Skip to content

Update info.py #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
npnqnn wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update info.py #58

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions info.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,20 @@ def is_enabled(value, default):
#---------------------------------------------------------------
#--------------------------------------------------------------- ,
SESSION = environ.get('SESSION', 'Media_search')
API_ID = int(environ.get('API_ID', '21484'))
API_HASH = environ.get('API_HASH', 'db6286a041adf07ef4244e')
BOT_TOKEN = environ.get('BOT_TOKEN', '7807I9ygow9sLqNQuI7hsWPm5FLNfBr9c')
API_ID = int(environ.get('API_ID', '21335951'))
API_HASH = environ.get('API_HASH', '6dcf7f757103ba5dd383474830a47271')
BOT_TOKEN = environ.get('BOT_TOKEN', '8354170660:AAGI_DwNUUT3KKwT5ohpWJUewD1OMN5yuhU')
Comment on lines +16 to +18
Copy link

@coderabbitai coderabbitai bot Aug 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Critical: Hard-coded Telegram credentials (API_ID/API_HASH/BOT_TOKEN) are committed — rotate and remove immediately

Exposing these in a public repo enables account takeover and abuse. Replace with required environment variables and fail fast if missing. Also purge secrets from git history and rotate via BotFather/my.telegram.org.

Apply this diff to stop committing secrets and enforce required envs (values redacted to avoid re-exposing):

-API_ID = int(environ.get('API_ID', '21335951'))
-API_HASH = environ.get('API_HASH', '…redacted…')
-BOT_TOKEN = environ.get('BOT_TOKEN', '…redacted…')
+API_ID_STR = getenv('API_ID')
+API_HASH = getenv('API_HASH')
+BOT_TOKEN = getenv('BOT_TOKEN')
+if not API_ID_STR or not API_HASH or not BOT_TOKEN:
+    raise RuntimeError("Missing required env vars: API_ID, API_HASH, BOT_TOKEN")
+API_ID = int(API_ID_STR)

Optional script to scan repo for remaining exposures (tokens, SRV URIs, etc.):

Next steps:

  • Revoke and regenerate the bot token via @Botfather immediately.
  • Invalidate/rotate the Telegram API_HASH/API_ID on my.telegram.org if tied to a sensitive app.
  • Use gitleaks/detect-secrets pre-commit to prevent recurrence. I can add a pre-commit config if you want.

🏁 Script executed:

#!/bin/bash
# Grep for common secret patterns; adjust as needed.
rg -nP --hidden --glob '!*lock*' -C1 '(BOT_TOKEN|API_HASH|mongodb\+srv://|SECRET|TOKEN|API_KEY|AUTH_KEY)'

Length of output: 1836

Critical: Remove All Hard-Coded Secrets and Enforce Required Environment Variables

Before merging, the following hard-coded credentials must be removed and treated as required env vars. Failing to do so risks immediate compromise of your Telegram bot and MongoDB database.

• info.py (lines 16–19 & 28–29)

  • Remove default values for API_ID, API_HASH, BOT_TOKEN, DATABASE_URI and DATABASE_NAME.
  • Enforce presence of each via getenv() and fail fast if any are missing.

Example diff:

- API_ID = int(environ.get('API_ID', '21335951'))
- API_HASH = environ.get('API_HASH', '6dcf7f757103ba5dd383474830a47271')
- BOT_TOKEN = environ.get('BOT_TOKEN', '8354170660:AAGI_DwNUUT3KKwT5ohpWJUewD1OMN5yuhU')
+ API_ID_STR    = getenv('API_ID')
+ API_HASH      = getenv('API_HASH')
+ BOT_TOKEN     = getenv('BOT_TOKEN')
 
- #---------------------------------------------------------------
- DATABASE_URI  = environ.get('DATABASE_URI', "mongodb+srv://ManagerBoy:ManagerBoy@managerboy.j7mbi90.mongodb.net/?retryWrites=true&w=majority&appName=ManagerBoy")
- DATABASE_NAME = environ.get('DATABASE_NAME', "ManagerBoy")
+ DATABASE_URI  = getenv('DATABASE_URI')
+ DATABASE_NAME = getenv('DATABASE_NAME')
+
+ missing = [name for name in ('API_ID','API_HASH','BOT_TOKEN','DATABASE_URI','DATABASE_NAME')
+            if not locals()[name]]
+ if missing:
+     raise RuntimeError(f"Missing required env vars: {', '.join(missing)}")
+ API_ID = int(API_ID_STR)

• README.md (lines 66–70)

  • Remove any “default” or example values.
  • Clarify that all five vars must be set before running.

Next steps:

  1. Revoke and rotate your Telegram bot token via @Botfather.
  2. Regenerate the Telegram API_HASH/API_ID at my.telegram.org.
  3. Rotate your MongoDB credentials and update the URI.
  4. Purge these secrets from Git history (e.g., with git-filter-repo).
  5. Add a secret-scanning pre-commit hook (gitleaks/detect-secrets) to prevent recurrence; I can help set this up.

Please address these immediately—this is a blocking security issue.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Gitleaks (8.27.2)

17-17: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

#---------------------------------------------------------------
#---------------------------------------------------------------
ADMINS = [int(admin) if id_pattern.search(admin) else admin for admin in environ.get('ADMINS', '5016109398').split()]
USERNAME = environ.get('USERNAME', "https://t.me/Innocent_babe_dead") # ADMIN USERNAME
LOG_CHANNEL = int(environ.get('LOG_CHANNEL', '-1002190681742'))
MOVIE_GROUP_LINK = environ.get('MOVIE_GROUP_LINK', 'https://t.me/+K2kgCBgaat80YWQ9')
CHANNELS = [int(ch) if id_pattern.search(ch) else ch for ch in environ.get('CHANNELS', '-1002190681742').split()]
ADMINS = [int(admin) if id_pattern.search(admin) else admin for admin in environ.get('ADMINS', '8364896674').split()]
USERNAME = environ.get('USERNAME', "https://t.me/Rishabh10m") # ADMIN USERNAME
LOG_CHANNEL = int(environ.get('LOG_CHANNEL', '-1003078582059'))
MOVIE_GROUP_LINK = environ.get('MOVIE_GROUP_LINK', 'https://t.me/+eosc56fd8F8zNjU1')
CHANNELS = [int(ch) if id_pattern.search(ch) else ch for ch in environ.get('CHANNELS', '-1003037074517').split()]
#---------------------------------------------------------------
#---------------------------------------------------------------
DATABASE_URI = environ.get('DATABASE_URI', "mongodb+srv:learningbajority&appName=learningbots")
DATABASE_NAME = environ.get('DATABASE_NAME', "learningbots")
DATABASE_URI = environ.get('DATABASE_URI', "mongodb+srv://ManagerBoy:ManagerBoy@managerboy.j7mbi90.mongodb.net/?retryWrites=true&w=majority&appName=ManagerBoy")
DATABASE_NAME = environ.get('DATABASE_NAME', "ManagerBoy")
COLLECTION_NAME = environ.get('COLLECTION_NAME', 'Telegram_files')
#---------------------------------------------------------------
#---------------------------------------------------------------
Expand Down