xinyin025/hotgo
1
0
Fork 0
mirror of https://github.com/bufanyun/hotgo.git synced 2025-09-17 08:46:39 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #176 from Yazzyk/v2.0

Browse Source 
处理了 2 个漏洞，并增加验证码方式选择
This commit is contained in:
孟帅 2025-07-01 00:07:53 +08:00 committed by GitHub
commit 1564e8605d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
10 changed files with 85 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server/internal/consts/captcha.go Normal file
View File

@ -0,0 +1,6 @@
package consts
const (
CaptchaTypeString = iota + 1 // 字符串
CaptchaTypeMath // 数字计算
)

6
server/internal/controller/admin/common/site.go
View File

@ -95,7 +95,11 @@ func (c *cSite) LoginConfig(ctx context.Context, _ *common.SiteLoginConfigReq) (
// Captcha 登录验证码
func (c *cSite) Captcha(ctx context.Context, _ *common.LoginCaptchaReq) (res *common.LoginCaptchaRes, err error) {
cid, base64 := captcha.Generate(ctx)
loginConf, err := service.SysConfig().GetLogin(ctx)
if err != nil {
return
}
cid, base64 := captcha.Generate(ctx, loginConf.CaptchaType)
res = &common.LoginCaptchaRes{Cid: cid, Base64: base64}
return
}

71
server/internal/library/captcha/captcha.go
View File

@ -7,6 +7,7 @@ package captcha
import (
"context"
"hotgo/internal/consts"
"image/color"
"github.com/gogf/gf/v2/frame/g"
@ -18,44 +19,52 @@ import (
var store = base64Captcha.DefaultMemStore
// Generate 生成验证码
func Generate(ctx context.Context) (id string, base64 string) {
// 字符
// driver := &base64Captcha.DriverString{
// Height: 42,
// Width: 100,
// //NoiseCount: 50,
// //ShowLineOptions: 20,
// Length: 4,
// BgColor: &color.RGBA{
// R: 255,
// G: 250,
// B: 250,
// A: 250,
// },
// Source: "0123456789", // abcdefghjkmnpqrstuvwxyz23456789
// Fonts: []string{"chromohv.ttf"},
// }
func Generate(ctx context.Context, captchaType int) (id string, base64 string) {
var err error
switch captchaType {
// 算数
driver := &base64Captcha.DriverMath{
Height: 42,
Width: 100,
NoiseCount: 0,
ShowLineOptions: 0,
BgColor: &color.RGBA{
R: 255,
G: 250,
B: 250,
A: 250,
},
Fonts: []string{"chromohv.ttf"},
case consts.CaptchaTypeMath:
driver := &base64Captcha.DriverMath{
Height: 42,
Width: 100,
NoiseCount: 0,
ShowLineOptions: 0,
BgColor: &color.RGBA{
R: 255,
G: 250,
B: 250,
A: 250,
},
Fonts: []string{"chromohv.ttf"},
}
c := base64Captcha.NewCaptcha(driver.ConvertFonts(), store)
id, base64, _, err = c.Generate()
// 字符
default:
driver := &base64Captcha.DriverString{
Height: 42,
Width: 100,
//NoiseCount: 50,
//ShowLineOptions: 20,
Length: 4,
BgColor: &color.RGBA{
R: 255,
G: 250,
B: 250,
A: 250,
},
Source: "abcdefghjkmnpqrstuvwxyz23456789", // abcdefghjkmnpqrstuvwxyz23456789
Fonts: []string{"chromohv.ttf"},
}
c := base64Captcha.NewCaptcha(driver.ConvertFonts(), store)
id, base64, _, err = c.Generate()
}
c := base64Captcha.NewCaptcha(driver.ConvertFonts(), store)
id, base64, _, err := c.Generate()
if err != nil {
g.Log().Errorf(ctx, "captcha.Generate err:%+v", err)
}
return
}

2
server/internal/logic/admin/site.go
View File

@ -154,7 +154,7 @@ func (s *sAdminSite) AccountLogin(ctx context.Context, in *adminin.AccountLoginI
}
if mb == nil {
err = gerror.New("账号不存在")
err = gerror.New("用户名或密码错误")
return
}

3
server/internal/logic/sys/login_log.go
View File

@ -82,6 +82,9 @@ func (s *sSysLoginLog) List(ctx context.Context, in *sysin.LoginLogListInp) (lis
}
for _, v := range list {
if v.Response.Contains("token") {
v.Response.Set("token", "******")
}
v.Os = useragent.GetOs(v.UserAgent)
v.Browser = useragent.GetBrowser(v.UserAgent)
v.SysLogId, err = dao.SysLog.Ctx(ctx).Fields(dao.SysLog.Columns().Id).Where(dao.SysLog.Columns().ReqId, v.ReqId).Value()

1
server/internal/model/config.go
View File

@ -176,6 +176,7 @@ type WechatConfig struct {
type LoginConfig struct {
RegisterSwitch int `json:"loginRegisterSwitch"`
CaptchaSwitch int `json:"loginCaptchaSwitch"`
CaptchaType int `json:"loginCaptchaType"`
Avatar string `json:"loginAvatar"`
RoleId int64 `json:"loginRoleId"`
DeptId int64 `json:"loginDeptId"`

4
server/storage/data/hotgo.sql
View File

@ -1527,8 +1527,8 @@ INSERT INTO `hg_sys_config` (`id`, `group`, `name`, `type`, `key`, `value`, `def
(125, 'upload', 'minio是否启用SSL', 'int', 'uploadMinioUseSSL', '1', '', 650, '', 1, 1, '2021-01-30 13:27:43', '2024-02-28 16:56:35'),
(126, 'upload', 'minio存储路径', 'string', 'uploadMinioPath', 'hotgo/attachment/', '', 650, '', 1, 1, '2021-01-30 13:27:43', '2024-02-28 16:56:35'),
(127, 'upload', 'minio桶名称', 'string', 'uploadMinioBucket', '', '', 650, '', 1, 1, '2021-01-30 13:27:43', '2024-02-28 16:56:35'),
(128, 'upload', 'minio对外访问域名', 'string', 'uploadMinioDomain', '', '', 650, '', 1, 1, '2021-01-30 13:27:43', '2024-02-28 16:56:35');
(128, 'upload', 'minio对外访问域名', 'string', 'uploadMinioDomain', '', '', 650, '', 1, 1, '2021-01-30 13:27:43', '2024-02-28 16:56:35'),
(129, 'login', '验证码方式', 'int', 'loginCaptchaType', '1', '2', 1200, '', 1, 1, '2025-06-25 17:04:39', '2025-06-25 17:23:15');
-- --------------------------------------------------------
--

2
server/utility/simple/simple.go
View File

@ -68,7 +68,7 @@ func CheckPassword(input, salt, hash string) (err error) {
}
if hash != gmd5.MustEncryptString(password+salt) {
err = gerror.New("用户密码不正确")
err = gerror.New("用户名或密码错误")
return
}
return

53
web/pnpm-lock.yaml
View File

@ -54,8 +54,8 @@ importers:
specifier: ^3.0.1
version: 3.0.1
naive-ui:
specifier: ^2.39.0
version: 2.39.0(vue@3.4.38(typescript@5.5.4))
specifier: ^2.41.0
version: 2.42.0(vue@3.4.38(typescript@5.5.4))
pinia:
specifier: ^2.2.2
version: 2.2.2(typescript@5.5.4)(vue@3.4.38(typescript@5.5.4))
@ -488,10 +488,6 @@ packages:
peerDependencies:
'@babel/core': ^7.0.0-0
'@babel/runtime@7.25.6':
resolution: {integrity: sha512-VBj9MYyDb9tuLq7yzqjgzt6Q+IBQLrGZfdjOekyEirZPHxXWoTSGUTMrpsfi58Up73d13NfYLv8HT9vmznjzhQ==}
engines: {node: '>=6.9.0'}
'@babel/template@7.25.0':
resolution: {integrity: sha512-aOOgh1/5XzKvg1jvVz7AVrx2piJ2XBi227DHmbY6y+bM9H2FlN+IfecYu4Xl0cNiiVejlsCri89LUsbj8vJD9Q==}
engines: {node: '>=6.9.0'}
@ -2081,14 +2077,10 @@ packages:
resolution: {integrity: sha512-wAV9QHOsNbwnWdNW2FYvE1P56wtgSbM+3SZcdGiWQILwVjACCXDCI3Ai8QlCjMDB8YK5zySiXZYBiwGmNY3lnw==}
engines: {node: '>=12'}
date-fns-tz@2.0.1:
resolution: {integrity: sha512-fJCG3Pwx8HUoLhkepdsP7Z5RsucUi+ZBOxyM5d0ZZ6c4SdYustq0VMmOu6Wf7bli+yS/Jwp91TOCqn9jMcVrUA==}
date-fns-tz@3.2.0:
resolution: {integrity: sha512-sg8HqoTEulcbbbVXeg84u5UnlsQa8GS5QXMqjjYIhS4abEVVKIUwe0/l/UhrZdKaL/W5eWZNlbTeEIiOXTcsBQ==}
peerDependencies:
date-fns: 2.x
date-fns@2.30.0:
resolution: {integrity: sha512-fnULvOpxnC5/Vg3NCiWelDsLiUc9bRwAPs/+LfTLNvetFCtCTN+yQz15C/fs4AwX1R9K5GLtLfn8QW+dWisaAw==}
engines: {node: '>=0.11'}
date-fns: ^3.0.0 || ^4.0.0
date-fns@3.6.0:
resolution: {integrity: sha512-fRHTG8g/Gif+kSh50gaGEdToemgfj74aRX3swtiouboip5JDLAyDE9F11nHMIcvOaXeOC6D7SpNhi7uFyB7Uww==}
@ -3461,8 +3453,8 @@ packages:
mz@2.7.0:
resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
naive-ui@2.39.0:
resolution: {integrity: sha512-5oUJzRG+rtLSH8eRU+fJvVYiQids2BxF9jp+fwGoAqHOptEINrBlgBu9uy+95RHE5FLJ7Q/z41o+qkoGnUrKxQ==}
naive-ui@2.42.0:
resolution: {integrity: sha512-c7cXR2YgOjgtBadXHwiWL4Y0tpGLAI5W5QzzHksOi22iuHXoSGMAzdkVTGVPE/PM0MSGQ/JtUIzCx2Y0hU0vTQ==}
peerDependencies:
vue: ^3.0.0
@ -3891,9 +3883,6 @@ packages:
resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
engines: {node: '>=8.10.0'}
regenerator-runtime@0.14.1:
resolution: {integrity: sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==}
regexp.prototype.flags@1.5.2:
resolution: {integrity: sha512-NcDiDkTLuPR+++OCKB0nWafEmhg/Da8aUPLPMQbK+bxKKCm1/S5he+AqYa4PlMCVBalb4/yxIRub6qkEx5yJbw==}
engines: {node: '>= 0.4'}
@ -4561,8 +4550,8 @@ packages:
peerDependencies:
vue: ^3.0.1
vueuc@0.4.58:
resolution: {integrity: sha512-Wnj/N8WbPRSxSt+9ji1jtDHPzda5h2OH/0sFBhvdxDRuyCZbjGg3/cKMaKqEoe+dErTexG2R+i6Q8S/Toq1MYg==}
vueuc@0.4.64:
resolution: {integrity: sha512-wlJQj7fIwKK2pOEoOq4Aro8JdPOGpX8aWQhV8YkTW9OgWD2uj2O8ANzvSsIGjx7LTOc7QbS7sXdxHi6XvRnHPA==}
peerDependencies:
vue: ^3.0.11
@ -4916,10 +4905,6 @@ snapshots:
transitivePeerDependencies:
- supports-color
'@babel/runtime@7.25.6':
dependencies:
regenerator-runtime: 0.14.1
'@babel/template@7.25.0':
dependencies:
'@babel/code-frame': 7.24.7
@ -6665,13 +6650,9 @@ snapshots:
dargs@8.1.0: {}
date-fns-tz@2.0.1(date-fns@2.30.0):
date-fns-tz@3.2.0(date-fns@3.6.0):
dependencies:
date-fns: 2.30.0
date-fns@2.30.0:
dependencies:
'@babel/runtime': 7.25.6
date-fns: 3.6.0
date-fns@3.6.0: {}
@ -8250,7 +8231,7 @@ snapshots:
object-assign: 4.1.1
thenify-all: 1.6.0
naive-ui@2.39.0(vue@3.4.38(typescript@5.5.4)):
naive-ui@2.42.0(vue@3.4.38(typescript@5.5.4)):
dependencies:
'@css-render/plugin-bem': 0.15.14(css-render@0.15.14)
'@css-render/vue3-ssr': 0.15.14(vue@3.4.38(typescript@5.5.4))
@ -8260,8 +8241,8 @@ snapshots:
async-validator: 4.2.5
css-render: 0.15.14
csstype: 3.1.3
date-fns: 2.30.0
date-fns-tz: 2.0.1(date-fns@2.30.0)
date-fns: 3.6.0
date-fns-tz: 3.2.0(date-fns@3.6.0)
evtd: 0.2.4
highlight.js: 11.10.0
lodash: 4.17.21
@ -8271,7 +8252,7 @@ snapshots:
vdirs: 0.1.8(vue@3.4.38(typescript@5.5.4))
vooks: 0.2.12(vue@3.4.38(typescript@5.5.4))
vue: 3.4.38(typescript@5.5.4)
vueuc: 0.4.58(vue@3.4.38(typescript@5.5.4))
vueuc: 0.4.64(vue@3.4.38(typescript@5.5.4))
nanoid@3.3.7: {}
@ -8668,8 +8649,6 @@ snapshots:
dependencies:
picomatch: 2.3.1
regenerator-runtime@0.14.1: {}
regexp.prototype.flags@1.5.2:
dependencies:
call-bind: 1.0.7
@ -9413,7 +9392,7 @@ snapshots:
sortablejs: 1.14.0
vue: 3.4.38(typescript@5.5.4)
vueuc@0.4.58(vue@3.4.38(typescript@5.5.4)):
vueuc@0.4.64(vue@3.4.38(typescript@5.5.4)):
dependencies:
'@css-render/vue3-ssr': 0.15.14(vue@3.4.38(typescript@5.5.4))
'@juggle/resize-observer': 3.4.0

10
web/src/views/system/config/LoginSetting.vue
View File

@ -12,6 +12,15 @@
</n-radio-group>
</n-form-item>
<n-form-item label="验证码方式" path="loginCaptchaType">
<n-radio-group v-model:value="formValue.loginCaptchaType" name="loginCaptchaType">
<n-space>
<n-radio :value="1">字符</n-radio>
<n-radio :value="2">算数</n-radio>
</n-space>
</n-radio-group>
</n-form-item>
<n-form-item label="注册开关" path="loginRegisterSwitch">
<n-radio-group v-model:value="formValue.loginRegisterSwitch" name="cashSwitch">
<n-space>
@ -113,6 +122,7 @@
const formValue = ref({
loginRegisterSwitch: 1,
loginCaptchaSwitch: 1,
loginCaptchaType: 1, // 1: 'str' or 2: 'numMath'
loginForceInvite: 2,
loginAutoOpenId: 2,
loginAvatar: '',