qinglong
fcac02d920
4.3 文件管理器路径收紧:
- 默认移除 Path('/') 全文件系统访问
- 仅允许项目目录 + data/ + 环境变量 SENSU_FILE_ROOTS 指定路径
3.4 插件路由鉴权修复:
- _check_plugin_auth 增加 panel_token 用户身份验证
- 先验证用户登录, 再检查插件权限
4.2 错误脱敏:
- security middleware 捕获异常 → 通用 'Internal server error'
- 堆栈详情仅写入日志, 不暴露给客户端
4.4 命令参数校验:
- POST /api/command 拒绝 shell 元字符 (;&|`$(){}!#~<>)
- 防止命令注入
4.5 Session 持久化:
- 登录/退出时保存到 SenSuDB.config_kv
- 框架重启后自动恢复已持久化会话
4.6 Token 过期: 24h → 2h
Co-Authored-By: Claude <noreply@anthropic.com>
106 lines
2.7 KiB
YAML
106 lines
2.7 KiB
YAML
commands:
|
|
autoscroll:
|
|
description: '滚动控制: 切换自动滚动'
|
|
permissions:
|
|
- framework.tui.control
|
|
source: internal
|
|
create-plugin:
|
|
description: 创建新插件脚手架
|
|
permissions:
|
|
- framework.scaffold.plugin
|
|
source: internal
|
|
echo: &id001
|
|
description: echo input
|
|
permissions: []
|
|
source: plugin.example_plugin
|
|
help:
|
|
description: 显示帮助信息
|
|
permissions:
|
|
- framework.command.help.read
|
|
source: internal
|
|
history:
|
|
description: 显示命令历史
|
|
permissions:
|
|
- framework.command.history.read
|
|
source: internal
|
|
install:
|
|
description: '从在线索引安装插件: install <name> 或 install --list'
|
|
permissions:
|
|
- framework.plugin.install
|
|
source: internal
|
|
netdiag:
|
|
description: 网络服务诊断
|
|
permissions:
|
|
- framework.network.diagnose
|
|
source: internal
|
|
permissions:
|
|
description: '权限管理: 显示权限状态'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
plugin_status: &id002
|
|
description: show status
|
|
permissions: []
|
|
source: plugin.example_plugin
|
|
pm_plugin_status:
|
|
description: '权限管理: 查看插件权限状态'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmallow:
|
|
description: '权限管理: 同意权限请求'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmdeny:
|
|
description: '权限管理: 拒绝权限请求'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmhelp:
|
|
description: '权限管理: 显示权限命令帮助'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmignore:
|
|
description: '权限管理: 暂时忽略权限请求'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmpending:
|
|
description: '权限管理: 查看待授权请求列表'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmrequests:
|
|
description: '权限管理: 查看待授权请求列表(别名)'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
pmtest:
|
|
description: '权限管理: 测试权限配置文件'
|
|
permissions:
|
|
- framework.permission.read
|
|
source: internal
|
|
scroll:
|
|
description: '滚动控制: 手动滚动到底部'
|
|
permissions:
|
|
- framework.tui.control
|
|
source: internal
|
|
status:
|
|
description: 显示框架状态
|
|
permissions:
|
|
- framework.status.read
|
|
source: internal
|
|
testlog:
|
|
description: 生成测试日志
|
|
permissions:
|
|
- framework.command.test
|
|
source: internal
|
|
last_updated: 11814.024966534
|
|
plugin_commands:
|
|
example_plugin:
|
|
echo: *id001
|
|
plugin_status: *id002
|
|
total_commands: 20
|