mirror of
https://gitee.com/xmz7891/ykxmz.git
synced 2026-10-18 10:10:43 +00:00
修管理页 Content-Type（浏览器显示成一屏源码）
用户截图：打开 relay.xxmxxs.top/zhongzhuanzhan 看到的**不是页面， 而是整页 HTML 源码**。 根因：_send() 的 content_type 参数默认是 application/json， 我重做管理页时调它没传 text/html —— 浏览器按 JSON/纯文本处理， 就把 HTML 原样显示了。 ⚠ 更该反省的是：**我当时没发现。** 验证脚本只看了 HTTP 200 和字节数，两个都对，就以为没问题。 200 不等于页面能看 —— 响应头也得看。 顺手修的第二个问题： HEAD 请求一律返回 501 Unsupported method（没实现 do_HEAD）。 浏览器用 GET 所以页面照开，但 Cloudflare 健康检查、 很多监控/代理探测都用 HEAD，curl -I 也是。 补了 do_HEAD：按路径算出类型和长度，只回头不回体。 新增测试 _build/test_response_headers.py（9 项）： * HEAD 各路径不能是 501 * 官网/管理页 Content-Type 必须是 text/html，不能是 json * favicon、产品截图必须是 image/* 并加进全量套件（阶段 3b6）。 验证：该测试 9/9 通过；全量套件 33 个阶段全部通过。
This commit is contained in:
xmz7891
@@ -1,17 +0,0 @@
|
||||
修管理页测试的引号敏感 + 补 netPanel id
|
||||
|
||||
重做管理页时把 HTML 从 class=pick（无引号）改成了
|
||||
class="pick"（标准写法），但测试里写死了无引号形式，
|
||||
于是 5 个断言集体误报失败。
|
||||
|
||||
HTML 两种写法都合法，测试不该关心这个 ——
|
||||
给两个测试加了 _has()，带不带引号都认。
|
||||
|
||||
另外给新管理页的体检卡补回 id=netPanel（语义合理，
|
||||
也顺手让测试钩子还在）。
|
||||
|
||||
同时删掉 _build/_missing_tail.py（恢复事故时的临时文件，
|
||||
静态检查把它当成真模块查，报了 8 个 undefined name）。
|
||||
|
||||
验证：管理页网络体检 15/15、中转批量删除 24/24、
|
||||
全局 32 个阶段全部通过。
|
||||
@@ -0,0 +1 @@
|
||||
gBp85DSPF9vKr12jTb6XIPt3
|
||||
@@ -0,0 +1 @@
|
||||
@REVAedu120830
|
||||
@@ -0,0 +1,106 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
r'''把响应头检查加进套件，并提交这次的修复。'''
|
||||
from __future__ import annotations
|
||||
|
||||
import ast
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
ROOT = Path(r"C:\Users\shu\Desktop\deepseekagent\LanRemote")
|
||||
VERIFY = ROOT / "_tests" / "verify_all.ps1"
|
||||
GIT = r"C:\Program Files\Git\bin\git.exe"
|
||||
BOM = b"\xef\xbb\xbf"
|
||||
|
||||
STAGE = '''
|
||||
# ---------------------------------------------------------------- 3b6
|
||||
Banner "3b6/7 网页响应头（Content-Type / HEAD）"
|
||||
# 踩过的坑：重做管理页时 _send() 没传 content_type，
|
||||
# 默认成了 application/json —— 浏览器把整页 HTML 当纯文本显示，
|
||||
# 用户看到的是一屏源码。
|
||||
# 更糟的是当时没发现：只验了 HTTP 200 和字节数，两个都对。
|
||||
# **200 不等于页面能看。**
|
||||
$stageOut = & python (Join-Path $root "_build\\test_response_headers.py") 2>&1
|
||||
Show-Fails $stageOut
|
||||
Record "网页响应头" ($LASTEXITCODE -eq 0)
|
||||
|
||||
'''
|
||||
|
||||
MSG = """修管理页 Content-Type（浏览器显示成一屏源码）
|
||||
|
||||
用户截图：打开 relay.xxmxxs.top/zhongzhuanzhan 看到的**不是页面，
|
||||
而是整页 HTML 源码**。
|
||||
|
||||
根因：_send() 的 content_type 参数默认是 application/json，
|
||||
我重做管理页时调它没传 text/html —— 浏览器按 JSON/纯文本处理，
|
||||
就把 HTML 原样显示了。
|
||||
|
||||
⚠ 更该反省的是：**我当时没发现。**
|
||||
验证脚本只看了 HTTP 200 和字节数，两个都对，就以为没问题。
|
||||
200 不等于页面能看 —— 响应头也得看。
|
||||
|
||||
顺手修的第二个问题：
|
||||
HEAD 请求一律返回 501 Unsupported method（没实现 do_HEAD）。
|
||||
浏览器用 GET 所以页面照开，但 Cloudflare 健康检查、
|
||||
很多监控/代理探测都用 HEAD，curl -I 也是。
|
||||
补了 do_HEAD：按路径算出类型和长度，只回头不回体。
|
||||
|
||||
新增测试 _build/test_response_headers.py（9 项）：
|
||||
* HEAD 各路径不能是 501
|
||||
* 官网/管理页 Content-Type 必须是 text/html，不能是 json
|
||||
* favicon、产品截图必须是 image/*
|
||||
并加进全量套件（阶段 3b6）。
|
||||
|
||||
验证：该测试 9/9 通过；全量套件 33 个阶段全部通过。
|
||||
"""
|
||||
|
||||
|
||||
def add_stage() -> None:
|
||||
raw = VERIFY.read_bytes()
|
||||
text = raw.decode("utf-8-sig")
|
||||
if "test_response_headers" in text:
|
||||
print(" 套件里已有响应头阶段")
|
||||
return
|
||||
anchor = "# ---------------------------------------------------------------- 3c"
|
||||
if anchor not in text:
|
||||
anchor = "# ---------------------------------------------------------------- 4"
|
||||
if anchor not in text:
|
||||
print(" [失败] 找不到锚点")
|
||||
return
|
||||
text = text.replace(anchor, STAGE.lstrip("\n") + anchor, 1)
|
||||
VERIFY.write_bytes(BOM + text.replace("\r\n", "\n").encode("utf-8"))
|
||||
print(" 已加「网页响应头」阶段")
|
||||
|
||||
|
||||
def commit() -> None:
|
||||
print()
|
||||
subprocess.run([GIT, "add", "-A"], cwd=str(ROOT), check=False)
|
||||
msg_file = ROOT / "_build" / "_c9.txt"
|
||||
msg_file.write_bytes(MSG.encode("utf-8"))
|
||||
r = subprocess.run([GIT, "commit", "-q", "-F", str(msg_file)],
|
||||
cwd=str(ROOT), capture_output=True, text=True,
|
||||
encoding="utf-8", errors="replace")
|
||||
msg_file.unlink(missing_ok=True)
|
||||
print(" commit exit=%s" % r.returncode)
|
||||
show = subprocess.run([GIT, "log", "--oneline", "-1"], cwd=str(ROOT),
|
||||
capture_output=True, text=True, encoding="utf-8",
|
||||
errors="replace")
|
||||
print(" " + (show.stdout or "").strip())
|
||||
env = dict(os.environ)
|
||||
env["GIT_SSH_COMMAND"] = r'"C:\Program Files\Git\usr\bin\ssh.exe"'
|
||||
push = subprocess.run([GIT, "push", "origin", "main"], cwd=str(ROOT),
|
||||
capture_output=True, text=True, encoding="utf-8",
|
||||
errors="replace", env=env)
|
||||
for line in (push.stderr or push.stdout or "").strip().splitlines()[-2:]:
|
||||
print(" " + line)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
add_stage()
|
||||
commit()
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,43 @@
|
||||
#!/bin/bash
|
||||
# 验证响应头 —— 上次改完只看了状态码和字节数，没看 Content-Type，
|
||||
# 结果页面在浏览器里是"一屏源码"。
|
||||
set -u
|
||||
|
||||
BASE=http://127.0.0.1:8080
|
||||
PASS=$(cat /root/lanremote-relay/data/admin_password.txt 2>/dev/null)
|
||||
|
||||
curl -s -c /tmp/ck.txt -o /dev/null --max-time 15 \
|
||||
-d "username=xmz7891&password=$PASS" "$BASE/admin/login"
|
||||
|
||||
echo " 管理页响应头:"
|
||||
curl -sI -b /tmp/ck.txt --max-time 15 "$BASE/zhongzhuanzhan" \
|
||||
| head -4 | sed 's/^/ /'
|
||||
|
||||
echo
|
||||
echo " 官网响应头:"
|
||||
curl -sI --max-time 15 "$BASE/" | head -3 | sed 's/^/ /'
|
||||
|
||||
echo
|
||||
echo " 产品截图响应头:"
|
||||
curl -sI --max-time 15 "$BASE/shot/pc-main.png" | head -3 | sed 's/^/ /'
|
||||
|
||||
echo
|
||||
echo " 登录页响应头:"
|
||||
curl -sI --max-time 15 "$BASE/zhongzhuanzhan" | head -3 | sed 's/^/ /'
|
||||
|
||||
echo
|
||||
echo " 判断:"
|
||||
admin_ct=$(curl -sI -b /tmp/ck.txt --max-time 15 "$BASE/zhongzhuanzhan" \
|
||||
| grep -i '^content-type' | tr -d '\r')
|
||||
if echo "$admin_ct" | grep -qi 'text/html'; then
|
||||
echo " ✓ 管理页是 text/html"
|
||||
else
|
||||
echo " ✗ 管理页 Content-Type 不对：$admin_ct"
|
||||
fi
|
||||
|
||||
site_ct=$(curl -sI --max-time 15 "$BASE/" | grep -i '^content-type' | tr -d '\r')
|
||||
if echo "$site_ct" | grep -qi 'text/html'; then
|
||||
echo " ✓ 官网是 text/html"
|
||||
else
|
||||
echo " ✗ 官网 Content-Type 不对：$site_ct"
|
||||
fi
|
||||
@@ -0,0 +1,178 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
r'''加一个"响应头"检查，并把这次的坑记下来。
|
||||
|
||||
踩的坑：
|
||||
重做管理页时，_send() 的 content_type 默认是 application/json，
|
||||
我调它的时候没传 text/html —— 结果浏览器把整页 HTML
|
||||
当纯文本显示，用户看到的是一屏源码。
|
||||
|
||||
更糟的是**我当时没发现**：验证脚本只看了 HTTP 200 和字节数，
|
||||
两个都对，就以为没问题了。**200 不等于页面能看。**
|
||||
|
||||
所以这个检查必须看响应头，不能只看状态码。
|
||||
顺便也发现 HEAD 请求返回 501（没实现 do_HEAD），一起补了。
|
||||
'''
|
||||
from __future__ import annotations
|
||||
|
||||
import ast
|
||||
import json
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
import urllib.error
|
||||
import urllib.request
|
||||
from pathlib import Path
|
||||
|
||||
ROOT = Path(r"C:\Users\shu\Desktop\deepseekagent\LanRemote")
|
||||
PORT = 8944
|
||||
PASS = "@REVAedu120830"
|
||||
|
||||
|
||||
def wait_port(seconds: float = 12.0) -> bool:
|
||||
deadline = time.time() + seconds
|
||||
while time.time() < deadline:
|
||||
try:
|
||||
with urllib.request.urlopen(
|
||||
"http://127.0.0.1:%d/v1/health" % PORT, timeout=2):
|
||||
return True
|
||||
except Exception: # noqa: BLE001
|
||||
time.sleep(0.5)
|
||||
return False
|
||||
|
||||
|
||||
def head(path: str, cookie: str = "") -> dict:
|
||||
"""发一个 HEAD，取回响应头。"""
|
||||
req = urllib.request.Request("http://127.0.0.1:%d%s" % (PORT, path),
|
||||
method="HEAD")
|
||||
if cookie:
|
||||
req.add_header("Cookie", cookie)
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=8) as resp:
|
||||
return {"status": resp.status,
|
||||
"ctype": resp.headers.get("Content-Type", ""),
|
||||
"len": resp.headers.get("Content-Length", "")}
|
||||
except urllib.error.HTTPError as exc:
|
||||
return {"status": exc.code,
|
||||
"ctype": exc.headers.get("Content-Type", ""), "len": ""}
|
||||
except Exception as exc: # noqa: BLE001
|
||||
return {"status": 0, "ctype": "", "len": str(exc)}
|
||||
|
||||
|
||||
def login() -> str:
|
||||
"""登录拿 cookie。
|
||||
|
||||
用 http.cookiejar 而不是手工读 Set-Cookie ——
|
||||
/admin/login 会 302 跳转，urllib 默认跟着跳，
|
||||
Set-Cookie 头在第一个响应上就被丢掉了，手工读永远是空。
|
||||
cookiejar 会把中间那次的 cookie 存下来。
|
||||
"""
|
||||
import http.cookiejar
|
||||
jar = http.cookiejar.CookieJar()
|
||||
opener = urllib.request.build_opener(
|
||||
urllib.request.HTTPCookieProcessor(jar))
|
||||
body = ("username=xmz7891&password=" + PASS).encode()
|
||||
req = urllib.request.Request(
|
||||
"http://127.0.0.1:%d/admin/login" % PORT, data=body, method="POST")
|
||||
req.add_header("Content-Type", "application/x-www-form-urlencoded")
|
||||
try:
|
||||
opener.open(req, timeout=8).read()
|
||||
except Exception: # noqa: BLE001
|
||||
pass
|
||||
for cookie in jar:
|
||||
if cookie.name == "lr_admin":
|
||||
return "%s=%s" % (cookie.name, cookie.value)
|
||||
return ""
|
||||
|
||||
|
||||
def main() -> int:
|
||||
env = dict(__import__("os").environ)
|
||||
env["RELAY_PORT"] = str(PORT)
|
||||
env["RELAY_ADMIN_PASSWORD"] = PASS
|
||||
data = ROOT / "_build" / "_hdr_data"
|
||||
data.mkdir(parents=True, exist_ok=True)
|
||||
env["RELAY_DATA"] = str(data)
|
||||
|
||||
# 中转把管理密码放在 DATA_DIR/data/admin_password.txt，
|
||||
# 没有这个文件就用内置默认值。为了让测试不依赖默认值，
|
||||
# 这里显式写一份，保证登录能成。
|
||||
auth_dir = data / "data"
|
||||
auth_dir.mkdir(parents=True, exist_ok=True)
|
||||
(auth_dir / "admin_password.txt").write_text(PASS, encoding="utf-8")
|
||||
|
||||
# /shot/ 路由是从 relay.py 所在目录找 site_shots/。
|
||||
# 仓库里那张图在 _build/site_shots/，这里拷一份过去，
|
||||
# 否则那条断言会因为"文件不存在"而误报。
|
||||
shot_src = ROOT / "_build" / "site_shots" / "pc-main.png"
|
||||
shot_dst = ROOT / "relay" / "site_shots" / "pc-main.png"
|
||||
if shot_src.is_file():
|
||||
shot_dst.parent.mkdir(parents=True, exist_ok=True)
|
||||
if not shot_dst.is_file():
|
||||
shot_dst.write_bytes(shot_src.read_bytes())
|
||||
|
||||
print(" 启动中转（端口 %d）" % PORT)
|
||||
proc = subprocess.Popen(
|
||||
[sys.executable, "relay.py"], cwd=str(ROOT / "relay"), env=env,
|
||||
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
||||
passed = failed = 0
|
||||
|
||||
def check(name, ok, detail=""):
|
||||
nonlocal passed, failed
|
||||
if ok:
|
||||
passed += 1
|
||||
print(" [PASS] " + name)
|
||||
else:
|
||||
failed += 1
|
||||
print(" [FAIL] " + name + " " + str(detail))
|
||||
|
||||
try:
|
||||
if not wait_port():
|
||||
print(" [失败] 中转没起来")
|
||||
return 1
|
||||
|
||||
print()
|
||||
print(" 一、HEAD 请求要能用（原来一律 501）")
|
||||
for path in ("/", "/v1/health", "/favicon.ico"):
|
||||
info = head(path)
|
||||
check("HEAD %s 不是 501" % path, info["status"] != 501,
|
||||
info["status"])
|
||||
|
||||
print()
|
||||
print(" 二、Content-Type 必须是 text/html（否则浏览器显示源码）")
|
||||
site = head("/")
|
||||
check("官网 Content-Type 是 text/html",
|
||||
"text/html" in site["ctype"], site["ctype"])
|
||||
|
||||
cookie = login()
|
||||
check("登录拿到 cookie", bool(cookie), cookie or "（没拿到）")
|
||||
admin = head("/zhongzhuanzhan", cookie)
|
||||
check("管理页 Content-Type 是 text/html",
|
||||
"text/html" in admin["ctype"],
|
||||
admin["ctype"] or "（空）")
|
||||
check("管理页不是 application/json",
|
||||
"json" not in admin["ctype"].lower(), admin["ctype"])
|
||||
|
||||
print()
|
||||
print(" 三、其它资源的类型")
|
||||
icon = head("/favicon.ico")
|
||||
check("favicon 是 image/*", "image" in icon["ctype"], icon["ctype"])
|
||||
if shot_dst.is_file():
|
||||
shot = head("/shot/pc-main.png")
|
||||
check("截图是 image/*", "image" in shot["ctype"], shot["ctype"])
|
||||
else:
|
||||
print(" [跳过] 截图类型（本地没有 site_shots/pc-main.png）")
|
||||
|
||||
finally:
|
||||
proc.terminate()
|
||||
try:
|
||||
proc.wait(timeout=8)
|
||||
except subprocess.TimeoutExpired:
|
||||
proc.kill()
|
||||
|
||||
print()
|
||||
print("=" * 54)
|
||||
print(" 通过 %d 项，失败 %d 项" % (passed, failed))
|
||||
return 0 if failed == 0 else 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.7 MiB After Width: | Height: | Size: 1.7 MiB |
@@ -422,6 +422,17 @@ $stageOut = & python (Join-Path $root "_build\test_installer_cycle.py") 2>&1
|
||||
Show-Fails $stageOut
|
||||
Record "安装包完整周期" ($LASTEXITCODE -eq 0)
|
||||
|
||||
# ---------------------------------------------------------------- 3b6
|
||||
Banner "3b6/7 网页响应头（Content-Type / HEAD）"
|
||||
# 踩过的坑：重做管理页时 _send() 没传 content_type，
|
||||
# 默认成了 application/json —— 浏览器把整页 HTML 当纯文本显示，
|
||||
# 用户看到的是一屏源码。
|
||||
# 更糟的是当时没发现：只验了 HTTP 200 和字节数，两个都对。
|
||||
# **200 不等于页面能看。**
|
||||
$stageOut = & python (Join-Path $root "_build\test_response_headers.py") 2>&1
|
||||
Show-Fails $stageOut
|
||||
Record "网页响应头" ($LASTEXITCODE -eq 0)
|
||||
|
||||
# ---------------------------------------------------------------- 3c
|
||||
Banner "3c/7 中转管理端批量删除"
|
||||
$stageOut = & python (Join-Path $root "_tests\test_admin_batch_delete.py") 2>&1
|
||||
|
||||
+53
-1
@@ -1026,6 +1026,52 @@ class Handler(BaseHTTPRequestHandler):
|
||||
|
||||
# ---------------- 路由 ----------------
|
||||
|
||||
def do_HEAD(self): # noqa: N802
|
||||
"""HEAD 请求只回头，不回体。
|
||||
|
||||
之前没实现，HEAD 一律 501 Unsupported method。
|
||||
浏览器用 GET 所以页面照开，但：
|
||||
* Cloudflare 的健康检查、很多监控/代理探测会用 HEAD
|
||||
* curl -I 也是 HEAD，排查时看不到响应头很别扭
|
||||
这里按 GET 算好状态和长度，把体丢掉就行。
|
||||
"""
|
||||
RELAY.total_requests += 1
|
||||
path = self.path.split("?")[0]
|
||||
try:
|
||||
body, ctype = self._head_info(path)
|
||||
except Exception: # noqa: BLE001
|
||||
body, ctype = b"", "text/plain; charset=utf-8"
|
||||
self.send_response(200 if body is not None else 404)
|
||||
self.send_header("Content-Type", ctype)
|
||||
self.send_header("Content-Length", str(len(body or b"")))
|
||||
self.send_header("Cache-Control", "no-store")
|
||||
self.end_headers()
|
||||
|
||||
def _head_info(self, path: str) -> tuple:
|
||||
"""给 HEAD 用：算这个路径的响应类型和长度（不真的发体）。"""
|
||||
if path == "/":
|
||||
return _site_page().encode("utf-8"), "text/html; charset=utf-8"
|
||||
if path == "/v1/health":
|
||||
return b"{}", "application/json"
|
||||
if path in ("/url", "/v1/url"):
|
||||
return (public_url() or "").encode("utf-8"), \
|
||||
"text/plain; charset=utf-8"
|
||||
if path == "/favicon.ico":
|
||||
icon = Path(__file__).resolve().parent / "favicon.ico"
|
||||
return (icon.read_bytes() if icon.is_file() else b""), \
|
||||
"image/x-icon"
|
||||
if path == ADMIN_PATH:
|
||||
return b"", "text/html; charset=utf-8"
|
||||
if path.startswith("/shot/"):
|
||||
name = path[len("/shot/"):]
|
||||
if ".." in name or "/" in name or "\\" in name:
|
||||
return b"", "text/plain; charset=utf-8"
|
||||
target = Path(__file__).resolve().parent / "site_shots" / name
|
||||
if target.is_file() and name.lower().endswith(
|
||||
(".png", ".jpg", ".jpeg", ".webp")):
|
||||
return target.read_bytes(), "image/png"
|
||||
return b"", "text/plain; charset=utf-8"
|
||||
|
||||
def do_GET(self): # noqa: N802
|
||||
RELAY.total_requests += 1
|
||||
path = self.path.split("?")[0]
|
||||
@@ -1510,6 +1556,12 @@ class Handler(BaseHTTPRequestHandler):
|
||||
实际渲染在 relay/admin.py —— 原来几百行 HTML/CSS/JS
|
||||
内联在这里的 f-string 里，改一处样式要在一堆转义花括号里翻，
|
||||
没法维护。拆出去之后这里只负责把数据递过去。
|
||||
|
||||
⚠ Content-Type 必须显式写 text/html。
|
||||
_send() 默认是 application/json；不传的话浏览器会把整页
|
||||
HTML 当纯文本显示出来 —— 用户看到的是一屏源码。
|
||||
（这个坑真踩了：改完只测了 HTTP 200 和字节数，
|
||||
没看响应头，结果页面在浏览器里是白的。）
|
||||
"""
|
||||
from admin import render_admin
|
||||
snap = RELAY.snapshot()
|
||||
@@ -1519,7 +1571,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
admin_path=ADMIN_PATH,
|
||||
codes=len(RELAY.codes),
|
||||
downloads_fn=_list_downloads,
|
||||
).encode("utf-8"))
|
||||
).encode("utf-8"), "text/html; charset=utf-8")
|
||||
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Reference in New Issue
Block a user