From 36ba048b544ec2dfad28dc8aace6846eacb8e652 Mon Sep 17 00:00:00 2001 From: jose <627622230@qq.com> Date: Wed, 26 Jun 2019 18:14:25 +0800 Subject: [PATCH] Add some features --- BTPanel/__init__.py | 56 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 46 insertions(+), 10 deletions(-) diff --git a/BTPanel/__init__.py b/BTPanel/__init__.py index 369a2526..c1b7b70f 100644 --- a/BTPanel/__init__.py +++ b/BTPanel/__init__.py @@ -20,6 +20,16 @@ from werkzeug.contrib.cache import SimpleCache from werkzeug.wrappers import Response from flask_socketio import SocketIO,emit,send +#设置BasicAuth +basic_auth_conf = 'config/basic_auth.json' +app.config['BASIC_AUTH_OPEN'] = False +if os.path.exists(basic_auth_conf): + try: + ba_conf = json.loads(public.readFile(basic_auth_conf)) + app.config['BASIC_AUTH_USERNAME'] = ba_conf['basic_user'] + app.config['BASIC_AUTH_PASSWORD'] = ba_conf['basic_pwd'] + app.config['BASIC_AUTH_OPEN'] = ba_conf['open'] + except: pass cache = SimpleCache() socketio = SocketIO() @@ -29,6 +39,7 @@ import common,db,jobs,uuid jobs.control_init() app.secret_key = uuid.UUID(int=uuid.getnode()).hex[-12:] + try: from flask_sqlalchemy import SQLAlchemy app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:////dev/shm/session.db' @@ -74,6 +85,22 @@ if admin_path in admin_path_checks: admin_path = '/bt' def service_status(): return 'True' + +@app.before_request +def basic_auth_check(): + if app.config['BASIC_AUTH_OPEN']: + if request.path in ['/public']: return; + auth = request.authorization + if not comm.get_sk(): return; + if not auth: return send_authenticated() + tips = '_bt.cn' + if public.md5(auth.username.strip() + tips) != app.config['BASIC_AUTH_USERNAME'] or public.md5(auth.password.strip() + tips) != app.config['BASIC_AUTH_PASSWORD']: + return send_authenticated() + + +def send_authenticated(): + return Response('', 401,{'WWW-Authenticate': 'Basic realm="Login Required"'}) + @app.route('/',methods=method_all) def home(): comReturn = comm.local() @@ -179,7 +206,7 @@ def ftp(pdata = None): data['isSetup'] = True; if os.path.exists(public.GetConfigValue('setup_path') + '/pure-ftpd') == False: data['isSetup'] = False; data['lan'] = public.GetLan('ftp') - return render_template( 'ftp.html',data=data) + return render_template('ftp.html',data=data) import ftp ftpObject = ftp.ftp() defs = ('AddUser','DeleteUser','SetUserPassword','SetStatus','setPort') @@ -330,6 +357,7 @@ def config(pdata = None): if comReturn: return comReturn if request.method == method_get[0] and not pdata: import system,wxapp,config + c_obj = config.config() data = system.system().GetConcifInfo() data['lan'] = public.GetLan('config') try: @@ -344,13 +372,15 @@ def config(pdata = None): if not os.path.exists(workers_p): public.writeFile(workers_p,'1') data['workers'] = int(public.readFile(workers_p)) data['session_timeout'] = int(public.readFile(sess_out_path)) - if config.config().get_ipv6_listen(None): data['ipv6'] = 'checked' - if config.config().get_token(None)['open']: data['api'] = 'checked' + if c_obj.get_ipv6_listen(None): data['ipv6'] = 'checked' + if c_obj.get_token(None)['open']: data['api'] = 'checked' + data['basic_auth'] = c_obj.get_basic_auth_stat(None) + data['basic_auth']['value'] = public.GetMsg("CLOSE") + if data['basic_auth']['open']: data['basic_auth']['value'] = public.GetMsg("OPEN") return render_template( 'config.html',data=data) import config - configObject = config.config() - defs = ('get_cli_php_version','get_tmp_token','set_cli_php_version','DelOldSession', 'GetSessionCount', 'SetSessionConf', 'GetSessionConf','get_ipv6_listen','set_ipv6_status','GetApacheValue','SetApacheValue','GetNginxValue','SetNginxValue','get_token','set_token','set_admin_path','is_pro','get_php_config','get_config','SavePanelSSL','GetPanelSSL','GetPHPConf','SetPHPConf','GetPanelList','AddPanelInfo','SetPanelInfo','DelPanelInfo','ClickPanelInfo','SetPanelSSL','SetTemplates','Set502','setPassword','setUsername','setPanel','setPathInfo','setPHPMaxSize','getFpmConfig','setFpmConfig','setPHPMaxTime','syncDate','setPHPDisable','SetControl','ClosePanel','AutoUpdatePanel','SetPanelLock') - return publicObject(configObject,defs,None,pdata); + defs = ('get_panel_error_logs','clean_panel_error_logs','get_basic_auth_stat','set_basic_auth','get_cli_php_version','get_tmp_token','set_cli_php_version','DelOldSession', 'GetSessionCount', 'SetSessionConf', 'GetSessionConf','get_ipv6_listen','set_ipv6_status','GetApacheValue','SetApacheValue','GetNginxValue','SetNginxValue','get_token','set_token','set_admin_path','is_pro','get_php_config','get_config','SavePanelSSL','GetPanelSSL','GetPHPConf','SetPHPConf','GetPanelList','AddPanelInfo','SetPanelInfo','DelPanelInfo','ClickPanelInfo','SetPanelSSL','SetTemplates','Set502','setPassword','setUsername','setPanel','setPathInfo','setPHPMaxSize','getFpmConfig','setFpmConfig','setPHPMaxTime','syncDate','setPHPDisable','SetControl','ClosePanel','AutoUpdatePanel','SetPanelLock') + return publicObject(config.config(),defs,None,pdata); @app.route('/ajax',methods=method_all) def ajax(pdata = None): @@ -376,7 +406,7 @@ def deployment(pdata = None): if comReturn: return comReturn import plugin_deployment sysObject = plugin_deployment.plugin_deployment() - defs = ('GetList','AddPackage','DelPackage','SetupPackage','GetSpeed') + defs = ('GetList','AddPackage','DelPackage','SetupPackage','GetSpeed','GetPackageOther') return publicObject(sysObject,defs,None,pdata); @app.route('/data',methods=method_all) @@ -448,7 +478,12 @@ def plugin(pdata = None): def panel_public(): get = get_input(); get.client_ip = public.GetClientIp(); + if get.fun in ['scan_login','login_qrcode','set_login','is_scan_ok','blind']: + #检查是否验证过安全入口 + if get.fun in ['login_qrcode','is_scan_ok']: + global admin_check_auth,admin_path,route_path,admin_path_file + if admin_path != '/bt' and os.path.exists(admin_path_file) and not 'admin_auth' in session: return 'False' import wxapp pluwx = wxapp.wxapp() checks = pluwx._check(get) @@ -501,8 +536,8 @@ def coll_socket(msg): return; emit('coll_response',getattr(t,msg['f'])(msg)) -@app.route('/btco',methods=method_all) -@app.route('/btco/',methods=method_all) +@app.route('/coll',methods=method_all) +@app.route('/coll/',methods=method_all) @app.route('//',methods=method_all) @app.route('///',methods=method_all) def panel_other(name=None,fun = None,stype=None): @@ -517,7 +552,7 @@ def panel_other(name=None,fun = None,stype=None): #前置准备 - if not name: name = 'btco' + if not name: name = 'coll' #是否响应面板默认静态文件 if name == 'static': @@ -932,6 +967,7 @@ def publicObject(toObject,defs,action=None,get = None): if hasattr(get,'path'): get.path = get.path.replace('//','/').replace('\\','/'); + if get.path.find('..') != -1: return public.ReturnJson(False,public.GetMsg("UNSAFE_PATH")),json_header if get.path.find('->') != -1: get.path = get.path.split('->')[0].strip(); not_acts = ['GetTaskSpeed','GetNetWork','check_pay_status','get_re_order_status','get_order_stat']