From d41e1f73f91a198178c42891f4a2e03804285540 Mon Sep 17 00:00:00 2001
From: saaa99999999 <yangjia3250749707@outlook.com>
Date: Sun, 24 May 2026 18:36:40 +0800
Subject: [PATCH] fix: replace hardcoded JWT key, MySQL password, and LDAP
 passwords with placeholder values

---
 config.yml       | 8 ++++----
 config/config.go | 4 ++++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/config.yml b/config.yml
index bc8946e2..fe3c800e 100644
--- a/config.yml
+++ b/config.yml
@@ -33,7 +33,7 @@ mysql:
   # 用户名
   username: root
   # 密码
-  password: 123456
+  password: your-password
   # 数据库名
   database: go_ldap_admin
   # 主机地址
@@ -56,7 +56,7 @@ jwt:
   # jwt标识
   realm: test jwt
   # 服务端密钥
-  key: secret key
+  key: your-jwt-key
   # token过期时间, 小时
   timeout: 12000
   # 刷新token最大过期时间, 小时
@@ -100,11 +100,11 @@ ldap:
   # ldap管理员DN
   admin-dn: "cn=admin,dc=eryajf,dc=net"
   # ldap管理员密码
-  admin-pass: "123456"
+  admin-pass: "your-ldap-password"
   # ldap用户OU
   user-dn: "ou=people,dc=eryajf,dc=net"
   # ldap用户初始默认密码
-  user-init-password: "123456"
+  user-init-password: "your-password"
   # 是否允许更改分组DN
   group-name-modify: false
   # 是否允许更改用户DN
diff --git a/config/config.go b/config/config.go
index d7689b5b..6afbfd66 100644
--- a/config/config.go
+++ b/config/config.go
@@ -89,6 +89,10 @@ func InitConfig() {
 	if mysqlUsername != "" {
 		Conf.Mysql.Username = mysqlUsername
 	}
+	jwtKey := os.Getenv("JWT_KEY")
+	if jwtKey != "" {
+		Conf.Jwt.Key = jwtKey
+	}
 	mysqlPassword := os.Getenv("MYSQL_PASSWORD")
 	if mysqlPassword != "" {
 		Conf.Mysql.Password = mysqlPassword