github
/
teleport
mirror of https://github.com/tp4a/teleport
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

版本升级到 3.6.4-b3 

1. 检查页面传入的空密码并报错；
2. 分组操作会检查对应的组操作权限；
3. 对页面提交的数据进行转义，避免sql注入；
feature/assist-websocket
Apex Liu 2022-09-13 09:59:48 +08:00
parent 8bb05a0d2a
commit 3ba80f02d2
15 changed files with 100 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.idea/teleport.iml
View File

@ -2,7 +2,7 @@
<module classpath="CMake" type="CPP_MODULE" version="4">
<component name="FacetManager">
<facet type="Python" name="Python facet">
<configuration sdkName="Python 3.7" />
<configuration sdkName="Python 3.9" />
</facet>
</component>
</module>

14
build/builder/build-version.py
View File

@ -462,13 +462,13 @@ class Builder:
if len(ver_array) != 2:
raise RuntimeError('Invalid .pbxproj file.')
_ver = ver_array[1].strip()[:-1].strip()
v = _ver.split(".")
if len(v) < 3:
raise RuntimeError('Invalid .pbxproj file.')
old_ver = '.'.join(v)
if old_ver == ver:
continue
# _ver = ver_array[1].strip()[:-1].strip()
# v = _ver.split(".")
# if len(v) < 3:
# raise RuntimeError('Invalid .pbxproj file.')
# old_ver = '.'.join(v)
# if old_ver == ver:
# continue
lines[x] = '{flag} = {ver};\n'.format(flag=ver_array[0], ver=ver)
bOK = True

4
build/builder/core/ver.py
View File

@ -1,4 +1,4 @@
# -*- coding: utf8 -*-
VER_TP_SERVER = "3.6.3"
VER_TP_SERVER = "3.6.4"
VER_TP_ASSIST = "3.6.3"
VER_TP_STATE = "b2"
VER_TP_STATE = "b3"

BIN
dist/client/windows/assist/installer.nsi vendored
View File

Binary file not shown.

BIN
server/tp_core/core/tp_core.rc
View File

Binary file not shown.

2
server/tp_core/core/ts_ver.h
View File

@ -1,6 +1,6 @@
#ifndef __TS_SERVER_VER_H__
#define __TS_SERVER_VER_H__
#define TP_SERVER_VER L"3.6.3"
#define TP_SERVER_VER L"3.6.4"
#endif // __TS_SERVER_VER_H__

4
server/www/requirements.txt
View File

@ -7,7 +7,7 @@
tornado
PyMySQL
psutil
jinja2
Jinja2
MarkupSafe
Pillow
wheezy.captcha
@ -15,7 +15,7 @@ qrcode
ldap3
cffi
# for Windows
# for Windows/macOS
pycryptodome
# for Linux
pycrypto

2
server/www/teleport/static/js/audit/record-list.js
View File

@ -449,7 +449,7 @@ $app.on_table_host_render_created = function (render) {
};
render.time_begin = function (row_id, fields) {
return tp_format_datetime(fields.time_begin, 'MM-dd HH:mm:ss');
return tp_format_datetime(fields.time_begin);
};
render.time_cost = function (row_id, fields) {

2
server/www/teleport/static/js/ops/session-list.js
View File

@ -283,7 +283,7 @@ $app.on_table_session_render_created = function (render) {
};
render.time_begin = function (row_id, fields) {
return tp_format_datetime(fields.time_begin, 'MM-dd HH:mm:ss');
return tp_format_datetime(fields.time_begin);
};
render.time_cost = function (row_id, fields) {

12
server/www/teleport/webroot/app/app_env.py
View File

@ -24,6 +24,12 @@ if PLATFORM not in ['windows', 'linux', 'darwin']:
PATH_DATA = ''
PATH_APP_ROOT = os.path.abspath(os.path.join(os.path.abspath(os.path.dirname(__file__)), '..', '..'))
BITS = 'x64'
if '32bit' == platform.architecture()[0]:
BITS = 'x86'
# 将Python安装的扩展库移除，避免开发调试与正式发布所依赖的库文件不一致导致发布的版本无法运行
# if PLATFORM != 'darwin':
if PLATFORM not in ['windows', 'darwin']:
@ -34,12 +40,6 @@ if PLATFORM not in ['windows', 'darwin']:
for p in x:
sys.path.remove(p)
PATH_APP_ROOT = os.path.abspath(os.path.join(os.path.abspath(os.path.dirname(__file__)), '..', '..'))
BITS = 'x64'
if '32bit' == platform.architecture()[0]:
BITS = 'x86'
# 引入必要的扩展库
_ext_path = os.path.abspath(os.path.join(PATH_APP_ROOT, '..', 'packages', 'packages-{}'.format(PLATFORM), BITS))
if _ext_path not in sys.path:

4
server/www/teleport/webroot/app/app_ver.py
View File

@ -1,4 +1,4 @@
# -*- coding: utf8 -*-
TP_SERVER_VER = "3.6.3"
TP_SERVER_VER = "3.6.4"
TP_ASSIST_REQUIRE_VER = "3.6.3"
TP_STATE_VER = "b2"
TP_STATE_VER = "b3"

22
server/www/teleport/webroot/app/base/controller.py
View File

@ -16,6 +16,8 @@ from app.base.session import tp_session
from app.const import *
from tornado.escape import json_encode
import app.app_ver as app_ver
# import app.const as app_const
@ -201,6 +203,13 @@ class TPBaseHandler(tornado.web.RequestHandler):
def show_error_page(self, err_code):
self.render('error/error.html', page_param=json.dumps({'err_code': err_code}))
@staticmethod
def escaped_argument(val):
if val is None:
return None
else:
return tornado.escape.xhtml_escape(val)
class TPBaseJsonHandler(TPBaseHandler):
"""
@ -213,3 +222,16 @@ class TPBaseJsonHandler(TPBaseHandler):
def __init__(self, application, request, **kwargs):
super().__init__(application, request, **kwargs)
self._mode = self.MODE_JSON
def check_group_operation_privilege(self, group_type):
if group_type == TP_GROUP_USER:
require_privilege = TP_PRIVILEGE_USER_GROUP
elif group_type == TP_GROUP_ACCOUNT:
require_privilege = TP_PRIVILEGE_ACCOUNT_GROUP
elif group_type == TP_GROUP_HOST:
require_privilege = TP_PRIVILEGE_ASSET_GROUP
else:
self.write_json(TPE_PARAM)
return TPE_PARAM
return self.check_privilege(require_privilege)

28
server/www/teleport/webroot/app/controller/group.py
View File

@ -19,11 +19,15 @@ class DoUpdateGroupHandler(TPBaseJsonHandler):
try:
gtype = int(args['gtype'])
gid = int(args['gid'])
name = args['name']
desc = args['desc']
name = self.escaped_argument(args['name'])
desc = self.escaped_argument(args['desc'])
except:
return self.write_json(TPE_PARAM)
# 权限检查
if self.check_group_operation_privilege(gtype) != TPE_OK:
return
if gid == -1:
err, _ = group.create(self, gtype, name, desc)
else:
@ -48,6 +52,10 @@ class DoLockGroupHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# 权限检查
if self.check_group_operation_privilege(gtype) != TPE_OK:
return
err = group.update_groups_state(self, gtype, glist, TP_STATE_DISABLED)
self.write_json(err)
@ -69,6 +77,10 @@ class DoUnlockGroupHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# 权限检查
if self.check_group_operation_privilege(gtype) != TPE_OK:
return
err = group.update_groups_state(self, gtype, glist, TP_STATE_NORMAL)
self.write_json(err)
@ -90,6 +102,10 @@ class DoRemoveGroupHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# 权限检查
if self.check_group_operation_privilege(gtype) != TPE_OK:
return
err = group.remove(self, gtype, glist)
self.write_json(err)
@ -112,6 +128,10 @@ class DoAddMembersHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# 权限检查
if self.check_group_operation_privilege(gtype) != TPE_OK:
return
err = group.add_members(gtype, gid, members)
self.write_json(err)
@ -133,6 +153,10 @@ class DoRemoveMembersHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# 权限检查
if self.check_group_operation_privilege(gtype) != TPE_OK:
return
err = group.remove_members(gtype, gid, members)
self.write_json(err)

13
server/www/teleport/webroot/app/controller/user.py
View File

@ -140,6 +140,7 @@ class DoGenerateOathSecretHandler(TPBaseJsonHandler):
return self.write_json(TPE_OK, data={"tmp_oath_secret": oath_secret})
# 用于进行身份验证器绑定时验证用户身份，必须提供用户名/密码
class DoVerifyUserHandler(TPBaseJsonHandler):
def post(self):
args = self.get_argument('args', None)
@ -156,6 +157,12 @@ class DoVerifyUserHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# Oath 绑定时必须进行密码验证
if username is None or len(username) == 0:
return self.write_json(TPE_PARAM, '未提供用户名')
if password is None or len(password) == 0:
return self.write_json(TPE_PARAM, '未提供密码')
try:
check_bind_oath = args['check_bind_oath']
except:
@ -187,6 +194,12 @@ class DoBindOathHandler(TPBaseJsonHandler):
except:
return self.write_json(TPE_PARAM)
# Oath 绑定时必须进行密码验证
if username is None or len(username) == 0:
return self.write_json(TPE_PARAM, '未提供用户名')
if password is None or len(password) == 0:
return self.write_json(TPE_PARAM, '未提供密码')
err, user_info, msg = user.login(self, username, password=password)
if err != TPE_OK:
if err == TPE_NOT_EXISTS:

6
version.in
View File

@ -10,9 +10,9 @@ Minor: 次版本号。如果两个程序集的名称和主版本号相同，而
Revision: 修订号。主版本号和次版本号都相同但修订号不同的程序集应是完全可互换的。
这适用于修复以前发布的程序集中的错误或安全漏洞。
TP_SERVER 3.6.3 # 整个服务端打包的版本
TP_TPCORE 3.6.3 # 核心服务 tp_core 的版本
TP_SERVER 3.6.4 # 整个服务端打包的版本
TP_TPCORE 3.6.4 # 核心服务 tp_core 的版本
TP_TPWEB 3.1.1 # web服务 tp_web 的版本（一般除非升级Python，否则不会变化）
TP_ASSIST 3.6.3 # 助手版本
TP_ASSIST_REQUIRE 3.6.3 # 适配的助手最低版本
TP_STATE b2 # 版本状态，可以是 beta1，rc2 等，用于打包文件名及部分界面。如果是 release 则界面上不显示。
TP_STATE b3 # 版本状态，可以是 beta1，rc2 等，用于打包文件名及部分界面。如果是 release 则界面上不显示。