qinglong
2da52e80d0
面板密码安全: - 支持哈希存储 (password_hash/password_salt) - 登录使用 secrets.compare_digest 时序安全比较 - 回退明文兼容旧配置 - 默认密码 admin 时打印 CRITICAL 警告 文件上传安全: - 拒绝危险扩展名: .exe/.dll/.so/.sh/.bat/.ps1 等 - 拒绝敏感文件名: .htaccess/Makefile/Dockerfile 等 - 上传时检查并返回 403 CSRF 防护: - panel_auth(csrf_protect=True) 参数 - 写操作需 X-CSRF-Token header 匹配 session token - 保护范围: 文件删除/写入/创建/上传/重命名 + 项目启停 + 代理管理 Co-Authored-By: Claude <noreply@anthropic.com>
63 lines
2.7 KiB
Python
63 lines
2.7 KiB
Python
from aiohttp import web
|
|
import json, logging
|
|
from ..utils.auth import panel_auth
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
def _get_engine(request):
|
|
sm = request.app.get("service_manager")
|
|
if sm and sm.has_service("project_engine"):
|
|
return sm.get_service("project_engine")
|
|
return None
|
|
|
|
def setup_project_routes(app, service_manager, prefix=''):
|
|
app["service_manager"] = service_manager
|
|
|
|
async def list_projects(request):
|
|
eng = _get_engine(request)
|
|
return web.json_response({"projects": eng.list_projects() if eng else []})
|
|
|
|
async def run_project(request):
|
|
try:
|
|
data = await request.json()
|
|
eng = _get_engine(request)
|
|
if not eng:
|
|
return web.json_response({"ok": False, "error": "engine not ready"}, status=503)
|
|
ok = await eng.run_project(
|
|
name=data.get("name","unnamed"), cmd=data.get("cmd",[]),
|
|
cwd=data.get("cwd","."), env=data.get("env",{}),
|
|
port=data.get("port",0), proxy_path=data.get("proxy_path",""))
|
|
return web.json_response({"ok": ok})
|
|
except Exception as e:
|
|
return web.json_response({"ok": False, "error": str(e)}, status=400)
|
|
|
|
async def stop_project(request):
|
|
name = request.match_info.get("name","")
|
|
eng = _get_engine(request)
|
|
ok = await eng.stop_project(name) if eng else False
|
|
return web.json_response({"ok": ok})
|
|
|
|
async def get_logs(request):
|
|
name = request.match_info.get("name","")
|
|
tail = int(request.query.get("tail", 50))
|
|
eng = _get_engine(request)
|
|
return web.json_response({"logs": eng.get_logs(name, tail) if eng else []})
|
|
|
|
async def send_stdin(request):
|
|
name = request.match_info.get("name","")
|
|
data = await request.json()
|
|
eng = _get_engine(request)
|
|
ok = await eng.send_stdin(name, data.get("text","")) if eng else False
|
|
return web.json_response({"ok": ok})
|
|
|
|
async def project_page(request):
|
|
return web.FileResponse("static/web_panel/pages/projects.html")
|
|
|
|
app.router.add_get(f'{prefix}/api/projects', panel_auth(list_projects))
|
|
app.router.add_post(f'{prefix}/api/projects/run', panel_auth(run_project, csrf_protect=True))
|
|
app.router.add_get(f'{prefix}/api/projects/{{name}}/logs', panel_auth(get_logs))
|
|
app.router.add_post(f'{prefix}/api/projects/{{name}}/stop', panel_auth(stop_project, csrf_protect=True))
|
|
app.router.add_post(f'{prefix}/api/projects/{{name}}/stdin', panel_auth(send_stdin, csrf_protect=True))
|
|
app.router.add_get(f'{prefix}/pages/projects', panel_auth(project_page))
|
|
logger.info("📦 项目管理路由已注册 (已加认证)")
|