security fixes

- CSRF tokens implemented into api calls
- password change shell injection fixed

python/helpers/settings.py

@@ -1083,7 +1083,12 @@ def _dict_to_env(data_dict):
 def set_root_password(password: str):
     if not runtime.is_dockerized():
         raise Exception("root password can only be set in dockerized environments")
-    subprocess.run(f"echo 'root:{password}' | chpasswd", shell=True, check=True)
+    _result = subprocess.run(
+        ["chpasswd"],
+        input=f"root:{password}".encode(),
+        capture_output=True,
+        check=True,
+    )
     dotenv.save_dotenv_value(dotenv.KEY_ROOT_PASSWORD, password)