mirror of
https://gitee.com/xmz7891/ykxmz.git
synced 2026-10-19 10:40:44 +00:00
🔐 修一个严重安全问题：管理密码被硬编码进公开仓库
== 问题 ==
relay/relay.py 第 138 行：
ADMIN_PASSWORD_DEFAULT = "@REVAedu120830"
而且 _tests/ 和 _build/ 下 11 个文件里也写着明文密码。
这个仓库是要推到**公开的 Gitee / EzHub** 的，等于：
git 仓库 = 公开的
管理页路径 /zhongzhuanzhan = 公开的（就写在代码里）
公网地址 = 公开的
密码 = 也在仓库里
**= 把管理台的门钥匙挂在门上。**
而且 git 历史删不掉 —— 只是在最新提交里删掉没用，
读过仓库的人已经从历史里拿到了。
== 修法 ==
### 1. 代码里不再有任何固定密码
relay.py 的 admin_password() 改成和 admin_key 一样的做法：
环境变量 RELAY_ADMIN_PASSWORD
-> data/admin_password.txt（600 权限，不进仓库）
-> 都没有就**首次启动随机生成**，写进那个文件并打印一次
这样全新部署的密码天然是随机的、每台不同。
### 2. 11 个文件里的明文密码清掉
_tests/ acceptance.py, test_relay_admin_login.py,
test_admin_batch_delete.py, test_admin_button.py,
test_admin_device_control.py, test_admin_js.py,
test_admin_netcheck.py
_build/ check_web.sh, verify_site_admin.sh,
split_site_admin2.py, test_response_headers.py
统一改成从 RELAY_ADMIN_PASSWORD 环境变量读，
拿不到就从部署的 data/admin_password.txt 读，
再拿不到就**跳过需要登录的用例**（而不是编个假密码硬试）。
### 3. 真机上的密码已经轮换
设备上的 data/admin_password.txt 已换成用户指定的新密码，
并实测：
✓ 新密码能登录（HTTP 302 + lr_admin cookie）
✓ 老密码登不上了
✓ 新密码无换行（printf 不带 \n，免得读出来多一个字符）
顺带：重启中断了 relay-stability 的 A/B 对照 A 组（69 个样本），
分析数据时会标注这一段。
== 新增测试 ==
_tests/test_admin_password_gen.py 验证六件事：
1. 全新部署会生成随机密码（不是那个老密码）
2. 密码长度 >= 12、纯字母数字
3. 用生成的密码能登录管理页
4. **老密码登不进去**
5. 重启后密码不变（从文件读回来）
6. **两次全新部署的密码不一样**（真的是随机的）
== 还没做的（等用户决定）==
git **历史**里还有那个密码。要彻底清掉得重写历史 + 强制推送，
这是个危险操作，按用户的规矩必须他确认之后才做。
而且**光删历史不够** —— 密码已经公开过，必须换（已换）。
This commit is contained in:
xmz7891
@@ -0,0 +1,362 @@
|
||||
2026-10-07 17:27:20 502 1407
|
||||
2026-10-07 17:27:36 200 921
|
||||
2026-10-07 17:27:52 200 1063
|
||||
2026-10-07 17:28:09 200 1491
|
||||
2026-10-07 17:28:27 200 2796
|
||||
2026-10-07 17:28:44 200 2277
|
||||
2026-10-07 17:29:00 200 974
|
||||
2026-10-07 17:29:17 200 1274
|
||||
2026-10-07 17:29:33 200 1265
|
||||
2026-10-07 17:29:50 200 1176
|
||||
2026-10-07 17:30:06 200 1062
|
||||
2026-10-07 17:30:35 200 14074
|
||||
2026-10-07 17:30:53 200 2637
|
||||
2026-10-07 17:31:09 200 1180
|
||||
2026-10-07 17:31:26 200 1524
|
||||
2026-10-07 17:31:42 530 862
|
||||
2026-10-07 17:31:58 200 1683
|
||||
2026-10-07 17:32:15 200 997
|
||||
2026-10-07 17:32:31 200 1530
|
||||
2026-10-07 17:32:48 200 1542
|
||||
2026-10-07 17:33:04 200 1257
|
||||
2026-10-07 17:33:21 200 1439
|
||||
2026-10-07 17:33:38 200 1526
|
||||
2026-10-07 17:33:55 200 2034
|
||||
2026-10-07 17:34:11 200 1438
|
||||
2026-10-07 17:34:28 200 1240
|
||||
2026-10-07 17:34:44 200 1509
|
||||
2026-10-07 17:35:01 200 1280
|
||||
2026-10-07 17:35:17 200 1240
|
||||
2026-10-07 17:35:34 200 1293
|
||||
2026-10-07 17:35:50 200 1018
|
||||
2026-10-07 17:36:06 200 1063
|
||||
2026-10-07 17:36:22 200 1033
|
||||
2026-10-07 17:36:40 200 2410
|
||||
2026-10-07 17:36:56 200 1206
|
||||
2026-10-07 17:37:13 200 1503
|
||||
2026-10-07 17:37:29 200 1152
|
||||
2026-10-07 17:37:47 200 2442
|
||||
2026-10-07 17:38:03 200 1267
|
||||
2026-10-07 17:38:20 200 1555
|
||||
2026-10-07 17:38:36 200 1187
|
||||
2026-10-07 17:38:54 200 2524
|
||||
2026-10-07 17:39:10 200 973
|
||||
2026-10-07 17:39:26 200 1444
|
||||
2026-10-07 17:39:43 200 1285
|
||||
2026-10-07 17:40:00 200 1600
|
||||
2026-10-07 17:40:16 200 982
|
||||
2026-10-07 17:40:45 200 14272
|
||||
2026-10-07 17:41:01 200 1264
|
||||
2026-10-07 17:41:18 200 1235
|
||||
2026-10-07 17:41:35 200 1482
|
||||
2026-10-07 17:41:51 200 1471
|
||||
2026-10-07 17:42:08 200 1483
|
||||
2026-10-07 17:42:37 200 13940
|
||||
2026-10-07 17:42:53 200 1073
|
||||
2026-10-07 17:43:09 200 1093
|
||||
2026-10-07 17:43:26 200 1472
|
||||
2026-10-07 17:43:43 200 1576
|
||||
2026-10-07 17:43:59 200 1453
|
||||
2026-10-07 17:44:16 200 1984
|
||||
2026-10-07 17:44:33 200 1237
|
||||
2026-10-07 17:44:49 200 924
|
||||
2026-10-07 17:45:06 200 1936
|
||||
2026-10-07 17:45:23 200 1750
|
||||
2026-10-07 17:45:39 200 1039
|
||||
2026-10-07 17:45:55 200 1033
|
||||
2026-10-07 17:46:11 200 1061
|
||||
2026-10-07 17:46:27 200 1083
|
||||
2026-10-07 17:46:44 200 847
|
||||
2026-10-07 17:47:00 200 972
|
||||
2026-10-07 17:47:16 200 1055
|
||||
2026-10-07 17:47:32 200 1219
|
||||
2026-10-07 17:47:48 200 1034
|
||||
2026-10-07 17:48:05 200 1203
|
||||
2026-10-07 17:48:21 200 1142
|
||||
2026-10-07 17:48:37 200 1235
|
||||
2026-10-07 17:48:53 200 988
|
||||
2026-10-07 17:49:10 200 1636
|
||||
2026-10-07 17:49:26 200 998
|
||||
2026-10-07 17:49:43 200 1226
|
||||
2026-10-07 17:49:59 200 849
|
||||
2026-10-07 17:50:15 200 966
|
||||
2026-10-07 17:50:31 200 1476
|
||||
2026-10-07 17:50:48 200 1336
|
||||
2026-10-07 17:51:05 200 1452
|
||||
2026-10-07 17:51:21 200 1017
|
||||
2026-10-07 17:51:50 200 13815
|
||||
2026-10-07 17:52:06 200 1437
|
||||
2026-10-07 17:52:23 200 1215
|
||||
2026-10-07 17:52:39 200 1065
|
||||
2026-10-07 17:53:03 200 9538
|
||||
2026-10-07 17:53:20 200 1556
|
||||
2026-10-07 17:53:36 200 1132
|
||||
2026-10-07 17:53:53 200 1548
|
||||
2026-10-07 17:54:09 200 1243
|
||||
2026-10-07 17:54:26 200 1499
|
||||
2026-10-07 17:54:43 200 1516
|
||||
2026-10-07 17:54:59 200 1491
|
||||
2026-10-07 17:55:16 200 1492
|
||||
2026-10-07 17:55:33 200 1665
|
||||
2026-10-07 17:55:49 200 1227
|
||||
2026-10-07 17:56:06 200 1531
|
||||
2026-10-07 17:56:46 000 25000
|
||||
2026-10-07 17:57:06 502 4652
|
||||
2026-10-07 17:57:22 200 1475
|
||||
2026-10-07 17:57:39 200 1545
|
||||
2026-10-07 17:57:55 200 1116
|
||||
2026-10-07 17:58:11 200 1026
|
||||
2026-10-07 17:58:28 200 1544
|
||||
2026-10-07 17:58:44 200 1038
|
||||
2026-10-07 17:59:00 200 992
|
||||
2026-10-07 17:59:17 200 988
|
||||
2026-10-07 17:59:34 200 1823
|
||||
2026-10-07 17:59:50 200 1004
|
||||
2026-10-07 18:00:06 200 1236
|
||||
2026-10-07 18:00:35 200 14105
|
||||
2026-10-07 18:01:05 200 14208
|
||||
2026-10-07 18:01:21 200 1597
|
||||
2026-10-07 18:01:38 200 1531
|
||||
2026-10-07 18:01:56 200 2613
|
||||
2026-10-07 18:02:13 200 1563
|
||||
2026-10-07 18:02:29 200 1509
|
||||
2026-10-07 18:02:46 200 1521
|
||||
2026-10-07 18:03:03 200 1492
|
||||
2026-10-07 18:03:19 200 1546
|
||||
2026-10-07 18:03:36 200 1215
|
||||
2026-10-07 18:03:52 200 1579
|
||||
2026-10-07 18:04:09 200 1592
|
||||
2026-10-07 18:04:26 200 2187
|
||||
2026-10-07 18:04:43 200 1001
|
||||
2026-10-07 18:04:59 200 1600
|
||||
2026-10-07 18:05:16 200 1116
|
||||
2026-10-07 18:05:32 200 991
|
||||
2026-10-07 18:05:49 200 1986
|
||||
2026-10-07 18:06:05 200 1005
|
||||
2026-10-07 18:06:21 200 992
|
||||
2026-10-07 18:06:37 200 1080
|
||||
2026-10-07 18:06:54 200 1066
|
||||
2026-10-07 18:07:10 200 1463
|
||||
2026-10-07 18:07:27 200 1210
|
||||
2026-10-07 18:07:43 200 1408
|
||||
2026-10-07 18:07:59 200 1024
|
||||
2026-10-07 18:08:16 200 1280
|
||||
2026-10-07 18:08:32 200 1300
|
||||
2026-10-07 18:08:48 200 992
|
||||
2026-10-07 18:09:04 200 954
|
||||
2026-10-07 18:09:20 200 987
|
||||
2026-10-07 18:09:37 200 1023
|
||||
2026-10-07 18:09:53 200 1256
|
||||
2026-10-07 18:10:09 200 1386
|
||||
2026-10-07 18:10:39 200 13955
|
||||
2026-10-07 18:10:55 200 1653
|
||||
2026-10-07 18:11:12 200 1824
|
||||
2026-10-07 18:11:29 200 1247
|
||||
2026-10-07 18:11:45 200 1274
|
||||
2026-10-07 18:12:02 200 1539
|
||||
2026-10-07 18:12:18 200 1335
|
||||
2026-10-07 18:12:35 200 1530
|
||||
2026-10-07 18:13:04 200 13994
|
||||
2026-10-07 18:13:21 200 1454
|
||||
2026-10-07 18:13:37 200 1591
|
||||
2026-10-07 18:13:54 200 1030
|
||||
2026-10-07 18:14:10 200 829
|
||||
2026-10-07 18:14:26 200 1085
|
||||
2026-10-07 18:14:42 200 1217
|
||||
2026-10-07 18:14:58 200 1134
|
||||
2026-10-07 18:15:15 200 934
|
||||
2026-10-07 18:15:31 200 1125
|
||||
2026-10-07 18:15:47 200 1089
|
||||
2026-10-07 18:16:03 200 1026
|
||||
2026-10-07 18:16:20 200 1488
|
||||
2026-10-07 18:16:36 200 1477
|
||||
2026-10-07 18:16:53 200 1367
|
||||
2026-10-07 18:17:10 200 1488
|
||||
2026-10-07 18:17:26 200 1003
|
||||
2026-10-07 18:17:42 200 1038
|
||||
2026-10-07 18:17:58 200 981
|
||||
2026-10-07 18:18:15 200 1471
|
||||
2026-10-07 18:18:31 200 1255
|
||||
2026-10-07 18:18:47 200 1233
|
||||
2026-10-07 18:19:04 200 1439
|
||||
2026-10-07 18:19:20 200 1008
|
||||
2026-10-07 18:19:36 200 1023
|
||||
2026-10-07 18:19:52 200 1049
|
||||
2026-10-07 18:20:10 200 2696
|
||||
2026-10-07 18:20:26 200 985
|
||||
2026-10-07 18:20:56 200 14428
|
||||
2026-10-07 18:21:13 200 1632
|
||||
2026-10-07 18:21:30 200 1731
|
||||
2026-10-07 18:21:46 200 1160
|
||||
2026-10-07 18:22:03 200 1462
|
||||
2026-10-07 18:22:19 200 1455
|
||||
2026-10-07 18:22:48 200 14144
|
||||
2026-10-07 18:23:05 200 1596
|
||||
2026-10-07 18:23:21 200 1055
|
||||
2026-10-07 18:23:38 200 987
|
||||
2026-10-07 18:23:54 200 1048
|
||||
2026-10-07 18:24:10 200 940
|
||||
2026-10-07 18:24:26 200 1256
|
||||
2026-10-07 18:24:44 200 2653
|
||||
2026-10-07 18:25:01 200 1705
|
||||
2026-10-07 18:25:17 200 1408
|
||||
2026-10-07 18:25:34 200 1557
|
||||
2026-10-07 18:25:51 200 1660
|
||||
2026-10-07 18:26:07 200 1005
|
||||
2026-10-07 18:26:23 200 1015
|
||||
2026-10-07 18:26:39 200 1079
|
||||
2026-10-07 18:26:56 200 1542
|
||||
2026-10-07 18:27:13 200 1534
|
||||
2026-10-07 18:27:29 200 1196
|
||||
2026-10-07 18:27:45 200 1163
|
||||
2026-10-07 18:28:02 200 1239
|
||||
2026-10-07 18:28:18 200 1232
|
||||
2026-10-07 18:28:35 200 1560
|
||||
2026-10-07 18:28:51 200 1267
|
||||
2026-10-07 18:29:08 200 1328
|
||||
2026-10-07 18:29:24 200 1070
|
||||
2026-10-07 18:29:40 200 1048
|
||||
2026-10-07 18:30:09 200 13901
|
||||
2026-10-07 18:30:26 200 1257
|
||||
2026-10-07 18:30:42 200 1670
|
||||
2026-10-07 18:30:59 200 1488
|
||||
2026-10-07 18:31:16 200 1716
|
||||
2026-10-07 18:31:33 200 1518
|
||||
2026-10-07 18:31:49 200 1522
|
||||
2026-10-07 18:32:06 200 1537
|
||||
2026-10-07 18:32:23 200 1513
|
||||
2026-10-07 18:32:39 200 1547
|
||||
2026-10-07 18:32:56 200 1237
|
||||
2026-10-07 18:33:12 200 1378
|
||||
2026-10-07 18:33:29 200 1255
|
||||
2026-10-07 18:33:45 200 1212
|
||||
2026-10-07 18:34:02 200 2046
|
||||
2026-10-07 18:34:19 200 1424
|
||||
2026-10-07 18:34:35 200 1406
|
||||
2026-10-07 18:34:52 200 1279
|
||||
2026-10-07 18:35:08 200 974
|
||||
2026-10-07 18:35:24 200 957
|
||||
2026-10-07 18:35:40 200 937
|
||||
2026-10-07 18:35:56 200 903
|
||||
2026-10-07 18:36:12 200 1223
|
||||
2026-10-07 18:36:29 200 1456
|
||||
2026-10-07 18:36:45 200 1183
|
||||
2026-10-07 18:37:01 200 1076
|
||||
2026-10-07 18:37:18 200 1182
|
||||
2026-10-07 18:37:34 200 937
|
||||
2026-10-07 18:37:50 200 1144
|
||||
2026-10-07 18:38:06 200 1218
|
||||
2026-10-07 18:38:23 200 1185
|
||||
2026-10-07 18:38:39 200 1028
|
||||
2026-10-07 18:38:55 200 969
|
||||
2026-10-07 18:39:11 200 933
|
||||
2026-10-07 18:39:28 200 1706
|
||||
2026-10-07 18:39:45 200 2392
|
||||
2026-10-07 18:40:02 200 1735
|
||||
2026-10-07 18:40:31 200 13866
|
||||
2026-10-07 18:40:48 200 1531
|
||||
2026-10-07 18:41:05 200 1282
|
||||
2026-10-07 18:41:34 200 14107
|
||||
2026-10-07 18:41:50 200 906
|
||||
2026-10-07 18:42:19 200 14242
|
||||
2026-10-07 18:42:36 200 1260
|
||||
2026-10-07 18:42:52 200 1254
|
||||
2026-10-07 18:43:08 200 1260
|
||||
2026-10-07 18:43:25 200 1021
|
||||
2026-10-07 18:43:41 200 829
|
||||
2026-10-07 18:43:57 200 1012
|
||||
2026-10-07 18:44:13 200 1613
|
||||
2026-10-07 18:44:30 200 1556
|
||||
2026-10-07 18:44:47 200 1422
|
||||
2026-10-07 18:45:04 200 2419
|
||||
2026-10-07 18:45:20 200 978
|
||||
2026-10-07 18:45:37 200 1787
|
||||
2026-10-07 18:45:53 200 968
|
||||
2026-10-07 18:46:10 200 1652
|
||||
2026-10-07 18:46:27 200 1504
|
||||
2026-10-07 18:46:43 200 944
|
||||
2026-10-07 18:46:59 200 1006
|
||||
2026-10-07 18:47:15 200 968
|
||||
2026-10-07 18:47:31 200 963
|
||||
2026-10-07 18:47:48 200 1245
|
||||
2026-10-07 18:48:04 200 1551
|
||||
2026-10-07 18:48:21 200 1194
|
||||
2026-10-07 18:48:37 200 941
|
||||
2026-10-07 18:48:53 200 1010
|
||||
2026-10-07 18:49:09 200 1051
|
||||
2026-10-07 18:49:25 200 1205
|
||||
2026-10-07 18:49:42 200 1372
|
||||
2026-10-07 18:49:58 200 1310
|
||||
2026-10-07 18:50:28 200 14115
|
||||
2026-10-07 18:50:45 200 2386
|
||||
2026-10-07 18:51:02 200 1415
|
||||
2026-10-07 18:51:18 200 1195
|
||||
2026-10-07 18:51:34 200 1230
|
||||
2026-10-07 18:51:51 200 1333
|
||||
2026-10-07 18:52:20 200 13900
|
||||
2026-10-07 18:52:36 200 1245
|
||||
2026-10-07 18:52:53 200 1218
|
||||
2026-10-07 18:53:09 200 963
|
||||
2026-10-07 18:53:26 200 1529
|
||||
2026-10-07 18:53:42 200 1053
|
||||
2026-10-07 18:53:58 200 1069
|
||||
2026-10-07 18:54:14 200 1012
|
||||
2026-10-07 18:54:31 200 1846
|
||||
2026-10-07 18:54:48 200 1324
|
||||
2026-10-07 18:55:04 200 1550
|
||||
2026-10-07 18:55:20 200 1008
|
||||
2026-10-07 18:55:37 200 1066
|
||||
2026-10-07 18:55:53 200 1065
|
||||
2026-10-07 18:56:09 200 1515
|
||||
2026-10-07 18:56:26 200 988
|
||||
2026-10-07 18:56:42 200 1003
|
||||
2026-10-07 18:56:58 200 1077
|
||||
2026-10-07 18:57:15 200 2306
|
||||
2026-10-07 18:57:33 200 2405
|
||||
2026-10-07 18:57:50 200 1549
|
||||
2026-10-07 18:58:07 200 2098
|
||||
2026-10-07 18:58:23 200 970
|
||||
2026-10-07 18:58:39 200 1089
|
||||
2026-10-07 18:58:56 200 1596
|
||||
2026-10-07 18:59:13 200 1906
|
||||
2026-10-07 18:59:29 200 1012
|
||||
2026-10-07 18:59:46 200 1588
|
||||
2026-10-07 19:00:02 200 1317
|
||||
2026-10-07 19:00:20 502 2101
|
||||
2026-10-07 19:00:36 200 1627
|
||||
2026-10-07 19:00:54 200 2006
|
||||
2026-10-07 19:01:23 200 14099
|
||||
2026-10-07 19:01:39 200 1599
|
||||
2026-10-07 19:01:56 200 1539
|
||||
2026-10-07 19:02:26 200 14438
|
||||
2026-10-07 19:02:42 200 1264
|
||||
2026-10-07 19:03:06 200 8534
|
||||
2026-10-07 19:03:22 200 1311
|
||||
2026-10-07 19:03:38 200 971
|
||||
2026-10-07 19:03:55 200 1676
|
||||
2026-10-07 19:04:12 200 1795
|
||||
2026-10-07 19:04:29 200 1552
|
||||
2026-10-07 19:04:45 200 994
|
||||
2026-10-07 19:05:03 200 3017
|
||||
2026-10-07 19:05:19 200 1048
|
||||
2026-10-07 19:05:36 200 1253
|
||||
2026-10-07 19:05:52 200 1607
|
||||
2026-10-07 19:06:10 200 2535
|
||||
2026-10-07 19:06:26 200 1126
|
||||
2026-10-07 19:06:43 200 1116
|
||||
2026-10-07 19:06:59 200 1361
|
||||
2026-10-07 19:07:16 200 1255
|
||||
2026-10-07 19:07:32 200 1161
|
||||
2026-10-07 19:07:49 200 2006
|
||||
2026-10-07 19:08:06 200 1564
|
||||
2026-10-07 19:08:22 200 1161
|
||||
2026-10-07 19:08:39 200 1480
|
||||
2026-10-07 19:08:55 200 998
|
||||
2026-10-07 19:09:11 200 993
|
||||
2026-10-07 19:09:27 200 981
|
||||
2026-10-07 19:09:44 200 1409
|
||||
2026-10-07 19:10:00 200 1522
|
||||
2026-10-07 19:10:17 200 1633
|
||||
2026-10-07 19:10:46 200 14107
|
||||
2026-10-07 19:11:04 200 2563
|
||||
|
||||
|
Reference in New Issue
Block a user