Northern_Lights/NapCatQQ
1
0
Fork 0
mirror of https://github.com/NapNeko/NapCatQQ.git synced 2026-01-15 12:50:33 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

feat: 安全性提升

Browse Source
This commit is contained in:
手瓜一十雪 2025-09-06 11:32:09 +08:00
parent f4412bb086
commit e4c1807f76
5 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/webui/src/api/Auth.ts
View File

@ -10,7 +10,7 @@ import { isEmpty } from '@webapi/utils/check';
// 检查是否使用默认Token // 检查是否使用默认Token
export const CheckDefaultTokenHandler: RequestHandler = async (_, res) => { export const CheckDefaultTokenHandler: RequestHandler = async (_, res) => {
const webuiToken = await WebUiConfig.GetWebUIConfig(); const webuiToken = await WebUiConfig.GetWebUIConfig();
if (webuiToken.token.startsWith('napcat')) { if (webuiToken.defaultToken) {
return sendSuccess(res, true); return sendSuccess(res, true);
} }
return sendSuccess(res, false); return sendSuccess(res, false);

4
src/webui/src/api/File.ts
View File

@ -65,6 +65,10 @@ const checkSameTypeExists = async (pathToCheck: string, isDirectory: boolean): P
// 获取目录内容 // 获取目录内容
export const ListFilesHandler: RequestHandler = async (req, res) => { export const ListFilesHandler: RequestHandler = async (req, res) => {
const webuiToken = await WebUiConfig.GetWebUIConfig();
if (webuiToken.defaultToken) {
return sendError(res, '默认密码禁止使用');
}
try { try {
const requestPath = (req.query['path'] as string) || (isWindows ? 'C:\\' : '/'); const requestPath = (req.query['path'] as string) || (isWindows ? 'C:\\' : '/');
const normalizedPath = normalizePath(requestPath); const normalizedPath = normalizePath(requestPath);

2
src/webui/src/api/Log.ts
View File

@ -47,7 +47,7 @@ export const CreateTerminalHandler: RequestHandler = async (req, res) => {
if (isMacOS) { if (isMacOS) {
return sendError(res, 'MacOS不支持终端'); return sendError(res, 'MacOS不支持终端');
} }
if ((await WebUiConfig.GetWebUIConfig()).token.startsWith('napcat')) { if ((await WebUiConfig.GetWebUIConfig()).defaultToken) {
return sendError(res, '该密码禁止创建终端'); return sendError(res, '该密码禁止创建终端');
} }
try { try {

6
src/webui/src/api/OB11Config.ts
View File

@ -2,7 +2,7 @@ import { RequestHandler } from 'express';
import { existsSync, readFileSync } from 'node:fs'; import { existsSync, readFileSync } from 'node:fs';
import { resolve } from 'node:path'; import { resolve } from 'node:path';
import { loadConfig, OneBotConfig } from '@/onebot/config/config'; import { loadConfig, OneBotConfig } from '@/onebot/config/config';
import { webUiPathWrapper } from '@/webui'; import { WebUiConfig, webUiPathWrapper } from '@/webui';
import { WebUiDataRuntime } from '@webapi/helper/Data'; import { WebUiDataRuntime } from '@webapi/helper/Data';
import { sendError, sendSuccess } from '@webapi/utils/response'; import { sendError, sendSuccess } from '@webapi/utils/response';
import { isEmpty } from '@webapi/utils/check'; import { isEmpty } from '@webapi/utils/check';
@ -47,6 +47,10 @@ export const OB11SetConfigHandler: RequestHandler = async (req, res) => {
if (isEmpty(req.body.config)) { if (isEmpty(req.body.config)) {
return sendError(res, 'config is empty'); return sendError(res, 'config is empty');
} }
const webuiToken = await WebUiConfig.GetWebUIConfig();
if (webuiToken.defaultToken) {
return sendError(res, '默认密码禁止写入配置');
}
// 写入配置 // 写入配置
try { try {
// 解析并加载配置 // 解析并加载配置

3
src/webui/src/helper/config.ts
View File

@ -18,6 +18,7 @@ const WebUiConfigSchema = Type.Object({
loginRate: Type.Number({ default: 10 }), loginRate: Type.Number({ default: 10 }),
autoLoginAccount: Type.String({ default: '' }), autoLoginAccount: Type.String({ default: '' }),
theme: themeType, theme: themeType,
defaultToken: Type.Boolean({ default: true }),
}); });
export type WebUiConfigType = Static<typeof WebUiConfigSchema>; export type WebUiConfigType = Static<typeof WebUiConfigSchema>;
@ -88,7 +89,7 @@ export class WebUiConfigWrapper {
if (currentConfig.token !== oldToken) { if (currentConfig.token !== oldToken) {
throw new Error('旧 token 不匹配'); throw new Error('旧 token 不匹配');
} }
await this.UpdateWebUIConfig({ token: newToken }); await this.UpdateWebUIConfig({ token: newToken, defaultToken: false });
} }
// 获取日志文件夹路径 // 获取日志文件夹路径