From a75b9d09751e913e82d0ede87491531879a12dcb Mon Sep 17 00:00:00 2001
From: qinglong <qinglong@@users.noreply.github.com>
Date: Sat, 13 Jun 2026 13:38:38 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E5=89=8D=E7=AB=AF=20WebSocket=20?=
 =?UTF-8?q?=E8=BF=9E=E6=8E=A5=E4=BC=A0=E9=80=92=20panel=5Ftoken=20?=
 =?UTF-8?q?=E8=AE=A4=E8=AF=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- dashboard.js / logs.js: WS URL 追加 ?token= 查询参数
- app.js: 添加 getCookie() 工具函数

Co-Authored-By: Claude <noreply@anthropic.com>
---
 static/web_panel/js/app.js          | 6 ++++++
 static/web_panel/pages/dashboard.js | 3 ++-
 static/web_panel/pages/logs.js      | 3 ++-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/static/web_panel/js/app.js b/static/web_panel/js/app.js
index 7dac60a..113da1e 100644
--- a/static/web_panel/js/app.js
+++ b/static/web_panel/js/app.js
@@ -6,6 +6,12 @@
   document.documentElement.setAttribute("data-theme", s);
 })();
 
+// ═══ 工具函数 ═══
+function getCookie(name) {
+  var match = document.cookie.match(new RegExp('(^| )' + name + '=([^;]+)'));
+  return match ? match[2] : '';
+}
+
 window.toggleTheme = function(){
   var t = document.documentElement.getAttribute("data-theme") === "light" ? "dark" : "light";
   document.documentElement.setAttribute("data-theme", t);
diff --git a/static/web_panel/pages/dashboard.js b/static/web_panel/pages/dashboard.js
index 27bcfb7..980c521 100644
--- a/static/web_panel/pages/dashboard.js
+++ b/static/web_panel/pages/dashboard.js
@@ -32,7 +32,8 @@ window.DashboardModule = {
         }
 
         var base = window.location.pathname.split("/").slice(0, 2).join("/");
-        var ws = new WebSocket("ws://" + location.host + base + "/api/system/ws");
+        var tok = getCookie("panel_token");
+        var ws = new WebSocket("ws://" + location.host + base + "/api/system/ws?token=" + (tok || ""));
         self.ws = ws;
 
         ws.onopen = function() {
diff --git a/static/web_panel/pages/logs.js b/static/web_panel/pages/logs.js
index 1ac02bd..83c3a8e 100644
--- a/static/web_panel/pages/logs.js
+++ b/static/web_panel/pages/logs.js
@@ -25,7 +25,8 @@ window.LogsModule = {
         }
 
         var base = window.location.pathname.split("/").slice(0, 2).join("/");
-        var ws = new WebSocket("ws://" + location.host + base + "/api/logs/ws");
+        var tok = getCookie("panel_token");
+        var ws = new WebSocket("ws://" + location.host + base + "/api/logs/ws?token=" + (tok || ""));
         self.ws = ws;
 
         ws.onopen = function() {