Skip to content

Commit 2ba17d8

Browse files
zhengkunwang223zhengkunwang223
authored
feat(system-security): Optimized unauthenticated settings to enhance system security (#7142)
1 parent aaae8a5 commit 2ba17d8

File tree

19 files changed

+426
-93
lines changed

19 files changed

+426
-93
lines changed

‎backend/app/api/v1/auth.go‎

Lines changed: 7 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,11 @@ package v1
22

33
import (
44
"encoding/base64"
5-
"net/http"
6-
75
"github.com/1Panel-dev/1Panel/backend/app/api/v1/helper"
86
"github.com/1Panel-dev/1Panel/backend/app/dto"
97
"github.com/1Panel-dev/1Panel/backend/app/model"
108
"github.com/1Panel-dev/1Panel/backend/constant"
119
"github.com/1Panel-dev/1Panel/backend/global"
12-
"github.com/1Panel-dev/1Panel/backend/middleware"
1310
"github.com/1Panel-dev/1Panel/backend/utils/captcha"
1411
"github.com/1Panel-dev/1Panel/backend/utils/qqwry"
1512
"github.com/gin-gonic/gin"
@@ -37,11 +34,18 @@ func (b *BaseApi) Login(c *gin.Context) {
3734
return
3835
}
3936
}
37+
4038
entranceItem := c.Request.Header.Get("EntranceCode")
4139
var entrance []byte
4240
if len(entranceItem) != 0 {
4341
entrance, _ = base64.StdEncoding.DecodeString(entranceItem)
4442
}
43+
if len(entrance) == 0 {
44+
cookieValue, err := c.Cookie("SecurityEntrance")
45+
if err == nil {
46+
entrance, _ = base64.StdEncoding.DecodeString(cookieValue)
47+
}
48+
}
4549

4650
user, err := authService.Login(c, req, string(entrance))
4751
go saveLoginLogs(c, err)
@@ -108,34 +112,6 @@ func (b *BaseApi) Captcha(c *gin.Context) {
108112
helper.SuccessWithData(c, captcha)
109113
}
110114

111-
// @Tags Auth
112-
// @Summary Load safety status
113-
// @Description 获取系统安全登录状态
114-
// @Success 200
115-
// @Router /auth/issafety [get]
116-
func (b *BaseApi) CheckIsSafety(c *gin.Context) {
117-
code := c.DefaultQuery("code", "")
118-
status, err := authService.CheckIsSafety(code)
119-
if err != nil {
120-
helper.ErrorWithDetail(c, constant.CodeErrInternalServer, constant.ErrTypeInternalServer, err)
121-
return
122-
}
123-
if status == "disable" && len(code) != 0 {
124-
helper.ErrResponse(c, http.StatusNotFound)
125-
return
126-
}
127-
if status == "unpass" {
128-
code := middleware.LoadErrCode()
129-
if code != 200 {
130-
helper.ErrResponse(c, code)
131-
return
132-
}
133-
helper.ErrorWithDetail(c, constant.CodeErrEntrance, constant.ErrTypeInternalServer, nil)
134-
return
135-
}
136-
helper.SuccessWithOutData(c)
137-
}
138-
139115
func (b *BaseApi) GetResponsePage(c *gin.Context) {
140116
pageCode, err := authService.GetResponsePage()
141117
if err != nil {

‎backend/app/service/auth.go‎

Lines changed: 39 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package service
22

33
import (
44
"crypto/hmac"
5+
"encoding/base64"
56
"strconv"
67

78
"github.com/1Panel-dev/1Panel/backend/app/dto"
@@ -19,12 +20,13 @@ import (
1920
type AuthService struct{}
2021

2122
type IAuthService interface {
22-
CheckIsSafety(code string) (string, error)
2323
GetResponsePage() (string, error)
2424
VerifyCode(code string) (bool, error)
2525
Login(c *gin.Context, info dto.Login, entrance string) (*dto.UserLoginInfo, error)
2626
LogOut(c *gin.Context) error
2727
MFALogin(c *gin.Context, info dto.MFALogin, entrance string) (*dto.UserLoginInfo, error)
28+
GetSecurityEntrance() string
29+
IsLogin(c *gin.Context) bool
2830
}
2931

3032
func NewIAuthService() IAuthService {
@@ -64,7 +66,16 @@ func (u *AuthService) Login(c *gin.Context, info dto.Login, entrance string) (*d
6466
if mfa.Value == "enable" {
6567
return &dto.UserLoginInfo{Name: nameSetting.Value, MfaStatus: mfa.Value}, nil
6668
}
67-
return u.generateSession(c, info.Name, info.AuthMethod)
69+
70+
loginUser, err := u.generateSession(c, info.Name, info.AuthMethod)
71+
if err != nil {
72+
return nil, err
73+
}
74+
if entrance != "" {
75+
entranceValue := base64.StdEncoding.EncodeToString([]byte(entrance))
76+
c.SetCookie("SecurityEntrance", entranceValue, 0, "", "", false, true)
77+
}
78+
return loginUser, nil
6879
}
6980

7081
func (u *AuthService) MFALogin(c *gin.Context, info dto.MFALogin, entrance string) (*dto.UserLoginInfo, error) {
@@ -103,7 +114,15 @@ func (u *AuthService) MFALogin(c *gin.Context, info dto.MFALogin, entrance strin
103114
return nil, constant.ErrAuth
104115
}
105116

106-
return u.generateSession(c, info.Name, info.AuthMethod)
117+
loginUser, err := u.generateSession(c, info.Name, info.AuthMethod)
118+
if err != nil {
119+
return nil, err
120+
}
121+
if entrance != "" {
122+
entranceValue := base64.StdEncoding.EncodeToString([]byte(entrance))
123+
c.SetCookie("SecurityEntrance", entranceValue, 0, "", "", false, true)
124+
}
125+
return loginUser, nil
107126
}
108127

109128
func (u *AuthService) generateSession(c *gin.Context, name, authMethod string) (*dto.UserLoginInfo, error) {
@@ -173,24 +192,30 @@ func (u *AuthService) VerifyCode(code string) (bool, error) {
173192
return hmac.Equal([]byte(setting.Value), []byte(code)), nil
174193
}
175194

176-
func (u *AuthService) CheckIsSafety(code string) (string, error) {
177-
status, err := settingRepo.Get(settingRepo.WithByKey("SecurityEntrance"))
195+
func (u *AuthService) GetResponsePage() (string, error) {
196+
pageCode, err := settingRepo.Get(settingRepo.WithByKey("NoAuthSetting"))
178197
if err != nil {
179198
return "", err
180199
}
181-
if len(status.Value) == 0 {
182-
return "disable", nil
200+
return pageCode.Value, nil
201+
}
202+
203+
func (u *AuthService) GetSecurityEntrance() string {
204+
status, err := settingRepo.Get(settingRepo.WithByKey("SecurityEntrance"))
205+
if err != nil {
206+
return ""
183207
}
184-
if status.Value == code {
185-
return "pass", nil
208+
if len(status.Value) == 0 {
209+
return ""
186210
}
187-
return "unpass", nil
211+
return status.Value
188212
}
189213

190-
func (u *AuthService) GetResponsePage() (string, error) {
191-
pageCode, err := settingRepo.Get(settingRepo.WithByKey("NoAuthSetting"))
214+
func (u *AuthService) IsLogin(c *gin.Context) bool {
215+
sID, _ := c.Cookie(constant.SessionName)
216+
_, err := global.SESSION.Get(sID)
192217
if err != nil {
193-
return "", err
218+
return false
194219
}
195-
return pageCode.Value, nil
220+
return true
196221
}

‎backend/constant/common.go‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,87 @@ const (
2323
DateTimeLayout = "2006-01-02 15:04:05" // or use time.DateTime while go version >= 1.20
2424
DateTimeSlimLayout = "20060102150405"
2525
)
26+
27+
var WebUrlMap = map[string]struct{}{
28+
"/apps": {},
29+
"/apps/all": {},
30+
"/apps/installed": {},
31+
"/apps/upgrade": {},
32+
33+
"/containers": {},
34+
"/containers/container": {},
35+
"/containers/image": {},
36+
"/containers/network": {},
37+
"/containers/volume": {},
38+
"/containers/repo": {},
39+
"/containers/compose": {},
40+
"/containers/template": {},
41+
"/containers/setting": {},
42+
43+
"/cronjobs": {},
44+
45+
"/databases": {},
46+
"/databases/mysql": {},
47+
"/databases/mysql/remote": {},
48+
"/databases/postgresql": {},
49+
"/databases/postgresql/remote": {},
50+
"/databases/redis": {},
51+
"/databases/redis/remote": {},
52+
53+
"/hosts": {},
54+
"/hosts/files": {},
55+
"/hosts/monitor/monitor": {},
56+
"/hosts/monitor/setting": {},
57+
"/hosts/terminal": {},
58+
"/hosts/firewall/port": {},
59+
"/hosts/firewall/forward": {},
60+
"/hosts/firewall/ip": {},
61+
"/hosts/process/process": {},
62+
"/hosts/process/network": {},
63+
"/hosts/ssh/ssh": {},
64+
"/hosts/ssh/log": {},
65+
"/hosts/ssh/session": {},
66+
67+
"/logs": {},
68+
"/logs/operation": {},
69+
"/logs/login": {},
70+
"/logs/website": {},
71+
"/logs/system": {},
72+
"/logs/ssh": {},
73+
74+
"/settings": {},
75+
"/settings/panel": {},
76+
"/settings/backupaccount": {},
77+
"/settings/license": {},
78+
"/settings/about": {},
79+
"/settings/safe": {},
80+
"/settings/snapshot": {},
81+
"/settings/expired": {},
82+
83+
"/toolbox": {},
84+
"/toolbox/device": {},
85+
"/toolbox/supervisor": {},
86+
"/toolbox/clam": {},
87+
"/toolbox/clam/setting": {},
88+
"/toolbox/ftp": {},
89+
"/toolbox/fail2ban": {},
90+
"/toolbox/clean": {},
91+
92+
"/websites": {},
93+
"/websites/ssl": {},
94+
"/websites/runtimes/php": {},
95+
"/websites/runtimes/node": {},
96+
"/websites/runtimes/java": {},
97+
"/websites/runtimes/net": {},
98+
"/websites/runtimes/go": {},
99+
"/websites/runtimes/python": {},
100+
101+
"/login": {},
102+
}
103+
104+
var DynamicRoutes = []string{
105+
`^/containers/composeDetail/[^/]+$`,
106+
`^/databases/mysql/setting/[^/]+/[^/]+$`,
107+
`^/databases/postgresql/setting/[^/]+/[^/]+$`,
108+
`^/websites/[^/]+/config/[^/]+$`,
109+
}

0 commit comments

Comments
 (0)