From 221894d972e5406588320248c3fc6500729e3435 Mon Sep 17 00:00:00 2001 From: "1808837298@qq.com" <1808837298@qq.com> Date: Tue, 24 Sep 2024 17:48:09 +0800 Subject: [PATCH 01/23] fix: error user role --- common/constants.go | 4 ++++ controller/user.go | 8 +++++--- middleware/auth.go | 27 +++++++++++++++++++++++++++ model/user.go | 5 +++-- web/src/components/UsersTable.js | 14 +++++++------- 5 files changed, 46 insertions(+), 12 deletions(-) diff --git a/common/constants.go b/common/constants.go index 3700fce..1f4d3f8 100644 --- a/common/constants.go +++ b/common/constants.go @@ -126,6 +126,10 @@ const ( RoleRootUser = 100 ) +func IsValidateRole(role int) bool { + return role == RoleGuestUser || role == RoleCommonUser || role == RoleAdminUser || role == RoleRootUser +} + var ( FileUploadPermission = RoleGuestUser FileDownloadPermission = RoleGuestUser diff --git a/controller/user.go b/controller/user.go index e69a613..bf8a2a2 100644 --- a/controller/user.go +++ b/controller/user.go @@ -7,6 +7,7 @@ import ( "one-api/common" "one-api/model" "strconv" + "strings" "sync" "github.com/gin-contrib/sessions" @@ -616,6 +617,7 @@ func DeleteSelf(c *gin.Context) { func CreateUser(c *gin.Context) { var user model.User err := json.NewDecoder(c.Request.Body).Decode(&user) + user.Username = strings.TrimSpace(user.Username) if err != nil || user.Username == "" || user.Password == "" { c.JSON(http.StatusOK, gin.H{ "success": false, @@ -663,8 +665,8 @@ func CreateUser(c *gin.Context) { } type ManageRequest struct { - Username string `json:"username"` - Action string `json:"action"` + Id int `json:"id"` + Action string `json:"action"` } // ManageUser Only admin user can do this @@ -680,7 +682,7 @@ func ManageUser(c *gin.Context) { return } user := model.User{ - Username: req.Username, + Id: req.Id, } // Fill attributes model.DB.Unscoped().Where(&user).First(&user) diff --git a/middleware/auth.go b/middleware/auth.go index 8426b04..e5ee547 100644 --- a/middleware/auth.go +++ b/middleware/auth.go @@ -10,6 +10,17 @@ import ( "strings" ) +func validUserInfo(username string, role int) bool { + // check username is empty + if strings.TrimSpace(username) == "" { + return false + } + if !common.IsValidateRole(role) { + return false + } + return true +} + func authHelper(c *gin.Context, minRole int) { session := sessions.Default(c) username := session.Get("username") @@ -30,6 +41,14 @@ func authHelper(c *gin.Context, minRole int) { } user := model.ValidateAccessToken(accessToken) if user != nil && user.Username != "" { + if !validUserInfo(user.Username, user.Role) { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": "无权进行此操作,用户信息无效", + }) + c.Abort() + return + } // Token is valid username = user.Username role = user.Role @@ -91,6 +110,14 @@ func authHelper(c *gin.Context, minRole int) { c.Abort() return } + if !validUserInfo(username.(string), role.(int)) { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": "无权进行此操作,用户信息无效", + }) + c.Abort() + return + } c.Set("username", username) c.Set("role", role) c.Set("id", id) diff --git a/model/user.go b/model/user.go index 44dd53e..6d3b2b2 100644 --- a/model/user.go +++ b/model/user.go @@ -295,11 +295,12 @@ func (user *User) ValidateAndFill() (err error) { // that means if your field’s value is 0, '', false or other zero values, // it won’t be used to build query conditions password := user.Password - if user.Username == "" || password == "" { + username := strings.TrimSpace(user.Username) + if username == "" || password == "" { return errors.New("用户名或密码为空") } // find buy username or email - DB.Where("username = ? OR email = ?", user.Username, user.Username).First(user) + DB.Where("username = ? OR email = ?", username, username).First(user) okay := common.ValidatePasswordAndHash(password, user.Password) if !okay || user.Status != common.UserStatusEnabled { return errors.New("用户名或密码错误,或用户已被封禁") diff --git a/web/src/components/UsersTable.js b/web/src/components/UsersTable.js index 5bfa586..060267e 100644 --- a/web/src/components/UsersTable.js +++ b/web/src/components/UsersTable.js @@ -151,7 +151,7 @@ const UsersTable = () => { title='确定?' okType={'warning'} onConfirm={() => { - manageUser(record.username, 'promote', record); + manageUser(record.id, 'promote', record); }} >