passenger 6.1.8 → 6.2.1

data/src/agent/Core/SecurityUpdateChecker.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2017-2025 Asynchronous B.V.
+ *  Copyright (c) 2017-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Config/AutoGeneratedCode.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2017-2025 Asynchronous B.V.
+ *  Copyright (c) 2017-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Config/AutoGeneratedCode.h.cxxcodebuilder

@@ -1,5 +1,5 @@
 #  Phusion Passenger - https://www.phusionpassenger.com/
-#  Copyright (c) 2017-2025 Asynchronous B.V.
+#  Copyright (c) 2017-2026 Asynchronous B.V.
 #
 #  "Passenger", "Phusion Passenger" and "Union Station" are registered
 #  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Config.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Context.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/DirectSpawner.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/DummySpawner.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/ErrorRenderer.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2014-2025 Asynchronous B.V.
+ *  Copyright (c) 2014-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Exceptions.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.
@@ -91,6 +91,7 @@ private:
 	string problemDescription;
 	string solutionDescription;
 	string stdoutAndErrData;
+	string whatMessage;
 	string id;
 
 	EnvDump parentProcessEnvDump;
@@ -188,6 +189,56 @@ private:
 		return message;
 	}
 
+	static string createWhatMessage(const string &summary,
+		const string &stdoutAndErrData)
+	{
+		static const size_t OUTPUT_CHUNK_SIZE = 4 * 1024;
+		static const size_t MAX_OUTPUT_SIZE = OUTPUT_CHUNK_SIZE * 2;
+
+		// HandshakePerform uses this sentinel when no output capture channel exists.
+		if (summary.empty() || stdoutAndErrData.empty()
+		 || stdoutAndErrData == "(not available)")
+		{
+			return summary;
+		}
+
+		string output;
+		if (stdoutAndErrData.size() > MAX_OUTPUT_SIZE) {
+			output.reserve(MAX_OUTPUT_SIZE + 64);
+			output.append(stdoutAndErrData, 0, OUTPUT_CHUNK_SIZE);
+			output.append("\n[...truncated ");
+			output.append(toString(stdoutAndErrData.size() - MAX_OUTPUT_SIZE));
+			output.append(" bytes...]\n");
+			output.append(stdoutAndErrData, stdoutAndErrData.size() - OUTPUT_CHUNK_SIZE,
+				OUTPUT_CHUNK_SIZE);
+		} else {
+			output = stdoutAndErrData;
+		}
+
+		if (!output.empty() && output[output.size() - 1] == '\n') {
+			output.erase(output.size() - 1);
+			if (!output.empty() && output[output.size() - 1] == '\r') {
+				output.erase(output.size() - 1);
+			}
+		}
+
+		string message;
+		message.reserve(summary.size() + output.size() + 32);
+		message.append(summary);
+		message.append("\nSubprocess output:\n    ");
+		for (string::const_iterator it = output.begin(); it != output.end(); it++) {
+			message.push_back(*it);
+			if (*it == '\n' && it + 1 != output.end()) {
+				message.append("    ");
+			}
+		}
+		return message;
+	}
+
+	void updateWhatMessage() {
+		whatMessage = createWhatMessage(summary, stdoutAndErrData);
+	}
+
 	static string createDefaultProblemDescription(ErrorCategory category,
 		const Journey &journey, const Config &config,
 		const StaticString &advancedProblemDetails,
@@ -791,6 +842,7 @@ public:
 	{
 		assert(_journey.getFirstFailedStep() != UNKNOWN_JOURNEY_STEP);
 		config.internStrings();
+		updateWhatMessage();
 	}
 
 	SpawnException(const std::exception &originalException,
@@ -805,13 +857,19 @@ public:
 	{
 		assert(_journey.getFirstFailedStep() != UNKNOWN_JOURNEY_STEP);
 		config.internStrings();
+		updateWhatMessage();
 	}
 
 	virtual ~SpawnException() throw() {}
 
 
+	/**
+	 * A plain-text representation of the error for terminals, logs and exception consumers.
+	 * Includes subprocess output if available, though limited to a fixed size by truncating
+	 * in the middle.
+	 */
 	virtual const char *what() const throw() {
-		return summary.c_str();
+		return whatMessage.c_str();
 	}
 
 	ErrorCategory getErrorCategory() const {
@@ -833,6 +891,7 @@ public:
 
 	void setSummary(const string &value) {
 		summary = value;
+		updateWhatMessage();
 	}
 
 	const string &getAdvancedProblemDetails() const {
@@ -865,6 +924,7 @@ public:
 
 	void setStdoutAndErrData(const string &value) {
 		stdoutAndErrData = value;
+		updateWhatMessage();
 	}
 
 	const string &getId() const {
@@ -881,6 +941,7 @@ public:
 			summary = createDefaultSummary(category, journey,
 				advancedProblemDetails);
 		}
+		updateWhatMessage();
 		if (problemDescription.empty()) {
 			problemDescription = createDefaultProblemDescription(
 				category, journey, config, advancedProblemDetails,

data/src/agent/Core/SpawningKit/Factory.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Handshake/BackgroundIOCapturer.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Handshake/Perform.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2016-2025 Asynchronous B.V.
+ *  Copyright (c) 2016-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.
@@ -116,7 +116,8 @@ private:
 	void initializeStdchannelsCapturing() {
 		if (stdoutAndErrFd != -1) {
 			stdoutAndErrCapturer = boost::make_shared<BackgroundIOCapturer>(
-				stdoutAndErrFd, pid, "output", alreadyReadStdoutAndErrData);
+				stdoutAndErrFd, pid, config->appGroupName, config->logFile,
+				"output", alreadyReadStdoutAndErrData);
 			stdoutAndErrCapturer->setEndReachedCallback(boost::bind(
 				&HandshakePerform::wakeupEventLoop, this));
 			stdoutAndErrCapturer->start();

data/src/agent/Core/SpawningKit/Handshake/Prepare.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2016-2025 Asynchronous B.V.
+ *  Copyright (c) 2016-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Handshake/Session.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2016-2025 Asynchronous B.V.
+ *  Copyright (c) 2016-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Handshake/WorkDir.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Journey.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2017-2025 Asynchronous B.V.
+ *  Copyright (c) 2017-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/PipeWatcher.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2012-2025 Asynchronous B.V.
+ *  Copyright (c) 2012-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/README.md

@@ -109,7 +109,7 @@ For example, in Ruby applications a significant amount of memory is taken up by
 
 SpawningKit provides facilities to use this preforking technique. Obviously, this technique can only be used if the target programming language actually supports forking. This is the case with e.g. C, Ruby (using MRI) and Python (using CPython), but not with e.g. Node.js, Ruby (using JRuby), Go and anything running on the JVM.
 
-Using the preforking technique through SpawningKit requires either application code modifications, or the existance of a wrapper that supports this technique.
+Using the preforking technique through SpawningKit requires either application code modifications, or the existence of a wrapper that supports this technique.
 
 ### The start command
 
@@ -528,9 +528,9 @@ The error report is presented in two ways:
  1. In the terminal or in log files.
  2. In an HTML page.
 
-The summary is only meant to be displayed in the terminal or in the log files as a one-liner. It can contain basic details (such as the OS error code) but is not meant to contain finer details such as the subprocess stdout/stderr output, the environment variable dump, etc.
+The summary is a one-line field used by the HTML error page and other structured consumers. It can contain basic details (such as the OS error code) but is not meant to contain finer details such as the subprocess stdout/stderr output or the environment variable dump. `SpawnException::what()` provides the plain-text representation for terminals, logs, and exception consumers. It starts with the summary and, when subprocess stdout or stderr is available, adds up to 8 KB of that output in an indented block. For larger output it includes the first and last 4 KB and marks how many bytes were omitted. The complete output remains available in the detailed HTML error page.
 
-Everything else is meant to be displayed in an HTML page. The HTML page explicitly does not include the summary, so the summary must not contain any information that isn't available in all the other fields.
+The remaining report details are meant to be displayed in an HTML page. The HTML page explicitly does not include the summary, so the summary must not contain any information that isn't available in all the other fields.
 
 The advanced problem details are only displayed in the HTML page if one does not explicitly supply a problem description. See "Generating an error report" for more information.
 

data/src/agent/Core/SpawningKit/Result/AutoGeneratedCode.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2017-2025 Asynchronous B.V.
+ *  Copyright (c) 2017-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Result/AutoGeneratedCode.h.cxxcodebuilder

@@ -1,5 +1,5 @@
 #  Phusion Passenger - https://www.phusionpassenger.com/
-#  Copyright (c) 2017-2025 Asynchronous B.V.
+#  Copyright (c) 2017-2026 Asynchronous B.V.
 #
 #  "Passenger", "Phusion Passenger" and "Union Station" are registered
 #  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/Result.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2014-2025 Asynchronous B.V.
+ *  Copyright (c) 2014-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/SmartSpawner.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.
@@ -34,6 +34,7 @@
 #include <vector>
 #include <map>
 #include <exception>
+#include <functional>
 #include <dirent.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -221,11 +222,14 @@ private:
 	{
 		StdChannelsAsyncOpenStatePtr state = boost::make_shared<StdChannelsAsyncOpenState>(
 			session.workDirFd);
-		state->stdinOpenThread = new oxt::thread(boost::bind(
-			openStdinChannel, state, session.workDir->getPath()),
+		// The threads borrow state. The caller keeps it alive, and its destructor
+		// interrupts and joins both threads before freeing it. Giving the callbacks
+		// shared ownership would create a cycle through the thread objects.
+		state->stdinOpenThread = new oxt::thread(std::bind(
+			openStdinChannel, std::ref(*state), session.workDir->getPath()),
 			"FIFO opener: " + session.workDir->getPath() + "/stdin", 1024 * 128);
-		state->stdoutAndErrOpenThread = new oxt::thread(boost::bind(
-			openStdoutAndErrChannel, state, session.workDir->getPath()),
+		state->stdoutAndErrOpenThread = new oxt::thread(std::bind(
+			openStdoutAndErrChannel, std::ref(*state), session.workDir->getPath()),
 			"FIFO opener: " + session.workDir->getPath() + "/stdout_and_err", 1024 * 128);
 		return state;
 	}
@@ -288,22 +292,18 @@ private:
 		}
 	}
 
-	static void openStdinChannel(StdChannelsAsyncOpenStatePtr state,
-		const string &workDir)
-	{
-		int fd = syscalls::openat(state->workDirFd, "stdin", O_WRONLY | O_APPEND | O_NOFOLLOW);
+	static void openStdinChannel(StdChannelsAsyncOpenState &state, const string &workDir) {
+		int fd = syscalls::openat(state.workDirFd, "stdin", O_WRONLY | O_APPEND | O_NOFOLLOW);
 		int e = errno;
-		state->stdinFd.assign(fd, __FILE__, __LINE__);
-		state->stdinOpenErrno = e;
+		state.stdinFd.assign(fd, __FILE__, __LINE__);
+		state.stdinOpenErrno = e;
 	}
 
-	static void openStdoutAndErrChannel(StdChannelsAsyncOpenStatePtr state,
-		const string &workDir)
-	{
-		int fd = syscalls::openat(state->workDirFd, "stdout_and_err", O_RDONLY | O_NOFOLLOW);
+	static void openStdoutAndErrChannel(StdChannelsAsyncOpenState &state, const string &workDir) {
+		int fd = syscalls::openat(state.workDirFd, "stdout_and_err", O_RDONLY | O_NOFOLLOW);
 		int e = errno;
-		state->stdoutAndErrFd.assign(fd, __FILE__, __LINE__);
-		state->stdoutAndErrOpenErrno = e;
+		state.stdoutAndErrFd.assign(fd, __FILE__, __LINE__);
+		state.stdoutAndErrOpenErrno = e;
 	}
 
 	bool preloaderStarted() const {

data/src/agent/Core/SpawningKit/Spawner.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/SpawningKit/UserSwitchingRules.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2025 Asynchronous B.V.
+ *  Copyright (c) 2011-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Core/TelemetryCollector.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2018-2025 Asynchronous B.V.
+ *  Copyright (c) 2018-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/ExecHelper/ExecHelperMain.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2018-2025 Asynchronous B.V.
+ *  Copyright (c) 2018-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/FileReadHelper/FileReadHelperMain.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2018-2025 Asynchronous B.V.
+ *  Copyright (c) 2018-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/MainFunctions.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2024-2025 Asynchronous B.V.
+ *  Copyright (c) 2024-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/ApiAccountUtils.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2015-2025 Asynchronous B.V.
+ *  Copyright (c) 2015-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.
@@ -36,6 +36,7 @@
 #include <ConfigKit/ConfigKit.h>
 #include <Exceptions.h>
 #include <StaticString.h>
+#include <FileTools/FileManip.h>
 #include <FileTools/PathManip.h>
 #include <Utils.h>
 #include <StrIntTools/StrIntUtils.h>
@@ -70,7 +71,7 @@ using namespace std;
  *           "password": "bar",
  *           "password_file": "/filename"
  *
- *           "level": "readonly" | "full"   // Optional; "full" is defeault
+ *           "level": "readonly" | "full"   // Optional; "full" is default
  *         },
  *         ...
  *       ]
@@ -108,7 +109,7 @@ inline Json::Value parseApiAccountDescription(const StaticString &description);
  *
  * A JSON array that passes this function is *valid*, although not necessarily *normalized*.
  */
-static void
+inline void
 validateAuthorizationsField(const string &key, const ConfigKit::Store &config,
 	vector<ConfigKit::Error> &outputErrors)
 {

data/src/agent/Shared/ApiServerUtils.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2015-2025 Asynchronous B.V.
+ *  Copyright (c) 2015-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.
@@ -58,7 +58,6 @@
 #include <sys/types.h>
 #include <string>
 #include <vector>
-#include <stdexcept>
 #include <cstddef>
 #include <cstring>
 #include <jsoncpp/json.h>
@@ -167,14 +166,17 @@ authorize(ApiServer *server, Client *client, Request *req) {
 	}
 
 	if (server->getApiAccountDatabase().empty()) {
-		SKC_INFO_FROM_STATIC(server, client,
-			"Authenticated as administrator because API account database is empty");
-		auth.apiKey = ApplicationPool2::ApiKey::makeSuper();
-		auth.canReadPool = true;
-		auth.canModifyPool = true;
-		auth.canInspectState = true;
-		auth.canAdminister = true;
-	} else if (parseBasicAuthHeader(req, username, password)) {
+		/*
+		 * Deliberately DEBUG, not WARN or INFO. This branch is evaluated on every
+		 * request before authentication, and the API socket is world-writable, so
+		 * anything emitted at the default log level lets any local client flood a
+		 * root-owned log file. The condition is a persistent configuration state
+		 * rather than a per-request event, so it belongs in a one-time startup
+		 * diagnostic, not here.
+		 */
+		SKC_DEBUG_FROM_STATIC(server, client,
+			"API account database is empty; refusing unauthenticated access");
+	} else 	if (parseBasicAuthHeader(req, username, password)) {
 		SKC_DEBUG_FROM_STATIC(server, client,
 			"HTTP basic authentication supplied: " << username);
 		if (username == "api") {
@@ -189,7 +191,9 @@ authorize(ApiServer *server, Client *client, Request *req) {
 		} else {
 			const typename ApiServer::ApiAccount *account =
 				server->getApiAccountDatabase().lookup(username);
-			if (account != NULL && constantTimeCompare(password, account->password)) {
+			if (account != NULL && !account->password.empty()
+			 && constantTimeCompare(password, account->password))
+			{
 				SKC_INFO_FROM_STATIC(server, client,
 					"Authenticated with administrator account: " << username);
 				auth.apiKey = ApplicationPool2::ApiKey::makeSuper();

data/src/agent/Shared/ApplicationPoolApiKey.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2015-2025 Asynchronous B.V.
+ *  Copyright (c) 2015-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/Fundamentals/AbortHandler.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2025 Asynchronous B.V.
+ *  Copyright (c) 2010-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/Fundamentals/AbortHandler.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2025 Asynchronous B.V.
+ *  Copyright (c) 2010-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/Fundamentals/Initialization.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2025 Asynchronous B.V.
+ *  Copyright (c) 2010-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/Fundamentals/Initialization.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2025 Asynchronous B.V.
+ *  Copyright (c) 2010-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/Fundamentals/Utils.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2025 Asynchronous B.V.
+ *  Copyright (c) 2010-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/Shared/Fundamentals/Utils.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2025 Asynchronous B.V.
+ *  Copyright (c) 2010-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/SpawnEnvSetupper/SpawnEnvSetupperMain.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2012-2025 Asynchronous B.V.
+ *  Copyright (c) 2012-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/SystemMetrics/SystemMetricsMain.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2014-2025 Asynchronous B.V.
+ *  Copyright (c) 2014-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.

data/src/agent/TempDirToucher/TempDirToucherMain.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2013-2025 Asynchronous B.V.
+ *  Copyright (c) 2013-2026 Asynchronous B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Asynchronous B.V.