Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-26 19:38:48 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

✨ Support read-only publish service

Browse source 
* 🎨 kernel supports read-only publishing services

* 🐛 Fix authentication vulnerabilities

* 🎨 Protect secret information

* 🎨 Adjust the permission control

* 🎨 Adjust the permission control

* 🎨 Fixed the vulnerability that `getFile` gets file `conf.json`

* 🎨 Add API `/api/setting/setPublish`

* 🎨 Add API `/api/setting/getPublish`

* 🐛 Fixed the issue that PWA-related files could not pass BasicAuth

* 🎨 Add a settings panel for publishing features

* 📝 Add guide for `Publish Service`

* 📝 Update Japanese user guide

* 🎨 Merge fixed static file services
This commit is contained in:
Yingyi / 颖逸 2024-06-12 21:03:51 +08:00 • committed by GitHub
parent 536879cb84
commit ba2193403d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
47 changed files with 3690 additions and 375 deletions
Download patch file Download diff file Expand all files Collapse all files

53
kernel/model/session.go
View file

@ -164,6 +164,16 @@ func CheckReadonly(c *gin.Context) {
}
func CheckAuth(c *gin.Context) {
// 已通过 JWT 认证
if role := GetGinContextRole(c); IsValidRole(role, []Role{
RoleAdministrator,
RoleEditor,
RoleReader,
}) {
c.Next()
return
}
//logging.LogInfof("check auth for [%s]", c.Request.RequestURI)
localhost := util.IsLocalHost(c.Request.RemoteAddr)
@ -171,6 +181,7 @@ func CheckAuth(c *gin.Context) {
if "" == Conf.AccessAuthCode {
// Skip the empty access authorization code check https://github.com/siyuan-note/siyuan/issues/9709
if util.SiyuanAccessAuthCodeBypass {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
@ -190,6 +201,7 @@ func CheckAuth(c *gin.Context) {
return
}
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
@ -206,19 +218,23 @@ func CheckAuth(c *gin.Context) {
// 放过来自本机的某些请求
if localhost {
if strings.HasPrefix(c.Request.RequestURI, "/assets/") {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
if strings.HasPrefix(c.Request.RequestURI, "/api/system/exit") {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
if strings.HasPrefix(c.Request.RequestURI, "/api/system/getNetwork") {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
if strings.HasPrefix(c.Request.RequestURI, "/api/sync/performSync") {
if util.ContainerIOS == util.Container || util.ContainerAndroid == util.Container {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
@ -229,6 +245,7 @@ func CheckAuth(c *gin.Context) {
session := util.GetSession(c)
workspaceSession := util.GetWorkspaceSession(session)
if workspaceSession.AccessAuthCode == Conf.AccessAuthCode {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
@ -248,6 +265,7 @@ func CheckAuth(c *gin.Context) {
if "" != token {
if Conf.Api.Token == token {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
@ -261,6 +279,7 @@ func CheckAuth(c *gin.Context) {
// 通过 API token (query-params: token)
if token := c.Query("token"); "" != token {
if Conf.Api.Token == token {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
@ -300,9 +319,43 @@ func CheckAuth(c *gin.Context) {
return
}
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
}
func CheckAdminRole(c *gin.Context) {
if IsValidRole(GetGinContextRole(c), []Role{
RoleAdministrator,
}) {
c.Next()
} else {
c.AbortWithStatus(http.StatusForbidden)
}
}
func CheckEditRole(c *gin.Context) {
if IsValidRole(GetGinContextRole(c), []Role{
RoleAdministrator,
RoleEditor,
}) {
c.Next()
} else {
c.AbortWithStatus(http.StatusForbidden)
}
}
func CheckReadRole(c *gin.Context) {
if IsValidRole(GetGinContextRole(c), []Role{
RoleAdministrator,
RoleEditor,
RoleReader,
}) {
c.Next()
} else {
c.AbortWithStatus(http.StatusForbidden)
}
}
var timingAPIs = map[string]int{
"/api/search/fullTextSearchBlock": 200, // Monitor the search performance and suggest solutions https://github.com/siyuan-note/siyuan/issues/7873
}