Skip to content

feat: 面板目录禁止删除 #7029

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
f2c-ci-robot merged 1 commit into from
Nov 13, 2024
Merged

feat: 面板目录禁止删除 #7029

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions backend/app/service/file.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,10 @@ func (f *FileService) Create(op request.FileCreate) error {
}

func (f *FileService) Delete(op request.FileDelete) error {
excludeDir := global.CONF.System.DataDir
if strings.Contains(op.Path, ".1panel_clash") || op.Path == excludeDir {
return buserr.New(constant.ErrPathNotDelete)
}
fo := files.NewFileOp()
recycleBinStatus, _ := settingRepo.Get(settingRepo.WithByKey("FileRecycleBin"))
if recycleBinStatus.Value == "disable" {
Copy link

@fit2cloudrd fit2cloudrd Nov 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这个代码在当前时间（2024年11月13日）上是合规且没有明显问题的。
不过，从最近一次更新来看，它可能不再被推荐使用。

  • 文件创建功能需要更精细地控制文件路径和删除操作来预防垃圾导入到磁盘错误

我将对这些方面提供一些改进建议：

优化文件逻辑：

确保只允许非目录结构的完整文件名来防止意外的乱码或错误行为。这通常有助于提高文件安全性并避免将来引入麻烦。

建议添加验证条件以排除特定的路径如系统数据目录。这样可以保证文件安全。

总结起来就是，根据最新的编程实践和设计规范，改进代码中存在的一些不足之处。

维护最新技术和最佳实践：

由于你提到的代码已经过时了，并且不符合现在的标准，请参考以下示例：

// 假设这里有一个名为FileService的方法：
func (service *FileService) Upload(filePath string, file *multipart.FileHeader){
    // 程序可能会在这里处理上传文件的过程...

    if os.IsNotExist(err){   // 检查是否存在该文件... 可以为file.Name()返回值...
        return http.StatusInternalServerError, errors.New(filepath.WouldBlockError{})     // 在必要时处理此情况....
    }

    // 此处应进一步进行验证和限制
}

在这个替代方案下，os.IsExist()函数会被一个适当的检查替换，而不是简单的filepath.WouldBlock()。同时，在filePath != "" && filePath ==".1panel_clash"之后执行额外的操作变得显而易见，例如删除任何与用户不想共享内容相关联的内容。

以上是我提供的改进建议及解决方案的解释，希望能帮助您解决您的具体问题！

Expand Down
1 change: 1 addition & 0 deletions backend/constant/errs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ var (
ErrFileDownloadDir = "ErrFileDownloadDir"
ErrCmdNotFound = "ErrCmdNotFound"
ErrFavoriteExist = "ErrFavoriteExist"
ErrPathNotDelete = "ErrPathNotDelete"
)

// mysql
Copy link

@fit2cloudrd fit2cloudrd Nov 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这段代码中存在一个逻辑错误，它试图引入两个具有相同名称的方法（ErrPathNotDelete）和字段 err_path_not_delete。我建议将第二个方法和字段更改为一致。

这是一个优化的例子：

var (
   ErrFileDownloadDir = ""
   ErrCmdNotFound    = ""
   ErrFavoriteExist  = ""

这样可以避免重复定义，并且在其他地方不需要额外地指明哪个是优先使用的版本。

// mysql
var(
.err_path_not_deleted = ""
)

Expand Down
2 changes: 2 additions & 0 deletions backend/i18n/lang/en.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ ErrCmdNotFound: "{{ .name}} command does not exist, please install this command
ErrSourcePathNotFound: "Source directory does not exist"
ErrFavoriteExist: "This path has been collected"
ErrInvalidChar: "Illegal characters are prohibited"
ErrPathNotDelete: "The selected directory cannot be deleted"


#website
ErrDomainIsExist: "Domain is already exist"
Expand Down
1 change: 1 addition & 0 deletions backend/i18n/lang/zh-Hant.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ ErrFileDownloadDir: "不支持下載文件夾"
ErrCmdNotFound: "{{ .name}} 命令不存在，請先在宿主機安裝此命令"
ErrSourcePathNotFound: "源目錄不存在"
ErrFavoriteExist: "已收藏此路徑"
ErrPathNotDelete: "所選目錄不可删除"

#website
ErrDomainIsExist: "域名已存在"
Expand Down
2 changes: 2 additions & 0 deletions backend/i18n/lang/zh.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ ErrCmdNotFound: "{{ .name}} 命令不存在，请先在宿主机安装此命令"
ErrSourcePathNotFound: "源目录不存在"
ErrFavoriteExist: "已收藏此路径"
ErrInvalidChar: "禁止使用非法字符"
ErrPathNotDelete: "所选目录不可删除"


#website
ErrDomainIsExist: "域名已存在"
Expand Down
1 change: 1 addition & 0 deletions frontend/src/lang/modules/en.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1297,6 +1297,7 @@ const message = {
noNameFile: 'Untitled File',
minimap: 'Code Mini Map',
fileCanNotRead: 'File can not read',
panelInstallDir: '1Panel installation directory cannot be deleted',
},
ssh: {
autoStart: 'Auto Start',
Expand Down
1 change: 1 addition & 0 deletions frontend/src/lang/modules/tw.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1227,6 +1227,7 @@ const message = {
noNameFile: '未命名檔案',
minimap: '縮略圖',
fileCanNotRead: '此文件不支持預覽',
panelInstallDir: '1Panel 安裝目錄不能删除',
},
ssh: {
autoStart: '開機自啟',
Expand Down
1 change: 1 addition & 0 deletions frontend/src/lang/modules/zh.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1229,6 +1229,7 @@ const message = {
noNameFile: '未命名文件',
minimap: '缩略图',
fileCanNotRead: '此文件不支持预览',
panelInstallDir: '1Panel 安装目录不能删除',
},
ssh: {
autoStart: '开机自启',
Expand Down
11 changes: 10 additions & 1 deletion frontend/src/views/host/file-management/delete/index.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ import { File } from '@/api/interface/file';
import { getIcon } from '@/utils/util';
import { DeleteFile, GetRecycleStatus } from '@/api/modules/files';
import { MsgSuccess, MsgWarning } from '@/utils/message';
import { loadBaseDir } from '@/api/modules/setting';

const open = ref(false);
const files = ref();
Expand All @@ -85,13 +86,21 @@ const getStatus = async () => {
} catch (error) {}
};

const onConfirm = () => {
const onConfirm = async () => {
const pros = [];
for (const s of files.value) {
if (s['path'].indexOf('.1panel_clash') > -1) {
MsgWarning(i18n.global.t('file.clashDeleteAlert'));
return;
}
if (s['isDir']) {
const pathRes = await loadBaseDir();
if (s['path'] === pathRes.data) {
MsgWarning(i18n.global.t('file.panelInstallDir'));
return;
}
}

pros.push(DeleteFile({ path: s['path'], isDir: s['isDir'], forceDelete: forceDelete.value }));
}
loading.value = true;
Copy link

@fit2cloudrd fit2cloudrd Nov 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

此段代码在一些地方存在问题。

import { DeleteFile, GetRecycleStatus } from '@/api/modules/files';

需要使用的是@/api/models/download/接口，即：

await deleteFn(params)
export default {
   namespace: 'download',
   state: {
      ...,
      dataList: [],
      total: 0
   },
    actions: {
       async doAction({ commit }, options) {}

...
// @ts-ignore
import { LoadConfig } from "@/modules/config"
await exportFn(config)

建议先进行相关接口和文件路径的修改。

Expand Down