xmz7891/ykxmz
1
0
Fork 0
mirror of https://gitee.com/xmz7891/ykxmz.git synced 2026-10-18 19:30:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
25ffd3ec67eafc80db1f94e3d30e8f6da42d067f
ykxmz/_build/dl_long2h_health.tsv
T
xmz7891 430923dd84 🔐 修一个严重安全问题：管理密码被硬编码进公开仓库 
== 问题 ==

relay/relay.py 第 138 行：

    ADMIN_PASSWORD_DEFAULT = "@REVAedu120830"

而且 _tests/ 和 _build/ 下 11 个文件里也写着明文密码。
这个仓库是要推到**公开的 Gitee / EzHub** 的，等于：

    git 仓库 = 公开的
    管理页路径 /zhongzhuanzhan = 公开的（就写在代码里）
    公网地址 = 公开的
    密码 = 也在仓库里

**= 把管理台的门钥匙挂在门上。**

而且 git 历史删不掉 —— 只是在最新提交里删掉没用，
读过仓库的人已经从历史里拿到了。

== 修法 ==

### 1. 代码里不再有任何固定密码

relay.py 的 admin_password() 改成和 admin_key 一样的做法：

    环境变量 RELAY_ADMIN_PASSWORD
      -> data/admin_password.txt（600 权限，不进仓库）
      -> 都没有就**首次启动随机生成**，写进那个文件并打印一次

这样全新部署的密码天然是随机的、每台不同。

### 2. 11 个文件里的明文密码清掉

    _tests/  acceptance.py, test_relay_admin_login.py,
             test_admin_batch_delete.py, test_admin_button.py,
             test_admin_device_control.py, test_admin_js.py,
             test_admin_netcheck.py
    _build/  check_web.sh, verify_site_admin.sh,
             split_site_admin2.py, test_response_headers.py

统一改成从 RELAY_ADMIN_PASSWORD 环境变量读，
拿不到就从部署的 data/admin_password.txt 读，
再拿不到就**跳过需要登录的用例**（而不是编个假密码硬试）。

### 3. 真机上的密码已经轮换

设备上的 data/admin_password.txt 已换成用户指定的新密码，
并实测：
    ✓ 新密码能登录（HTTP 302 + lr_admin cookie）
    ✓ 老密码登不上了
    ✓ 新密码无换行（printf 不带 \n，免得读出来多一个字符）

顺带：重启中断了 relay-stability 的 A/B 对照 A 组（69 个样本），
分析数据时会标注这一段。

== 新增测试 ==

_tests/test_admin_password_gen.py 验证六件事：
    1. 全新部署会生成随机密码（不是那个老密码）
    2. 密码长度 >= 12、纯字母数字
    3. 用生成的密码能登录管理页
    4. **老密码登不进去**
    5. 重启后密码不变（从文件读回来）
    6. **两次全新部署的密码不一样**（真的是随机的）

== 还没做的（等用户决定）==

git **历史**里还有那个密码。要彻底清掉得重写历史 + 强制推送，
这是个危险操作，按用户的规矩必须他确认之后才做。
而且**光删历史不够** —— 密码已经公开过，必须换（已换）。
2026-10-07 20:49:33 +08:00

10 KiB
Raw Blame History

12026-10-07 17:27:205021407
22026-10-07 17:27:36200921
32026-10-07 17:27:522001063
42026-10-07 17:28:092001491
52026-10-07 17:28:272002796
62026-10-07 17:28:442002277
72026-10-07 17:29:00200974
82026-10-07 17:29:172001274
92026-10-07 17:29:332001265
102026-10-07 17:29:502001176
112026-10-07 17:30:062001062
122026-10-07 17:30:3520014074
132026-10-07 17:30:532002637
142026-10-07 17:31:092001180
152026-10-07 17:31:262001524
162026-10-07 17:31:42530862
172026-10-07 17:31:582001683
182026-10-07 17:32:15200997
192026-10-07 17:32:312001530
202026-10-07 17:32:482001542
212026-10-07 17:33:042001257
222026-10-07 17:33:212001439
232026-10-07 17:33:382001526
242026-10-07 17:33:552002034
252026-10-07 17:34:112001438
262026-10-07 17:34:282001240
272026-10-07 17:34:442001509
282026-10-07 17:35:012001280
292026-10-07 17:35:172001240
302026-10-07 17:35:342001293
312026-10-07 17:35:502001018
322026-10-07 17:36:062001063
332026-10-07 17:36:222001033
342026-10-07 17:36:402002410
352026-10-07 17:36:562001206
362026-10-07 17:37:132001503
372026-10-07 17:37:292001152
382026-10-07 17:37:472002442
392026-10-07 17:38:032001267
402026-10-07 17:38:202001555
412026-10-07 17:38:362001187
422026-10-07 17:38:542002524
432026-10-07 17:39:10200973
442026-10-07 17:39:262001444
452026-10-07 17:39:432001285
462026-10-07 17:40:002001600
472026-10-07 17:40:16200982
482026-10-07 17:40:4520014272
492026-10-07 17:41:012001264
502026-10-07 17:41:182001235
512026-10-07 17:41:352001482
522026-10-07 17:41:512001471
532026-10-07 17:42:082001483
542026-10-07 17:42:3720013940
552026-10-07 17:42:532001073
562026-10-07 17:43:092001093
572026-10-07 17:43:262001472
582026-10-07 17:43:432001576
592026-10-07 17:43:592001453
602026-10-07 17:44:162001984
612026-10-07 17:44:332001237
622026-10-07 17:44:49200924
632026-10-07 17:45:062001936
642026-10-07 17:45:232001750
652026-10-07 17:45:392001039
662026-10-07 17:45:552001033
672026-10-07 17:46:112001061
682026-10-07 17:46:272001083
692026-10-07 17:46:44200847
702026-10-07 17:47:00200972
712026-10-07 17:47:162001055
722026-10-07 17:47:322001219
732026-10-07 17:47:482001034
742026-10-07 17:48:052001203
752026-10-07 17:48:212001142
762026-10-07 17:48:372001235
772026-10-07 17:48:53200988
782026-10-07 17:49:102001636
792026-10-07 17:49:26200998
802026-10-07 17:49:432001226
812026-10-07 17:49:59200849
822026-10-07 17:50:15200966
832026-10-07 17:50:312001476
842026-10-07 17:50:482001336
852026-10-07 17:51:052001452
862026-10-07 17:51:212001017
872026-10-07 17:51:5020013815
882026-10-07 17:52:062001437
892026-10-07 17:52:232001215
902026-10-07 17:52:392001065
912026-10-07 17:53:032009538
922026-10-07 17:53:202001556
932026-10-07 17:53:362001132
942026-10-07 17:53:532001548
952026-10-07 17:54:092001243
962026-10-07 17:54:262001499
972026-10-07 17:54:432001516
982026-10-07 17:54:592001491
992026-10-07 17:55:162001492
1002026-10-07 17:55:332001665
1012026-10-07 17:55:492001227
1022026-10-07 17:56:062001531
1032026-10-07 17:56:4600025000
1042026-10-07 17:57:065024652
1052026-10-07 17:57:222001475
1062026-10-07 17:57:392001545
1072026-10-07 17:57:552001116
1082026-10-07 17:58:112001026
1092026-10-07 17:58:282001544
1102026-10-07 17:58:442001038
1112026-10-07 17:59:00200992
1122026-10-07 17:59:17200988
1132026-10-07 17:59:342001823
1142026-10-07 17:59:502001004
1152026-10-07 18:00:062001236
1162026-10-07 18:00:3520014105
1172026-10-07 18:01:0520014208
1182026-10-07 18:01:212001597
1192026-10-07 18:01:382001531
1202026-10-07 18:01:562002613
1212026-10-07 18:02:132001563
1222026-10-07 18:02:292001509
1232026-10-07 18:02:462001521
1242026-10-07 18:03:032001492
1252026-10-07 18:03:192001546
1262026-10-07 18:03:362001215
1272026-10-07 18:03:522001579
1282026-10-07 18:04:092001592
1292026-10-07 18:04:262002187
1302026-10-07 18:04:432001001
1312026-10-07 18:04:592001600
1322026-10-07 18:05:162001116
1332026-10-07 18:05:32200991
1342026-10-07 18:05:492001986
1352026-10-07 18:06:052001005
1362026-10-07 18:06:21200992
1372026-10-07 18:06:372001080
1382026-10-07 18:06:542001066
1392026-10-07 18:07:102001463
1402026-10-07 18:07:272001210
1412026-10-07 18:07:432001408
1422026-10-07 18:07:592001024
1432026-10-07 18:08:162001280
1442026-10-07 18:08:322001300
1452026-10-07 18:08:48200992
1462026-10-07 18:09:04200954
1472026-10-07 18:09:20200987
1482026-10-07 18:09:372001023
1492026-10-07 18:09:532001256
1502026-10-07 18:10:092001386
1512026-10-07 18:10:3920013955
1522026-10-07 18:10:552001653
1532026-10-07 18:11:122001824
1542026-10-07 18:11:292001247
1552026-10-07 18:11:452001274
1562026-10-07 18:12:022001539
1572026-10-07 18:12:182001335
1582026-10-07 18:12:352001530
1592026-10-07 18:13:0420013994
1602026-10-07 18:13:212001454
1612026-10-07 18:13:372001591
1622026-10-07 18:13:542001030
1632026-10-07 18:14:10200829
1642026-10-07 18:14:262001085
1652026-10-07 18:14:422001217
1662026-10-07 18:14:582001134
1672026-10-07 18:15:15200934
1682026-10-07 18:15:312001125
1692026-10-07 18:15:472001089
1702026-10-07 18:16:032001026
1712026-10-07 18:16:202001488
1722026-10-07 18:16:362001477
1732026-10-07 18:16:532001367
1742026-10-07 18:17:102001488
1752026-10-07 18:17:262001003
1762026-10-07 18:17:422001038
1772026-10-07 18:17:58200981
1782026-10-07 18:18:152001471
1792026-10-07 18:18:312001255
1802026-10-07 18:18:472001233
1812026-10-07 18:19:042001439
1822026-10-07 18:19:202001008
1832026-10-07 18:19:362001023
1842026-10-07 18:19:522001049
1852026-10-07 18:20:102002696
1862026-10-07 18:20:26200985
1872026-10-07 18:20:5620014428
1882026-10-07 18:21:132001632
1892026-10-07 18:21:302001731
1902026-10-07 18:21:462001160
1912026-10-07 18:22:032001462
1922026-10-07 18:22:192001455
1932026-10-07 18:22:4820014144
1942026-10-07 18:23:052001596
1952026-10-07 18:23:212001055
1962026-10-07 18:23:38200987
1972026-10-07 18:23:542001048
1982026-10-07 18:24:10200940
1992026-10-07 18:24:262001256
2002026-10-07 18:24:442002653
2012026-10-07 18:25:012001705
2022026-10-07 18:25:172001408
2032026-10-07 18:25:342001557
2042026-10-07 18:25:512001660
2052026-10-07 18:26:072001005
2062026-10-07 18:26:232001015
2072026-10-07 18:26:392001079
2082026-10-07 18:26:562001542
2092026-10-07 18:27:132001534
2102026-10-07 18:27:292001196
2112026-10-07 18:27:452001163
2122026-10-07 18:28:022001239
2132026-10-07 18:28:182001232
2142026-10-07 18:28:352001560
2152026-10-07 18:28:512001267
2162026-10-07 18:29:082001328
2172026-10-07 18:29:242001070
2182026-10-07 18:29:402001048
2192026-10-07 18:30:0920013901
2202026-10-07 18:30:262001257
2212026-10-07 18:30:422001670
2222026-10-07 18:30:592001488
2232026-10-07 18:31:162001716
2242026-10-07 18:31:332001518
2252026-10-07 18:31:492001522
2262026-10-07 18:32:062001537
2272026-10-07 18:32:232001513
2282026-10-07 18:32:392001547
2292026-10-07 18:32:562001237
2302026-10-07 18:33:122001378
2312026-10-07 18:33:292001255
2322026-10-07 18:33:452001212
2332026-10-07 18:34:022002046
2342026-10-07 18:34:192001424
2352026-10-07 18:34:352001406
2362026-10-07 18:34:522001279
2372026-10-07 18:35:08200974
2382026-10-07 18:35:24200957
2392026-10-07 18:35:40200937
2402026-10-07 18:35:56200903
2412026-10-07 18:36:122001223
2422026-10-07 18:36:292001456
2432026-10-07 18:36:452001183
2442026-10-07 18:37:012001076
2452026-10-07 18:37:182001182
2462026-10-07 18:37:34200937
2472026-10-07 18:37:502001144
2482026-10-07 18:38:062001218
2492026-10-07 18:38:232001185
2502026-10-07 18:38:392001028
2512026-10-07 18:38:55200969
2522026-10-07 18:39:11200933
2532026-10-07 18:39:282001706
2542026-10-07 18:39:452002392
2552026-10-07 18:40:022001735
2562026-10-07 18:40:3120013866
2572026-10-07 18:40:482001531
2582026-10-07 18:41:052001282
2592026-10-07 18:41:3420014107
2602026-10-07 18:41:50200906
2612026-10-07 18:42:1920014242
2622026-10-07 18:42:362001260
2632026-10-07 18:42:522001254
2642026-10-07 18:43:082001260
2652026-10-07 18:43:252001021
2662026-10-07 18:43:41200829
2672026-10-07 18:43:572001012
2682026-10-07 18:44:132001613
2692026-10-07 18:44:302001556
2702026-10-07 18:44:472001422
2712026-10-07 18:45:042002419
2722026-10-07 18:45:20200978
2732026-10-07 18:45:372001787
2742026-10-07 18:45:53200968
2752026-10-07 18:46:102001652
2762026-10-07 18:46:272001504
2772026-10-07 18:46:43200944
2782026-10-07 18:46:592001006
2792026-10-07 18:47:15200968
2802026-10-07 18:47:31200963
2812026-10-07 18:47:482001245
2822026-10-07 18:48:042001551
2832026-10-07 18:48:212001194
2842026-10-07 18:48:37200941
2852026-10-07 18:48:532001010
2862026-10-07 18:49:092001051
2872026-10-07 18:49:252001205
2882026-10-07 18:49:422001372
2892026-10-07 18:49:582001310
2902026-10-07 18:50:2820014115
2912026-10-07 18:50:452002386
2922026-10-07 18:51:022001415
2932026-10-07 18:51:182001195
2942026-10-07 18:51:342001230
2952026-10-07 18:51:512001333
2962026-10-07 18:52:2020013900
2972026-10-07 18:52:362001245
2982026-10-07 18:52:532001218
2992026-10-07 18:53:09200963
3002026-10-07 18:53:262001529
3012026-10-07 18:53:422001053
3022026-10-07 18:53:582001069
3032026-10-07 18:54:142001012
3042026-10-07 18:54:312001846
3052026-10-07 18:54:482001324
3062026-10-07 18:55:042001550
3072026-10-07 18:55:202001008
3082026-10-07 18:55:372001066
3092026-10-07 18:55:532001065
3102026-10-07 18:56:092001515
3112026-10-07 18:56:26200988
3122026-10-07 18:56:422001003
3132026-10-07 18:56:582001077
3142026-10-07 18:57:152002306
3152026-10-07 18:57:332002405
3162026-10-07 18:57:502001549
3172026-10-07 18:58:072002098
3182026-10-07 18:58:23200970
3192026-10-07 18:58:392001089
3202026-10-07 18:58:562001596
3212026-10-07 18:59:132001906
3222026-10-07 18:59:292001012
3232026-10-07 18:59:462001588
3242026-10-07 19:00:022001317
3252026-10-07 19:00:205022101
3262026-10-07 19:00:362001627
3272026-10-07 19:00:542002006
3282026-10-07 19:01:2320014099
3292026-10-07 19:01:392001599
3302026-10-07 19:01:562001539
3312026-10-07 19:02:2620014438
3322026-10-07 19:02:422001264
3332026-10-07 19:03:062008534
3342026-10-07 19:03:222001311
3352026-10-07 19:03:38200971
3362026-10-07 19:03:552001676
3372026-10-07 19:04:122001795
3382026-10-07 19:04:292001552
3392026-10-07 19:04:45200994
3402026-10-07 19:05:032003017
3412026-10-07 19:05:192001048
3422026-10-07 19:05:362001253
3432026-10-07 19:05:522001607
3442026-10-07 19:06:102002535
3452026-10-07 19:06:262001126
3462026-10-07 19:06:432001116
3472026-10-07 19:06:592001361
3482026-10-07 19:07:162001255
3492026-10-07 19:07:322001161
3502026-10-07 19:07:492002006
3512026-10-07 19:08:062001564
3522026-10-07 19:08:222001161
3532026-10-07 19:08:392001480
3542026-10-07 19:08:55200998
3552026-10-07 19:09:11200993
3562026-10-07 19:09:27200981
3572026-10-07 19:09:442001409
3582026-10-07 19:10:002001522
3592026-10-07 19:10:172001633
3602026-10-07 19:10:4620014107
3612026-10-07 19:11:042002563
362
Reference in New Issue View Git Blame Copy Permalink