Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: unauthorized access due to 'web api' enabled by defalut #2

Merged
merged 1 commit into from
Oct 28, 2023
Merged

fix: unauthorized access due to 'web api' enabled by defalut #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 14 additions & 11 deletions web/controllers/base.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ type BaseController struct {
actionName string
}

//初始化参数
// 初始化参数
func (s *BaseController) Prepare() {
s.Data["web_base_url"] = beego.AppConfig.String("web_base_url")
controllerName, actionName := s.GetControllerAndAction()
Expand All @@ -33,6 +33,9 @@ func (s *BaseController) Prepare() {
timestamp := s.GetIntNoErr("timestamp")
configKey := beego.AppConfig.String("auth_key")
timeNowUnix := time.Now().Unix()
if configKey == "" {
configKey = crypt.GetRandomString(128)
}
if !(md5Key != "" && (math.Abs(float64(timeNowUnix-int64(timestamp))) <= 20) && (crypt.Md5(configKey+strconv.Itoa(timestamp)) == md5Key)) {
if s.GetSession("auth") != true {
s.Redirect(beego.AppConfig.String("web_base_url")+"/login/index", 302)
Expand Down Expand Up @@ -62,7 +65,7 @@ func (s *BaseController) Prepare() {
s.Data["allow_user_change_username"], _ = beego.AppConfig.Bool("allow_user_change_username")
}

//加载模板
// 加载模板
func (s *BaseController) display(tpl ...string) {
s.Data["web_base_url"] = beego.AppConfig.String("web_base_url")
var tplname string
Expand All @@ -86,19 +89,19 @@ func (s *BaseController) display(tpl ...string) {
s.TplName = tplname
}

//错误
// 错误
func (s *BaseController) error() {
s.Data["web_base_url"] = beego.AppConfig.String("web_base_url")
s.Layout = "public/layout.html"
s.TplName = "public/error.html"
}

//getEscapeString
// getEscapeString
func (s *BaseController) getEscapeString(key string) string {
return html.EscapeString(s.GetString(key))
}

//去掉没有err返回值的int
// 去掉没有err返回值的int
func (s *BaseController) GetIntNoErr(key string, def ...int) int {
strv := s.Ctx.Input.Query(key)
if len(strv) == 0 && len(def) > 0 {
Expand All @@ -108,7 +111,7 @@ func (s *BaseController) GetIntNoErr(key string, def ...int) int {
return val
}

//获取去掉错误的bool值
// 获取去掉错误的bool值
func (s *BaseController) GetBoolNoErr(key string, def ...bool) bool {
strv := s.Ctx.Input.Query(key)
if len(strv) == 0 && len(def) > 0 {
Expand All @@ -118,29 +121,29 @@ func (s *BaseController) GetBoolNoErr(key string, def ...bool) bool {
return val
}

//ajax正确返回
// ajax正确返回
func (s *BaseController) AjaxOk(str string) {
s.Data["json"] = ajax(str, 1)
s.ServeJSON()
s.StopRun()
}

//ajax错误返回
// ajax错误返回
func (s *BaseController) AjaxErr(str string) {
s.Data["json"] = ajax(str, 0)
s.ServeJSON()
s.StopRun()
}

//组装ajax
// 组装ajax
func ajax(str string, status int) map[string]interface{} {
json := make(map[string]interface{})
json["status"] = status
json["msg"] = str
return json
}

//ajax table返回
// ajax table返回
func (s *BaseController) AjaxTable(list interface{}, cnt int, recordsTotal int, kwargs map[string]interface{}) {
json := make(map[string]interface{})
json["rows"] = list
Expand All @@ -157,7 +160,7 @@ func (s *BaseController) AjaxTable(list interface{}, cnt int, recordsTotal int,
s.StopRun()
}

//ajax table参数
// ajax table参数
func (s *BaseController) GetAjaxParams() (start, limit int) {
return s.GetIntNoErr("offset"), s.GetIntNoErr("limit")
}
Expand Down