mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-05-07 03:58:09 -05:00
Closed
opened 2026-04-20 16:11:03 -05:00 by GiteaMirror
·
13 comments
No Branch/Tag Specified
main
feat-v2-foundation
spike-huma-openapi3
claude/investigate-swagger3-support-nyyUa
feat-list-view-buckets
ci-mysql-8-test
codex/analyze-codebase-for-email-task-feature
feat-project-templates
csv-import-feature
claude/email-reply-comments-wpdcQ
fix-oidc-pkce-support
fix/overview-subtasks-expand
feat/bucket-select-task-detail
feat-soft-delete-projects
claude/review-bot-design-plan-cf5C3
claude/project-scoped-api-tokens-KTqR3
claude/explore-openclaw-integration-KQEzg
claude/project-scoped-api-tokens-yv5KS
fix-duplicate-close-button
feat-list-view-sorting
feat/official-vite-sentry-plugin
feat/highlight-overdue-tasks
feat/add-enter-key-form-submission-handling
feat/TipTap-nits
feat/update-caldavtimetotimestamp-parsing
feat-phosphor-icons
wip-plans
claude/investigate-issue-2173-llKme
fix-description-text-drag
feat-custom-keyboard-shortcuts
pr-1845-ci
codex/fix-drag-and-drop-behavior-inconsistency
copilot/add-clickable-labels-for-filtering
copilot/fix-issue-1786
playwright-migration
fix-kanban-repeating-wip
copilot/fix-1498
feature/replace-axios
codex/upgrade-to-tailwind-4.1.8-using-pnpm
codex/add-cypress-test-for-avatar-types
feature/biome
feature/oxc
codex/update-flexsearch-to-0.8.205
4r6ni9-codex/fix-deprecated-sass-@import-usage
codex/fix-deprecated-sass-@import-usage
codex/add-cypress-test-for-task-list-refresh-fix
codex/fix-quick-add-magic-not-adding-tasks
codex/fix-all-type-errors
codex/fix-mimetype-for-docs.json
feature/caldav-from-scratch
feature/gh-actions-hetzner
fix-ci
feat/new-logger
jyte-better-dev-config
feat/add-team-member-with-enter
fix/button-and-icon-types
fix/notifications-component-name-collision
feature/null-time
renovate/tailwindcss-4.x
feature/unplugin-vue-router
fix/deprecated-import
feature/zod-schema
renovate/golangci-golangci-lint-1.x
fix/tiptap-editor-reactive-destructuring
release/0.24
feat/improve-add-task
fix/saved-filter-search
feat/webp-and-avif-attachment-previews
feature/migrate-back-to-bulma
fix/sass-add-missing-list-import
feature/sticky-demo-bar
fix/gantt-view-switch
feature/typesense-position-join
feature/focus-visible
dependencies/golangci-lint
feature/better-filter-syntax
fix/tiptap-task-list
renovate/github.com-golang-jwt-jwt-v4-5.x
feature/hide-forbidden-related-tasks
renovate/golang-1.x
release/0.20
release/0.17
release/0.16
release/0.15
release/0.14
v2.3.0
v2.2.2
v2.2.1
v2.2.0
v2.1.0
v2.0.0
v1.1.0
v1.0.0
v1.0.0-rc4
v1.0.0-rc3
v1.0.0-rc2
v1.0.0-rc1
v1.0.0-rc0
v0.24.6
v0.24.5
v0.24.4
v0.24.3
v0.24.2
v0.24.1
v0.24.0
v0.23.0
v0.22.1
v0.22.0
0.21.0
v0.21.0
v0.20.4
v0.20.5
v0.20.3
v0.20.2
v0.20.1
v0.20.0
v0.19.2
v0.19.1
v0.19.0
vue3
v0.18.1
v0.18.0
v0.17.1
v0.17.0
v0.16.1
v0.16.0
v0.15.1
v0.15.0
v0.14.1
v0.14.0
v0.13.1
v0.13
v0.12
v0.11
v0.10
v0.9
v0.8
v0.7
v0.6
v0.5
v0.4
v0.3
v0.2
v0.1
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
question
security
support
upstream issue
waiting for reply
wontfix
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/vikunja#5832
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @xrhstosmour on GitHub (Mar 9, 2022).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/22
I am trying to deploy via docker-compose the
vikunja/apiimage, using as database PostgreSQL.When the VIKUNJA_DATABASE_PASSWORD environment variable contains any special character like:
#$!@the deployment fails with the following error:
pq: password authentication failed for user "<my_database_user>" usermod: no changes.Only if i remove every special character the deployment suceeds.
I also tried escaping the password but nothing changed. A tool you can use for escaping the password can be found here.
Below you can find an example of the docker-compose.yml i tried:
How should i face this problem and proceed with the deployment?
Thank you in advance.
@kolaente commented on GitHub (Mar 9, 2022):
Are you sure this is a vikunja specific problem and not one of docker compose?
Does it work if you run the container manually with the docker command?
@xrhstosmour commented on GitHub (Mar 9, 2022):
Just tested it, using the same PostgreSQL database, which works for all the other containers i use.
I forgot to say that i use a different port for the database which is exposed at the postgresql service at the docker-compose.yml as follows:
and provide it to the vikunja service at the docker-compose.yml, at the VIKUNJA_DATABASE_HOST environment variable as i described before:
Furthermore i got again the same error, when doing what you suggested, as you can see below:
The config.yml file i used has the below format:
If i try to connect via pgAdmin to the above database, using the config.yml credentials without escaping anything, the connection succeeds.
What am i doing wrong?
@kolaente commented on GitHub (Mar 9, 2022):
Can you check with the postgres container if there's an error about a failed password attempt? I think you won't be able to reach the postgres container in your test with
docker runsince the two containers are not on the same network and the api container won't be able to reach any ports on exposed to the host by default.I tried reproducing your problem with this compose file:
but it failed to start with the error
Invalid interpolation format for "environment" option in service "db": "passwordwith#$!@test"- I think docker compose's yaml parser is to blame here. I then moved the password to a .env file and it didn't work either. I don't know if the password it ended up setting in the db was the one I provided in the .env file though, probably not.May I ask what your attack vector is here for using special characters in a db password? I think you could easily use a very long password (200+ characters) instead and be as secure, especially if you have your network properly secured so nobody can access it from the outside of your server.
@kolaente commented on GitHub (Mar 9, 2022):
Ah can you make sure the password you configured in Vikunja's config works? With the
psqlcli tool?@xrhstosmour commented on GitHub (Mar 9, 2022):
Yeap there is an error about failed password:
I made sure to use the appropriate network for the connection between the containers.
I pass the password through a .env file too like so:
As for the reason i use special characters is because i am a maniac 🤣and this image:
As for the
psqlcli tool, i can't test it, but it says:which is what exactly have tried through the docker-compose.yml .env and nothing worked.
@kolaente commented on GitHub (Mar 9, 2022):
Nice image :) I doubt is will make a difference in practice whether it takes 23qd years or 1qt years to crack a password for a local Vikunja database. Again, if you secured your network properly that means someone who will make this much effort to get your Vikunja tasks probably sits on your pc already and knows everything about you. If I were targeted by someone with this much resources I doubt there's a lot I can do to protect myself. Other than turning everything off and moving to the woods of course.
I'm going to be a bit rude here and will close this issue as it does not seem to be related to a Problem in Vikunja. You might want to move this problem to the docker-compose or postgres projects.
Feel free to ping though if you have other issues or find a solution 👋
@xrhstosmour commented on GitHub (Mar 9, 2022):
As i said maniac 🤣.
As for the issue i will look to it some more, as i think it has to do with the way the PostgreSQL URI being used at the backend of the Vikunja application, because the same special character password strategy is being used to all the other containers i use, for instance pgAdmin, Joplin and VaultWarden (which says it needs the password encoded) and every one of them worked like charm, at the same docker-compose.yml.
So yes it's a bit rude, but i understand.
Goodbye.
@kolaente commented on GitHub (Mar 9, 2022):
Please keep me posted if you find anything!
@xrhstosmour commented on GitHub (Mar 9, 2022):
That is the last comment i do, i promise!
Is there any case the the problem has to do with the url.PathEscape function here.
I have no experience with Go but when i tried to run what my .env should probably pass to the vikunja API, that is what it came back:
As you can see characters
@and$are not escaped and if i escape them manually by changing them to%40and%24accordingly at the .env file, then the function escapes the%, messing up the connection string more.@kolaente commented on GitHub (Mar 9, 2022):
Very interesting, that's probably the cause here. I'm not sure how to fix this though. One way would be to remove the call to
url.PathEscapebut I don't think that'd be a good way to fix this since we'd loose the escaping. I don't remember exactly why I put it in there in the first place though so maybe we're safe to remove it. Reopening this issue though since it does seem to be a problem in Vikunja.How do others solve it?
@xrhstosmour commented on GitHub (Mar 9, 2022):
Again I am not sure if that is the real case, because both escaping and encoding should cooperate with the PostgreSQL engine you use for the connection, so as to keep the password the same both when receiving and when authenticating.
I am not sure what is the right solution without breaking any other part of the code, maybe trying to use some Encode function that Go might have.
Some containers I use, I think they encode/escape all the characters.
On the other hand VaultWarden, let the user percentage encode the password, if there are any special characters in, details can be found here.
Again, just to be clear all of the above are guesses, I just really like the interface (a dark theme also would be nice 😂) and the concept of Vikunja (also I love Dart/Flutter), so I wanted to try it, in a home server project.
@AmitPr commented on GitHub (Mar 20, 2022):
Can confirm that I wasn't able to connect to postgres when my user password had special characters, but when I changed the password to only contain alphanumeric characters everything worked as expected. Seems like an issue within vikunja or one of the libraries it's pulling from.
@kolaente commented on GitHub (Jul 7, 2022):
I did some more digging and it looks like this works without issues when I remove the escaping all together. I went ahead and did just that in
230478aae9. My guess is the db driver will also escape the passwords implicitly and would therefore double-escape everything with the escaping in Vikunja as well.