml operated by its devs have /setup exposed and not working, i think its fine
if it bothers you block or redirect the url on your web server’s config
I don’t think it does anything once the first admin account is created
Does it actually work?
Thanks. I just tried it out and it actually doesn’t work. The page is still there which is annoying, but at least it can’t be exploited to give random people admin accounts.
Lemmy, PieFed, Mastodon?
This is for Lemmy.
You might try PieFed’s setup process also - its reputedly very streamlined.
I don’t see any guide talking about that. I would try some kind of Htaccess to prevent people from using
/setup.It feels like a bandaid, but on the other hand I have never seen a “server application” where URLs like /setup can selfdestruct after one use.
