becomer/cpdaily_xiaozhushou
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 收紧管理端越权, 全量CDK/代理列表/公告管理/系统设置仅超管
ci/woodpecker/tag/build Pipeline was successful
Details

Browse Source 
实测发现任意代理 token 可访问 /admin/all-cdks、/admin/all-agents、
/agent/list 查看全站数据，并可创建全站强制弹窗公告、篡改系统计费与
SMTP 配置。为这些接口补充 AdminOnly 中间件；公告收取仍走
/my-announcements，代理自管理功能（自有CDK/下级代理）不受影响。
This commit is contained in:
becomer
2026-09-03 15:28:43 +08:00
parent a75d57f309
commit 097aed6f40
1 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backed/cmd/server/main.go
+15 -14
View File
@@ -97,33 +97,34 @@ func main() {
adminAuth.Get("/cdks", handler.ListCDKs) adminAuth.Get("/cdks", handler.ListCDKs)
adminAuth.Post("/cdks", handler.GenerateCDK) adminAuth.Post("/cdks", handler.GenerateCDK)
adminAuth.Put("/cdks/:id/status", handler.UpdateCDKStatus) adminAuth.Put("/cdks/:id/status", handler.UpdateCDKStatus)
adminAuth.Get("/all-cdks", handler.ListAllCDKs) // 全量数据仅超管可见（代理只能看自己生成的）
adminAuth.Get("/all-cdks", middleware.AdminOnly(), handler.ListAllCDKs)
adminAuth.Get("/agents", handler.ListSubAgents) adminAuth.Get("/agents", handler.ListSubAgents)
adminAuth.Post("/agents", handler.CreateSubAgent) adminAuth.Post("/agents", handler.CreateSubAgent)
adminAuth.Put("/agents/:id", handler.UpdateSubAgent) adminAuth.Put("/agents/:id", handler.UpdateSubAgent)
adminAuth.Get("/agents/:id", handler.GetAgentDetail) adminAuth.Get("/agents/:id", handler.GetAgentDetail)
adminAuth.Put("/agents/:id/password", handler.UpdateAgentPassword) adminAuth.Put("/agents/:id/password", handler.UpdateAgentPassword)
adminAuth.Put("/agents/:id/status", handler.UpdateAgentStatus) adminAuth.Put("/agents/:id/status", handler.UpdateAgentStatus)
adminAuth.Get("/all-agents", handler.ListAllAgents) adminAuth.Get("/all-agents", middleware.AdminOnly(), handler.ListAllAgents)
adminAuth.Get("/agent/list", handler.ListAllAgents) adminAuth.Get("/agent/list", middleware.AdminOnly(), handler.ListAllAgents)
// 管理后台 - 用户管理（仅admin） // 管理后台 - 用户管理（仅admin）
adminAuth.Get("/users", middleware.AdminOnly(), handler.ListUsers) adminAuth.Get("/users", middleware.AdminOnly(), handler.ListUsers)
adminAuth.Get("/users/:id", middleware.AdminOnly(), handler.GetUserDetail) adminAuth.Get("/users/:id", middleware.AdminOnly(), handler.GetUserDetail)
adminAuth.Put("/users/:id/status", middleware.AdminOnly(), handler.UpdateUserStatus) adminAuth.Put("/users/:id/status", middleware.AdminOnly(), handler.UpdateUserStatus)
// 管理后台 - 公告 // 管理后台 - 公告（公告面向全站代理/用户推送，管理操作仅超管；代理/管理员通过 /my-announcements 收取公告）
adminAuth.Post("/announcements", handler.CreateAnnouncement) adminAuth.Post("/announcements", middleware.AdminOnly(), handler.CreateAnnouncement)
adminAuth.Get("/announcements", handler.ListAnnouncements) adminAuth.Get("/announcements", middleware.AdminOnly(), handler.ListAnnouncements)
adminAuth.Get("/announcements/:id", handler.GetAnnouncement) adminAuth.Get("/announcements/:id", middleware.AdminOnly(), handler.GetAnnouncement)
adminAuth.Put("/announcements/:id", handler.UpdateAnnouncement) adminAuth.Put("/announcements/:id", middleware.AdminOnly(), handler.UpdateAnnouncement)
adminAuth.Delete("/announcements/:id", handler.DeleteAnnouncement) adminAuth.Delete("/announcements/:id", middleware.AdminOnly(), handler.DeleteAnnouncement)
// 管理后台 - 系统设置 // 管理后台 - 系统设置（全站计费/奖励/SMTP 配置，仅超管）
adminAuth.Get("/settings", handler.GetSettings) adminAuth.Get("/settings", middleware.AdminOnly(), handler.GetSettings)
adminAuth.Post("/settings", handler.UpdateSetting) adminAuth.Post("/settings", middleware.AdminOnly(), handler.UpdateSetting)
adminAuth.Put("/settings", handler.UpdateSetting) adminAuth.Put("/settings", middleware.AdminOnly(), handler.UpdateSetting)
adminAuth.Post("/settings/test-mail", handler.TestMail) adminAuth.Post("/settings/test-mail", middleware.AdminOnly(), handler.TestMail)
// 管理后台 - 我的公告（代理/管理员视角，共用普通用户公告处理器，但 target_type=agent） // 管理后台 - 我的公告（代理/管理员视角，共用普通用户公告处理器，但 target_type=agent）
adminAuth.Get("/my-announcements", handler.ListUserAnnouncements) adminAuth.Get("/my-announcements", handler.ListUserAnnouncements)