qinglong 2da52e80d0 security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token ...

面板密码安全:
- 支持哈希存储 (password_hash/password_salt)
- 登录使用 secrets.compare_digest 时序安全比较
- 回退明文兼容旧配置
- 默认密码 admin 时打印 CRITICAL 警告

文件上传安全:
- 拒绝危险扩展名: .exe/.dll/.so/.sh/.bat/.ps1 等
- 拒绝敏感文件名: .htaccess/Makefile/Dockerfile 等
- 上传时检查并返回 403

CSRF 防护:
- panel_auth(csrf_protect=True) 参数
- 写操作需 X-CSRF-Token header 匹配 session token
- 保护范围: 文件删除/写入/创建/上传/重命名 + 项目启停 + 代理管理

Co-Authored-By: Claude <noreply@anthropic.com>

2026-06-13 14:07:38 +08:00

..

web_panel

security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token

2026-06-13 14:07:38 +08:00

__init__.py

Initial commit: SenSu Alpha 0.2.0

2026-06-10 12:28:05 +08:00

api_service.py

Initial commit: SenSu Alpha 0.2.0

2026-06-10 12:28:05 +08:00

auth_service.py

security: P2 生产深度加固 — 路径/鉴权/脱敏/校验/持久化/过期

2026-06-13 13:50:51 +08:00

command_service.py

feat(v0.5.2): 插件索引仓库 + install 命令

2026-06-13 11:08:47 +08:00

init_service.py

security: P3 — 插件隔离默认开启 + SenSuDB 注册 + 审计日志

2026-06-13 13:56:58 +08:00

internet_service.py

security: P2 生产深度加固 — 路径/鉴权/脱敏/校验/持久化/过期

2026-06-13 13:50:51 +08:00

log_service.py

feat: WS实时推送、网速双线图、按钮MD3修复、页面加载器修复 (v0.6.0)

2026-06-11 16:23:31 +08:00

permission_service.py

Initial commit: SenSu Alpha 0.2.0

2026-06-10 12:28:05 +08:00

plugin_index.py

feat(v0.5.2): 插件索引仓库 + install 命令

2026-06-13 11:08:47 +08:00

plugin_service.py

feat(v0.5.1): 插件进程隔离 — 集成到 PluginService

2026-06-13 11:07:30 +08:00

process_isolated.py

v0.4+v0.5: TUI dashboard, tab completion, systemd, Docker, process isolation

2026-06-10 19:08:16 +08:00

project_engine.py

Phase 1: ProjectEngine + PyEnvManager + project management WebUI

2026-06-10 20:41:24 +08:00

project_service.py

v0.3: SQLite persistence + ProjectService + dependency resolution

2026-06-10 18:59:25 +08:00

proxy_service.py

Phase 2: ProxyService reverse proxy (HTTP+WebSocket forwarding)

2026-06-10 20:47:17 +08:00

pyenv_manager.py

Phase 1: ProjectEngine + PyEnvManager + project management WebUI

2026-06-10 20:41:24 +08:00

sensu_db.py

v0.3: SQLite persistence + ProjectService + dependency resolution

2026-06-10 18:59:25 +08:00

shutdown_service.py

Initial commit: SenSu Alpha 0.2.0

2026-06-10 12:28:05 +08:00

sysmon_widget.py

Debug: fix headless mode, plugin compat, psutil optional, module imports

2026-06-10 19:26:41 +08:00

tui_service.py

fix: 系统监控改用 asyncio task 驱动，抗 Android 后台挂起

2026-06-13 12:50:06 +08:00