Browse Source

fix:修复无salt值放行问题

master
刘子旺 7 months ago
parent
commit
a5b276116c
  1. 13
      godo/files/os.go
  2. 28
      godo/files/pwdfile.go

13
godo/files/os.go

@ -359,15 +359,16 @@ func IsHavePwd(pwd string) bool {
} }
// salt值优先从server端获取,如果没有则从header获取 // salt值优先从server端获取,如果没有则从header获取
func GetSalt(r *http.Request) string { func GetSalt(r *http.Request) (string, error) {
data, ishas := libs.GetConfig("salt") data, ishas := libs.GetConfig("salt")
salt := data.(string)
if ishas { if ishas {
return salt return data.(string), nil
} else { }
salt = r.Header.Get("salt") salt := r.Header.Get("salt")
return salt if salt != "" {
return salt, nil
} }
return "", fmt.Errorf("无法获取salt")
} }
// 获取加密标志 // 获取加密标志

28
godo/files/pwdfile.go

@ -13,13 +13,24 @@ func HandleReadFile(w http.ResponseWriter, r *http.Request) {
// 初始值 // 初始值
path := r.URL.Query().Get("path") path := r.URL.Query().Get("path")
fPwd := r.Header.Get("filePwd")
salt := GetSalt(r)
hasPwd, err := GetPwdFlag() hasPwd, err := GetPwdFlag()
if err != nil { if err != nil {
libs.HTTPError(w, http.StatusInternalServerError, err.Error()) libs.HTTPError(w, http.StatusInternalServerError, err.Error())
return return
} }
// 检查是否需要密码,如果需要,则从请求头中获取文件密码和盐值
var fPwd string
var salt string
if hasPwd {
fPwd = r.Header.Get("filePwd") // 获取文件密码
salt, err = GetSalt(r) // 获取盐值
if err != nil {
libs.HTTPError(w, http.StatusInternalServerError, err.Error()) // 处理获取盐值时的错误
return
}
}
// 校验文件路径 // 校验文件路径
if err := validateFilePath(path); err != nil { if err := validateFilePath(path); err != nil {
libs.HTTPError(w, http.StatusBadRequest, err.Error()) libs.HTTPError(w, http.StatusBadRequest, err.Error())
@ -79,7 +90,12 @@ func HandleReadFile(w http.ResponseWriter, r *http.Request) {
// 设置文件密码 // 设置文件密码
func HandleSetFilePwd(w http.ResponseWriter, r *http.Request) { func HandleSetFilePwd(w http.ResponseWriter, r *http.Request) {
fPwd := r.Header.Get("filepPwd") fPwd := r.Header.Get("filepPwd")
salt := GetSalt(r) salt, err := GetSalt(r) // 获取盐值
// 处理获取盐值时的错误
if err != nil {
libs.HTTPError(w, http.StatusInternalServerError, err.Error())
return
}
// 服务端再hash加密 // 服务端再hash加密
hashPwd := libs.HashPassword(fPwd, salt) hashPwd := libs.HashPassword(fPwd, salt)
@ -104,9 +120,9 @@ func HandleSetFilePwd(w http.ResponseWriter, r *http.Request) {
// 更改文件密码 // 更改文件密码
func HandleChangeFilePwd(w http.ResponseWriter, r *http.Request) { func HandleChangeFilePwd(w http.ResponseWriter, r *http.Request) {
filePwd := r.Header.Get("filePwd") filePwd := r.Header.Get("filePwd")
salt := GetSalt(r) salt, err := GetSalt(r) // 获取盐值
if filePwd == "" || salt == "" { if err != nil || filePwd == "" { // 检查错误和密码是否为空
libs.ErrorMsg(w, "密码为空") libs.ErrorMsg(w, "参数错误")
return return
} }
newPwd := libs.HashPassword(filePwd, salt) newPwd := libs.HashPassword(filePwd, salt)

Loading…
Cancel
Save