Update app.py

app.py

@@ -17,6 +17,7 @@ from openpyxl import Workbook
 from openpyxl.utils import get_column_letter
 from io import BytesIO
 import base64
+import hashlib
 
 # Configure logging
 logging.basicConfig(level=logging.INFO)
@@ -31,12 +32,28 @@ CONFIDENCE_THRESHOLD = 0.65
 BATCH_SIZE = 8  # Reduced batch size for CPU
 MAX_WORKERS = 4  # Number of worker threads for processing
 
-# Secret password for logs access - CHANGE THIS! Make it complex and memorable only to you
-SECRET_PASSWORD = "6GBPR9KmnQwkD1REesysRvWX1ZpEbqmEs3hli8YKvXfcqRX8eB9BsEkS6L8Hvp0"
+# Get password hash from environment variable (more secure)
+ADMIN_PASSWORD_HASH = os.environ.get('ADMIN_PASSWORD_HASH')
+
+# If the environment variable isn't set, use a default hash (for development only)
+# This is the hash of "default_password_for_development_only" - change this in production!
+if not ADMIN_PASSWORD_HASH:
+    ADMIN_PASSWORD_HASH = "5e22d1ed71b273b1b2b5331f2d3e0f6cf34595236f201c6924d6bc81de27cdcb"
 
 # Excel file path for logs
 EXCEL_LOG_PATH = "/tmp/prediction_logs.xlsx"
 
+def is_admin_password(input_text: str) -> bool:
+    """
+    Check if the input text matches the admin password using secure hash comparison.
+    This prevents the password from being visible in the source code.
+    """
+    # Hash the input text
+    input_hash = hashlib.sha256(input_text.strip().encode()).hexdigest()
+    
+    # Compare hashes (constant-time comparison to prevent timing attacks)
+    return input_hash == ADMIN_PASSWORD_HASH
+
 class TextWindowProcessor:
     def __init__(self):
         try:
@@ -428,8 +445,8 @@ def get_logs_as_base64():
 
 def analyze_text(text: str, mode: str, classifier: TextClassifier) -> tuple:
     """Analyze text using specified mode and return formatted results."""
-    # Check if the input text matches the secret password for log access
-    if text.strip() == SECRET_PASSWORD:
+    # Check if the input text matches the admin password using secure comparison
+    if is_admin_password(text.strip()):
         # Return logs instead of analysis
         base64_data = get_logs_as_base64()
         logs_timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")