From 790d8edb12f363abc1848bf1b9e33ac0bab9575d Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Tue, 25 Aug 2026 14:47:05 +0800
Subject: [PATCH] =?UTF-8?q?security:=20workspace=5Fedit.xterm=20=E6=9C=AA?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E7=9B=B4=E6=8E=A5=E6=8B=92=E7=BB=9D=EF=BC=8C?=
 =?UTF-8?q?=E5=8E=BB=E6=8E=89=E5=8C=BF=E5=90=8D=E5=9B=9E=E9=80=80=20admin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

此前 'if not uid: uid = user-01' 把未登录者当成 admin：结合 RBAC 通配授权，
匿名可拿到 admin 工作空间的编辑器进程，读写工作空间全部源码与 env/*.json(含 DB 密码)。
---
 wwwroot/workspace_edit.xterm | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/wwwroot/workspace_edit.xterm b/wwwroot/workspace_edit.xterm
index 318ca40..a0b01f5 100644
--- a/wwwroot/workspace_edit.xterm
+++ b/wwwroot/workspace_edit.xterm
@@ -6,7 +6,15 @@ file_id = (params_kw or {}).get('id', '').strip()
 
 uid = await get_user()
 if not uid:
-    uid = 'user-01'
+    # 安全：未登录直接拒绝。此前回退成 'user-01'(admin) —— 结合 RBAC 通配授权，
+    # 未登录者可拿到 admin 工作空间的编辑器进程（bwrap 沙箱内仍可读写工作空间
+    # 全部源码与 env/*.json，后者含 DB 密码）。禁止匿名回退。
+    r = DictObject()
+    r.host = 'localhost'
+    r.username = 'pipeline'
+    r.cmdargs = ['echo 未登录，拒绝访问']
+    r.noinput = True
+    return r
 
 session_id = (params_kw or {}).get('session_id', '') or ''