github
/
jumpserver
mirror of https://github.com/jumpserver/jumpserver
1
0
Fork 0
Code Issues Releases Wiki Activity

perf: Validate connection token id

dev
wangruidong 2025-08-28 17:31:14 +08:00 committed by 老广
parent 28d5475d0f
commit 468b84eb3d
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/authentication/api/connection_token.py
View File

@ -618,6 +618,8 @@ class SuperConnectionTokenViewSet(ConnectionTokenViewSet):
token_id = request.data.get('id') or '' token_id = request.data.get('id') or ''
token = ConnectionToken.get_typed_connection_token(token_id) token = ConnectionToken.get_typed_connection_token(token_id)
if not token:
raise PermissionDenied('Token {} is not valid'.format(token))
token.is_valid() token.is_valid()
serializer = self.get_serializer(instance=token) serializer = self.get_serializer(instance=token)

4
apps/authentication/models/connection_token.py
View File

@ -4,6 +4,7 @@ from datetime import timedelta
from django.conf import settings from django.conf import settings
from django.core.cache import cache from django.core.cache import cache
from django.core.exceptions import ValidationError
from django.db import models from django.db import models
from django.shortcuts import get_object_or_404 from django.shortcuts import get_object_or_404
from django.utils import timezone from django.utils import timezone
@ -76,7 +77,10 @@ class ConnectionToken(JMSOrgBaseModel):
@classmethod @classmethod
def get_typed_connection_token(cls, token_id): def get_typed_connection_token(cls, token_id):
try:
token = get_object_or_404(cls, id=token_id) token = get_object_or_404(cls, id=token_id)
except ValidationError:
return None
if token.type == ConnectionTokenType.ADMIN.value: if token.type == ConnectionTokenType.ADMIN.value:
token = AdminConnectionToken.objects.get(id=token_id) token = AdminConnectionToken.objects.get(id=token_id)