From f5b9d697b3ce45d899160b6397ef3752a12ea7c4 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Tue, 25 Aug 2026 14:46:50 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E7=A7=BB=E9=99=A4=20/rbac/add=5Fsu?=
 =?UTF-8?q?peruser.dspy=20=E6=9C=AA=E6=8E=88=E6=9D=83=E8=B6=85=E7=AE=A1?=
 =?UTF-8?q?=E5=88=9B=E5=BB=BA=E5=90=8E=E9=97=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

该端点被授权给 any 角色且文件内零鉴权：任何未登录者裸调 URL 即可创建
superuser/111111（角色 owner.superuser+admin）→ 登录后完全接管平台
→ 经 agent run_shell/终端可达 RCE。等同奇安信 QVD-2026-57410(DSH 9.8) 危害。

超管初始化改为部署期本地 CLI（宿主应用 scripts/create_superuser.py），
不再经 HTTP 暴露。load_path.py 同步移除该路径注册。
---
 scripts/load_path.py       |  1 -
 wwwroot/add_superuser.dspy | 19 -------------------
 2 files changed, 20 deletions(-)
 delete mode 100644 wwwroot/add_superuser.dspy

diff --git a/scripts/load_path.py b/scripts/load_path.py
index c10a21b..1446dcd 100644
--- a/scripts/load_path.py
+++ b/scripts/load_path.py
@@ -37,7 +37,6 @@ PATHS_LOGINED = [
     f"/{MOD}/add_provider.dspy",
     f"/{MOD}/add_provider.ui",
     f"/{MOD}/add_reseller.dspy",
-    f"/{MOD}/add_superuser.dspy",
     f"/{MOD}/find_unauth_files.dspy",
     f"/{MOD}/get_all_roles.dspy",
     f"/{MOD}/get_normal_roles.dspy",
diff --git a/wwwroot/add_superuser.dspy b/wwwroot/add_superuser.dspy
deleted file mode 100644
index 228d778..0000000
--- a/wwwroot/add_superuser.dspy
+++ /dev/null
@@ -1,19 +0,0 @@
-debug('/rbac/add_superuser.dspy')
-db = DBPools()
-dbname = get_module_dbname('rbac')
-async with db.sqlorContext(dbname) as sor:
-	ns = DictObject(**{
-		"id": uuid(),
-		"username":"superuser",
-		"password":password_encode('111111'),
-		"orgid":"0"
-	})
-	roles = [
-		{
-			"orgtypeid":"owner",
-			"roles":["superuser", "admin"]
-		}
-	]
-	await create_user(sor, ns, roles)
-	return "OK"
-return "Error"