github
/
jumpserver
mirror of https://github.com/jumpserver/jumpserver
1
0
Fork 0
Code Issues Releases Wiki Activity

fix: 修复 celery 等日志文件的访问漏洞 (#5475) 

Co-authored-by: xinwen <coderWen@126.com>
v2.5
fit2bot 2021-01-19 14:36:30 +08:00 committed by GitHub
parent 043d24a8f7
commit 08ed363d44
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apps/ops/celery/utils.py
View File

@ -2,6 +2,7 @@
# #
import json import json
import os import os
import uuid
from django.conf import settings from django.conf import settings
from django.utils.timezone import get_current_timezone from django.utils.timezone import get_current_timezone
@ -101,6 +102,10 @@ def get_celery_periodic_task(task_name):
def get_celery_task_log_path(task_id): def get_celery_task_log_path(task_id):
task_id = str(task_id) task_id = str(task_id)
try:
uuid.UUID(task_id)
except:
return
rel_path = os.path.join(task_id[0], task_id[1], task_id + '.log') rel_path = os.path.join(task_id[0], task_id[1], task_id + '.log')
path = os.path.join(settings.CELERY_LOG_DIR, rel_path) path = os.path.join(settings.CELERY_LOG_DIR, rel_path)
os.makedirs(os.path.dirname(path), exist_ok=True) os.makedirs(os.path.dirname(path), exist_ok=True)

2
apps/ops/ws.py
View File

@ -16,7 +16,7 @@ class CeleryLogWebsocket(JsonWebsocketConsumer):
def connect(self): def connect(self):
user = self.scope["user"] user = self.scope["user"]
if user.is_authenticated and user.is_org_admin: if user.is_authenticated:
self.accept() self.accept()
else: else:
self.close() self.close()