From 097aed6f407f52414db7b759628b55d83837fc8e Mon Sep 17 00:00:00 2001 From: becomer Date: Thu, 3 Sep 2026 15:28:43 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=94=B6=E7=B4=A7=E7=AE=A1=E7=90=86?= =?UTF-8?q?=E7=AB=AF=E8=B6=8A=E6=9D=83,=20=E5=85=A8=E9=87=8FCDK/=E4=BB=A3?= =?UTF-8?q?=E7=90=86=E5=88=97=E8=A1=A8/=E5=85=AC=E5=91=8A=E7=AE=A1?= =?UTF-8?q?=E7=90=86/=E7=B3=BB=E7=BB=9F=E8=AE=BE=E7=BD=AE=E4=BB=85?= =?UTF-8?q?=E8=B6=85=E7=AE=A1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 实测发现任意代理 token 可访问 /admin/all-cdks、/admin/all-agents、 /agent/list 查看全站数据，并可创建全站强制弹窗公告、篡改系统计费与 SMTP 配置。为这些接口补充 AdminOnly 中间件；公告收取仍走 /my-announcements，代理自管理功能（自有CDK/下级代理）不受影响。 --- backed/cmd/server/main.go | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/backed/cmd/server/main.go b/backed/cmd/server/main.go index 81f3575..9c15a12 100644 --- a/backed/cmd/server/main.go +++ b/backed/cmd/server/main.go @@ -97,33 +97,34 @@ func main() { adminAuth.Get("/cdks", handler.ListCDKs) adminAuth.Post("/cdks", handler.GenerateCDK) adminAuth.Put("/cdks/:id/status", handler.UpdateCDKStatus) - adminAuth.Get("/all-cdks", handler.ListAllCDKs) + // 全量数据仅超管可见（代理只能看自己生成的） + adminAuth.Get("/all-cdks", middleware.AdminOnly(), handler.ListAllCDKs) adminAuth.Get("/agents", handler.ListSubAgents) adminAuth.Post("/agents", handler.CreateSubAgent) adminAuth.Put("/agents/:id", handler.UpdateSubAgent) adminAuth.Get("/agents/:id", handler.GetAgentDetail) adminAuth.Put("/agents/:id/password", handler.UpdateAgentPassword) adminAuth.Put("/agents/:id/status", handler.UpdateAgentStatus) - adminAuth.Get("/all-agents", handler.ListAllAgents) - adminAuth.Get("/agent/list", handler.ListAllAgents) + adminAuth.Get("/all-agents", middleware.AdminOnly(), handler.ListAllAgents) + adminAuth.Get("/agent/list", middleware.AdminOnly(), handler.ListAllAgents) // 管理后台 - 用户管理（仅admin） adminAuth.Get("/users", middleware.AdminOnly(), handler.ListUsers) adminAuth.Get("/users/:id", middleware.AdminOnly(), handler.GetUserDetail) adminAuth.Put("/users/:id/status", middleware.AdminOnly(), handler.UpdateUserStatus) - // 管理后台 - 公告 - adminAuth.Post("/announcements", handler.CreateAnnouncement) - adminAuth.Get("/announcements", handler.ListAnnouncements) - adminAuth.Get("/announcements/:id", handler.GetAnnouncement) - adminAuth.Put("/announcements/:id", handler.UpdateAnnouncement) - adminAuth.Delete("/announcements/:id", handler.DeleteAnnouncement) + // 管理后台 - 公告（公告面向全站代理/用户推送，管理操作仅超管；代理/管理员通过 /my-announcements 收取公告） + adminAuth.Post("/announcements", middleware.AdminOnly(), handler.CreateAnnouncement) + adminAuth.Get("/announcements", middleware.AdminOnly(), handler.ListAnnouncements) + adminAuth.Get("/announcements/:id", middleware.AdminOnly(), handler.GetAnnouncement) + adminAuth.Put("/announcements/:id", middleware.AdminOnly(), handler.UpdateAnnouncement) + adminAuth.Delete("/announcements/:id", middleware.AdminOnly(), handler.DeleteAnnouncement) - // 管理后台 - 系统设置 - adminAuth.Get("/settings", handler.GetSettings) - adminAuth.Post("/settings", handler.UpdateSetting) - adminAuth.Put("/settings", handler.UpdateSetting) - adminAuth.Post("/settings/test-mail", handler.TestMail) + // 管理后台 - 系统设置（全站计费/奖励/SMTP 配置，仅超管） + adminAuth.Get("/settings", middleware.AdminOnly(), handler.GetSettings) + adminAuth.Post("/settings", middleware.AdminOnly(), handler.UpdateSetting) + adminAuth.Put("/settings", middleware.AdminOnly(), handler.UpdateSetting) + adminAuth.Post("/settings/test-mail", middleware.AdminOnly(), handler.TestMail) // 管理后台 - 我的公告（代理/管理员视角，共用普通用户公告处理器，但 target_type=agent） adminAuth.Get("/my-announcements", handler.ListUserAnnouncements)