From c2fd9da8bc9c5ee6e33f49a9cd48cf3d676ce77e Mon Sep 17 00:00:00 2001 From: Pnkcaht Date: Sun, 4 Jan 2026 22:17:14 -0500 Subject: [PATCH] Fix race condition during initial admin account creation (#26036) * Update README.md * Update README.md * Update README.md * Remove link to non-existent newsletter Also format with `yarn lint:fix` as noted in the contributing guide. * Update README.md * Update good first issues query * Fix race condition during initial admin account creation * Update core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Use synchronized method for initial admin account creation --------- Co-authored-by: Mark Waite Co-authored-by: Kris Stern Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../java/hudson/security/HudsonPrivateSecurityRealm.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java index 2a6910ec12..3fd2dc2b08 100644 --- a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java +++ b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java @@ -363,11 +363,14 @@ public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRea * This can be run by anyone, but only to create the very first user account. */ @RequirePOST - public void doCreateFirstAccount(StaplerRequest2 req, StaplerResponse2 rsp) throws IOException, ServletException { + public synchronized void doCreateFirstAccount(StaplerRequest2 req, StaplerResponse2 rsp) + throws IOException, ServletException { + if (hasSomeUser()) { rsp.sendError(SC_UNAUTHORIZED, "First user was already created"); return; } + User u = createAccount(req, rsp, false, "firstUser.jelly"); if (u != null) { tryToMakeAdmin(u);