0ct0pu5/siyuan
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

🎨 Access authorization code captcha vulnerability https://github.com/siyuan-note/siyuan/issues/13147

Browse source
This commit is contained in:
Daniel 2024-11-15 20:32:54 +08:00
parent 0d3d6df134
commit f34dd62cef
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
4 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/stage/auth.html
View file

@ -181,7 +181,7 @@
<h1 style="margin-bottom: 48px;color:var(--b3-theme-on-background)">{{.workspace}}</h1>
<input class="b3-text-field" id="authCode" type="password" placeholder="{{.l0}}"/><br>
<div style="position: relative;width: 240px;margin: 8px auto 0;display: none">
<img id="captchaImg" style="top: 1px;position: absolute;height: 27px;right: 1px;cursor: pointer">
<img id="captchaImg" style="top: 1px;position: absolute;height: 26px;right: 1px;cursor: pointer">
<input id="captcha" class="b3-text-field" placeholder="{{.l3}}">
</div>
<button class="b3-button" onclick="submitAuth()">{{.l1}}</button>

1
kernel/go.mod
View file

@ -143,6 +143,7 @@ require (
github.com/pkg/errors v0.9.1 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/qiniu/go-sdk/v7 v7.20.2 // indirect
github.com/quasoft/memstore v0.0.0-20191010062613-2bce066d2b0b // indirect
github.com/quic-go/qpack v0.5.1 // indirect
github.com/quic-go/quic-go v0.48.1 // indirect
github.com/refraction-networking/utls v1.6.7 // indirect

2
kernel/go.sum
View file

@ -297,6 +297,8 @@ github.com/qiniu/dyn v1.3.0/go.mod h1:E8oERcm8TtwJiZvkQPbcAh0RL8jO1G0VXJMW3FAWdk
github.com/qiniu/go-sdk/v7 v7.20.2 h1:Jd+ZJs79APo0dnRlv3aA/uEP7b44flP+p32Lek/WxlY=
github.com/qiniu/go-sdk/v7 v7.20.2/go.mod h1:ZnEP1rOOi7weF+yzM2qZMHI0z1ht+KjVuNAuKTQW3aM=
github.com/qiniu/x v1.10.5/go.mod h1:03Ni9tj+N2h2aKnAz+6N0Xfl8FwMEDRC2PAlxekASDs=
github.com/quasoft/memstore v0.0.0-20191010062613-2bce066d2b0b h1:aUNXCGgukb4gtY99imuIeoh8Vr0GSwAlYxPAhqZrpFc=
github.com/quasoft/memstore v0.0.0-20191010062613-2bce066d2b0b/go.mod h1:wTPjTepVu7uJBYgZ0SdWHQlIas582j6cn2jgk4DDdlg=
github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
github.com/quic-go/quic-go v0.48.1 h1:y/8xmfWI9qmGTc+lBr4jKRUWLGSlSigv847ULJ4hYXA=

12
kernel/server/serve.go
View file

@ -35,7 +35,7 @@ import (
"github.com/emersion/go-webdav/carddav"
"github.com/gin-contrib/gzip"
"github.com/gin-contrib/sessions"
"github.com/gin-contrib/sessions/cookie"
"github.com/gin-contrib/sessions/memstore"
"github.com/gin-gonic/gin"
"github.com/mssola/useragent"
"github.com/olahol/melody"
@ -60,7 +60,9 @@ const (
)
var (
cookieStore = cookie.NewStore([]byte("ATN51UlxVq1Gcvdf"))
// 这里用的是内存存储，意味着重启后所有 session 会丢失，需要重新登录
sessionStore = memstore.NewStore([]byte("ATN51UlxVq1Gcvdf"))
HttpMethods = []string{
http.MethodGet,
http.MethodHead,
@ -122,13 +124,13 @@ func Serve(fastMode bool) {
gzip.Gzip(gzip.DefaultCompression, gzip.WithExcludedExtensions([]string{".pdf", ".mp3", ".wav", ".ogg", ".mov", ".weba", ".mkv", ".mp4", ".webm"})),
)
cookieStore.Options(sessions.Options{
sessionStore.Options(sessions.Options{
Path: "/",
Secure: util.SSL,
//MaxAge: 60 * 60 * 24 * 7, // 默认是 Session
HttpOnly: true,
})
ginServer.Use(sessions.Sessions("siyuan", cookieStore))
ginServer.Use(sessions.Sessions("siyuan", sessionStore))
serveDebug(ginServer)
serveAssets(ginServer)
@ -524,7 +526,7 @@ func serveWebSocket(ginServer *gin.Engine) {
authOk := true
if "" != model.Conf.AccessAuthCode {
session, err := cookieStore.Get(s.Request, "siyuan")
session, err := sessionStore.Get(s.Request, "siyuan")
if err != nil {
authOk = false
logging.LogErrorf("get cookie failed: %s", err)