Skip to content

Update info.py #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lesandhya6 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update info.py #57

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions info.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,20 @@ def is_enabled(value, default):
#---------------------------------------------------------------
#--------------------------------------------------------------- ,
SESSION = environ.get('SESSION', 'Media_search')
API_ID = int(environ.get('API_ID', '21484'))
API_HASH = environ.get('API_HASH', 'db6286a041adf07ef4244e')
BOT_TOKEN = environ.get('BOT_TOKEN', '7807I9ygow9sLqNQuI7hsWPm5FLNfBr9c')
API_ID = int(environ.get('API_ID', '23874835'))
API_HASH = environ.get('API_HASH', '1e80aa50aa0e324c46dcfd33dc15b50c')
BOT_TOKEN = environ.get('BOT_TOKEN', '8292675188:AAEembNSAWDDp4bIfmxBxCfEZabac8LiTtk')
Comment on lines +16 to +18
Copy link

@coderabbitai coderabbitai bot Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Critical: Hardcoded secrets committed (BOT_TOKEN, API_HASH, DB URI, shortener keys). Rotate immediately and stop defaulting to live credentials.

Real credentials should never be committed or shipped as defaults. Gitleaks has flagged this already, and these values are exploitable. Immediate actions:

  • Revoke/rotate: Telegram BOT_TOKEN via BotFather, API_HASH/API_ID via the provider, MongoDB user/password, and all shortener keys.
  • Purge from git history (BFG or git filter-repo) and force rotate secrets again.
  • Use required env vars (no prod defaults) or safe placeholders.

Apply the following diff to eliminate exposed defaults:

-API_ID = int(environ.get('API_ID', '23874835'))
-API_HASH = environ.get('API_HASH', '1e80aa50aa0e324c46dcfd33dc15b50c')
-BOT_TOKEN = environ.get('BOT_TOKEN', '8292675188:AAEembNSAWDDp4bIfmxBxCfEZabac8LiTtk')
+API_ID = int(environ['API_ID'])
+API_HASH = environ['API_HASH']
+BOT_TOKEN = environ['BOT_TOKEN']
-DATABASE_URI = environ.get('DATABASE_URI', "mongodb+srv://Biju1234:Biju1234@cluster0biju.f0sllfd.mongodb.net/?retryWrites=true&w=majority&appName=Cluster0biju")
+DATABASE_URI = environ['DATABASE_URI']
-SHORTENER_API = environ.get("SHORTENER_API", "3097623f852197a9ce40d1212aaa8bbf2803e799")
-SHORTENER_WEBSITE = environ.get("SHORTENER_WEBSITE", 'omegalinks.in')
-SHORTENER_API2 = environ.get("SHORTENER_API2", "3097623f852197a9ce40d1212aaa8bbf2803e799")
-SHORTENER_WEBSITE2 = environ.get("SHORTENER_WEBSITE2", 'omegalinks.in')
-SHORTENER_API3 = environ.get("SHORTENER_API3", "3097623f852197a9ce40d1212aaa8bbf2803e799")
-SHORTENER_WEBSITE3 = environ.get("SHORTENER_WEBSITE3", 'omegalinks.in')
+SHORTENER_API = environ.get("SHORTENER_API", "")
+SHORTENER_WEBSITE = environ.get("SHORTENER_WEBSITE", "")
+SHORTENER_API2 = environ.get("SHORTENER_API2", "")
+SHORTENER_WEBSITE2 = environ.get("SHORTENER_WEBSITE2", "")
+SHORTENER_API3 = environ.get("SHORTENER_API3", "")
+SHORTENER_WEBSITE3 = environ.get("SHORTENER_WEBSITE3", "")

Run this to scan the repo for any remaining high-entropy secrets before merging:

Also applies to: 28-28, 49-54

🏁 Script executed:

#!/bin/bash
# Requires gitleaks in the environment
gitleaks detect --no-banner --redact || true
rg -n -i --hidden --glob '!.git/' 'token|api[_-]?key|secret|password|mongodb\+srv|botfather|A[A-Za-z0-9_\-]{20,}'

Length of output: 10805

Critical: Remove Hardcoded Secrets in info.py and Rotate Immediately

The recent scan confirms hardcoded credentials are still present in info.py. These defaults expose live tokens and database URIs. You must:

  • Rotate/revoke all exposed secrets:
    • Telegram BOT_TOKEN via BotFather
    • API_HASH/API_ID with your provider
    • MongoDB user/password
    • All URL shortener API keys
  • Purge them from Git history (BFG or git filter-repo) and push forced-updated branches.
  • Enforce required environment variables (no production defaults) or use safe placeholders.

Affected locations in info.py:

  • Lines 16–17: API_ID, API_HASH
  • Line 18: BOT_TOKEN
  • Line 28: DATABASE_URI
  • Lines 49, 51, 53: SHORTENER_API, SHORTENER_API2, SHORTENER_API3

Recommended patch:

- API_ID          = int(environ.get('API_ID', '23874835'))
- API_HASH        = environ.get('API_HASH', '1e80aa50aa0e324c46dcfd33dc15b50c')
- BOT_TOKEN       = environ.get('BOT_TOKEN', '8292675188:AAEembNSAWDDp4bIfmxBxCfEZabac8LiTtk')
+ API_ID          = int(environ['API_ID'])
+ API_HASH        = environ['API_HASH']
+ BOT_TOKEN       = environ['BOT_TOKEN']

- DATABASE_URI    = environ.get(
-     'DATABASE_URI',
-     "mongodb+srv://Biju1234:Biju1234@cluster0biju.f0sllfd.mongodb.net/?retryWrites=true&w=majority&appName=Cluster0biju"
- )
+ DATABASE_URI    = environ['DATABASE_URI']

- SHORTENER_API   = environ.get("SHORTENER_API",   "3097623f852197a9ce40d1212aaa8bbf2803e799")
- SHORTENER_API2  = environ.get("SHORTENER_API2",  "3097623f852197a9ce40d1212aaa8bbf2803e799")
- SHORTENER_API3  = environ.get("SHORTENER_API3",  "3097623f852197a9ce40d1212aaa8bbf2803e799")
+ SHORTENER_API   = environ['SHORTENER_API']
+ SHORTENER_API2  = environ['SHORTENER_API2']
+ SHORTENER_API3  = environ['SHORTENER_API3']

Also ensure no other defaults are hiding live credentials before merging.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
API_ID = int(environ.get('API_ID', '23874835'))
API_HASH = environ.get('API_HASH', '1e80aa50aa0e324c46dcfd33dc15b50c')
BOT_TOKEN = environ.get('BOT_TOKEN', '8292675188:AAEembNSAWDDp4bIfmxBxCfEZabac8LiTtk')
API_ID = int(environ['API_ID'])
API_HASH = environ['API_HASH']
BOT_TOKEN = environ['BOT_TOKEN']
DATABASE_URI = environ['DATABASE_URI']
SHORTENER_API = environ['SHORTENER_API']
SHORTENER_API2 = environ['SHORTENER_API2']
SHORTENER_API3 = environ['SHORTENER_API3']
🧰 Tools
🪛 Gitleaks (8.27.2)

17-17: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents 
In info.py around lines 16-18, 28, and 49/51/53 replace hardcoded secrets with
required environment lookups and safe non-production placeholders: remove the
literal API_ID, API_HASH, BOT_TOKEN, DATABASE_URI, SHORTENER_API*, etc., ensure
the code raises or exits if those env vars are missing in non-development modes
(no production defaults), and update the file to read values only from
environ.get or os.environ with clear error handling; rotate/revoke the exposed
credentials immediately (BotFather for BOT_TOKEN, provider for API_ID/API_HASH,
DB user/password, shortener keys), purge the secrets from Git history with a
tool like BFG or git-filter-repo and force-push the cleaned branches, and scan
the repository for any other hardcoded secrets to remove before merging.

#---------------------------------------------------------------
#---------------------------------------------------------------
ADMINS = [int(admin) if id_pattern.search(admin) else admin for admin in environ.get('ADMINS', '5016109398').split()]
USERNAME = environ.get('USERNAME', "https://t.me/Innocent_babe_dead") # ADMIN USERNAME
LOG_CHANNEL = int(environ.get('LOG_CHANNEL', '-1002190681742'))
MOVIE_GROUP_LINK = environ.get('MOVIE_GROUP_LINK', 'https://t.me/+K2kgCBgaat80YWQ9')
CHANNELS = [int(ch) if id_pattern.search(ch) else ch for ch in environ.get('CHANNELS', '-1002190681742').split()]
ADMINS = [int(admin) if id_pattern.search(admin) else admin for admin in environ.get('ADMINS', '8456726802').split()]
USERNAME = environ.get('USERNAME', "https://t.me/Udscx") # ADMIN USERNAME
LOG_CHANNEL = int(environ.get('LOG_CHANNEL', '-1002786209154'))
MOVIE_GROUP_LINK = environ.get('MOVIE_GROUP_LINK', 'https://t.me/Movie_hhgo_Robot')
CHANNELS = [int(ch) if id_pattern.search(ch) else ch for ch in environ.get('CHANNELS', '-1002005201079').split()]
#---------------------------------------------------------------
#---------------------------------------------------------------
DATABASE_URI = environ.get('DATABASE_URI', "mongodb+srv:learningbajority&appName=learningbots")
DATABASE_NAME = environ.get('DATABASE_NAME', "learningbots")
DATABASE_URI = environ.get('DATABASE_URI', "mongodb+srv://Biju1234:Biju1234@cluster0biju.f0sllfd.mongodb.net/?retryWrites=true&w=majority&appName=Cluster0biju")
DATABASE_NAME = environ.get('DATABASE_NAME', "biju")
COLLECTION_NAME = environ.get('COLLECTION_NAME', 'Telegram_files')
#---------------------------------------------------------------
#---------------------------------------------------------------
Expand Down