github
/
jumpserver
mirror of https://github.com/jumpserver/jumpserver
1
0
Fork 0
Code Issues Releases Wiki Activity

defend attack

pull/26/head
ibuler 2015-12-10 14:10:47 +08:00
parent d337b929ef
commit e03b4722b0
4 changed files with 26 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
jumpserver/api.py
View File

@ -484,5 +484,18 @@ def get_tmp_dir():
mkdir(dir_name, mode=0777) mkdir(dir_name, mode=0777)
return dir_name return dir_name
def defend_attack(func):
def _deco(request, *args, **kwargs):
if int(request.session.get('visit', 1)) > 5:
return HttpResponse('Forbidden', status=403)
request.session['visit'] = request.session.get('visit', 1) + 1
request.session.set_expiry(300)
logger.debug(request.session.get('visit'))
return func(request, *args, **kwargs)
return _deco
CRYPTOR = PyCrypt(KEY) CRYPTOR = PyCrypt(KEY)
logger = set_log(LOG_LEVEL) logger = set_log(LOG_LEVEL)

3
jumpserver/views.py
View File

@ -164,6 +164,7 @@ def is_latest():
pass pass
@defend_attack
def Login(request): def Login(request):
"""登录界面""" """登录界面"""
error = '' error = ''
@ -207,11 +208,13 @@ def Login(request):
return render_to_response('login.html', {'error': error}) return render_to_response('login.html', {'error': error})
@require_role('user')
def Logout(request): def Logout(request):
logout(request) logout(request)
return HttpResponseRedirect('/login/') return HttpResponseRedirect('/login/')
@require_role('admin')
def setting(request): def setting(request):
header_title, path1 = '项目设置', '设置' header_title, path1 = '项目设置', '设置'
setting_default = get_object(Setting, name='default') setting_default = get_object(Setting, name='default')

8
juser/views.py
View File

@ -268,7 +268,7 @@ def send_mail_retry(request):
跳板机地址： %s 跳板机地址： %s
用户名：%s 用户名：%s
重设密码：%s/juser/forget_password/ 重设密码：%s/juser/forget_password/
请登录web重新生成key 请登录web点击个人信息页面重新生成ssh密钥
""" % (URL, user.username, URL) """ % (URL, user.username, URL)
try: try:
@ -278,11 +278,14 @@ def send_mail_retry(request):
return HttpResponse('发送成功') return HttpResponse('发送成功')
@defend_attack
def forget_password(request): def forget_password(request):
if request.method == 'POST': if request.method == 'POST':
defend_attack(request)
email = request.POST.get('email', '') email = request.POST.get('email', '')
username = request.POST.get('username', '') username = request.POST.get('username', '')
user = get_object(User, username=username, email=email) name = request.POST.get('name', '')
user = get_object(User, username=username, email=email, name=name)
if user: if user:
timestamp = int(time.time()) timestamp = int(time.time())
hash_encode = PyCrypt.md5_crypt(str(user.uuid) + str(timestamp) + KEY) hash_encode = PyCrypt.md5_crypt(str(user.uuid) + str(timestamp) + KEY)
@ -393,6 +396,7 @@ def user_edit(request):
return my_render('juser/user_edit.html', locals(), request) return my_render('juser/user_edit.html', locals(), request)
@require_role('user')
def profile(request): def profile(request):
user_id = request.user.id user_id = request.user.id
if not user_id: if not user_id:

5
templates/juser/forget_password.html
View File

@ -16,7 +16,7 @@
<body class="gray-bg"> <body class="gray-bg">
<div class="lock-word animated fadeInDown"> <div class="lock-word animated fadeInDown">
<span class="first-word">Jumperver</span> <span class="first-word">Jumpserver</span>
</div> </div>
<div class="middle-box text-center lockscreen animated fadeInDown"> <div class="middle-box text-center lockscreen animated fadeInDown">
<div> <div>
@ -35,6 +35,9 @@
<div class="form-group"> <div class="form-group">
<input type="text" name='username' class="form-control" placeholder="Username" required=""> <input type="text" name='username' class="form-control" placeholder="Username" required="">
</div> </div>
<div class="form-group">
<input type="text" name='name' class="form-control" placeholder="Name" required="">
</div>
<div class="form-group"> <div class="form-group">
<input type="text" name='email' class="form-control" placeholder="Email" required=""> <input type="text" name='email' class="form-control" placeholder="Email" required="">
</div> </div>