From a5b276116c28af51b8d2ee06e6cfdebf7a586d2a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=88=98=E5=AD=90=E6=97=BA?= <15039612+liu-ziwang123@user.noreply.gitee.com> Date: Thu, 31 Oct 2024 11:03:40 +0800 Subject: [PATCH] =?UTF-8?q?fix:=E4=BF=AE=E5=A4=8D=E6=97=A0salt=E5=80=BC?= =?UTF-8?q?=E6=94=BE=E8=A1=8C=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- godo/files/os.go | 13 +++++++------ godo/files/pwdfile.go | 28 ++++++++++++++++++++++------ 2 files changed, 29 insertions(+), 12 deletions(-) diff --git a/godo/files/os.go b/godo/files/os.go index 7fd6560..d35b024 100644 --- a/godo/files/os.go +++ b/godo/files/os.go @@ -359,15 +359,16 @@ func IsHavePwd(pwd string) bool { } // salt值优先从server端获取,如果没有则从header获取 -func GetSalt(r *http.Request) string { +func GetSalt(r *http.Request) (string, error) { data, ishas := libs.GetConfig("salt") - salt := data.(string) if ishas { - return salt - } else { - salt = r.Header.Get("salt") - return salt + return data.(string), nil + } + salt := r.Header.Get("salt") + if salt != "" { + return salt, nil } + return "", fmt.Errorf("无法获取salt") } // 获取加密标志 diff --git a/godo/files/pwdfile.go b/godo/files/pwdfile.go index e0bb6ba..6a8e095 100644 --- a/godo/files/pwdfile.go +++ b/godo/files/pwdfile.go @@ -13,13 +13,24 @@ func HandleReadFile(w http.ResponseWriter, r *http.Request) { // 初始值 path := r.URL.Query().Get("path") - fPwd := r.Header.Get("filePwd") - salt := GetSalt(r) hasPwd, err := GetPwdFlag() if err != nil { libs.HTTPError(w, http.StatusInternalServerError, err.Error()) return } + + // 检查是否需要密码,如果需要,则从请求头中获取文件密码和盐值 + var fPwd string + var salt string + if hasPwd { + fPwd = r.Header.Get("filePwd") // 获取文件密码 + salt, err = GetSalt(r) // 获取盐值 + if err != nil { + libs.HTTPError(w, http.StatusInternalServerError, err.Error()) // 处理获取盐值时的错误 + return + } + } + // 校验文件路径 if err := validateFilePath(path); err != nil { libs.HTTPError(w, http.StatusBadRequest, err.Error()) @@ -79,7 +90,12 @@ func HandleReadFile(w http.ResponseWriter, r *http.Request) { // 设置文件密码 func HandleSetFilePwd(w http.ResponseWriter, r *http.Request) { fPwd := r.Header.Get("filepPwd") - salt := GetSalt(r) + salt, err := GetSalt(r) // 获取盐值 + // 处理获取盐值时的错误 + if err != nil { + libs.HTTPError(w, http.StatusInternalServerError, err.Error()) + return + } // 服务端再hash加密 hashPwd := libs.HashPassword(fPwd, salt) @@ -104,9 +120,9 @@ func HandleSetFilePwd(w http.ResponseWriter, r *http.Request) { // 更改文件密码 func HandleChangeFilePwd(w http.ResponseWriter, r *http.Request) { filePwd := r.Header.Get("filePwd") - salt := GetSalt(r) - if filePwd == "" || salt == "" { - libs.ErrorMsg(w, "密码为空") + salt, err := GetSalt(r) // 获取盐值 + if err != nil || filePwd == "" { // 检查错误和密码是否为空 + libs.ErrorMsg(w, "参数错误") return } newPwd := libs.HashPassword(filePwd, salt)