yumoqing/rbac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
292 Commits 2 Branches 0 Tags
Commit Graph

13 Commits

Author SHA1 Message Date
yumoqing
c572d4c254 fix(users): replace script handlers with declarative urlwidget binds 
- reset_password: urlwidget + PopupWindow Form (same pattern as userrole),
  hidden userid field from params_kw, password fields with required validation
- clear_login_fail: urlwidget + conform dialog, params_mapping id only
- fixes runtime crash: script bind called bricks.getWidgetById('users_tbl')
  without from_widget context -> TypeError on dom_element
- register /rbac/admin_reset_password.ui in PATHS_ADMIN (admin role only)
- i18n entries for 4 languages
 2026-09-09 18:38:36 +08:00
yumoqing
5712f4091e feat(users): admin reset password + clear login fail count for other users 
- json/users.json: add 2 toolbar tools (selected_row) + script binds,
  same pattern as enable_user/disable_user; reset_password collects new
  password via prompt and POSTs JSON body to admin_reset_password.dspy
- api/admin_reset_password.dspy: orgid ownership check, min length 8,
  cfm match, password_encode (RC4), also resets login_fail counters,
  audit_log(password_reset), new password never logged
- api/clear_login_fail.dspy: ownership check, SET login_fail_count=0
  last_login_fail=NULL, audit_log(login_fail_clear)
- scripts/load_path.py: new PATHS_ADMIN section registered as *.admin
  (NOT logined - sensitive endpoints must not be open to any logged user)
 2026-09-09 16:49:55 +08:00
yumoqing
f5b9d697b3 security: 移除 /rbac/add_superuser.dspy 未授权超管创建后门 
该端点被授权给 any 角色且文件内零鉴权：任何未登录者裸调 URL 即可创建
superuser/111111（角色 owner.superuser+admin）→ 登录后完全接管平台
→ 经 agent run_shell/终端可达 RCE。等同奇安信 QVD-2026-57410(DSH 9.8) 危害。

超管初始化改为部署期本地 CLI（宿主应用 scripts/create_superuser.py），
不再经 HTTP 暴露。load_path.py 同步移除该路径注册。
 2026-08-25 14:46:50 +08:00
yumoqing
77c17f6374 refactor(rbac): 删除 userapp/userdepartment 两张废弃表（无业务读写，预留未启用） 
- 删 models/json 的 userapp/userdepartment 定义 + xlsx
- script/init.py rbac_tables 移除两表
- scripts/load_path.py 移除路径注册
- .gitignore 移除对应条目
 2026-08-21 18:33:21 +08:00
yumoqing
e1abe0bb71 fix: role dropdown filter by user org_type, add get_search_roleid.dspy 2026-07-13 11:27:21 +08:00
yumoqing
5ddbf299bf feat: 注册 api/add_user.dspy 和 api/update_user.dspy RBAC 权限 2026-06-29 15:19:45 +08:00
Hermes Agent
cd29b276f7 fix: add login.css to any permissions 2026-06-15 13:55:09 +08:00
yumoqing
18251e3eae fix: add favicon.ico and i18n_getmsgs to any permissions 2026-06-11 23:54:17 +08:00
yumoqing
d1b81c9a9f fix: remove Sage dependency from load_path.py, use standard pattern 2026-06-11 23:41:10 +08:00
yumoqing
7f2c3d25dd feat: 用户菜单添加完善信息功能 - 新增 edit_profile.dspy/save_profile.dspy - usermenu.ui 添加完善信息入口 - load_path.py 注册权限路径 2026-05-31 10:52:13 +08:00
yumoqing
36569c0e41 feat: 现代化登录/注册界面改造 
- login.css: 全新现代化样式，支持亮/暗主题
- login.ui: 三Tab布局(密码登录/手机登录/注册)，手机登录支持短信验证码
- sms_register.dspy: 短信验证注册后端，验证通过后自动注册并登录
- load_path.py: 添加 sms_register.dspy 到 any 权限
- 修复手机登录 setValue 调用 (上一轮已提交)
- 注册流程: 手机号+短信验证码+用户名+密码，短信验证通过后才允许注册
 2026-05-30 14:08:11 +08:00
yumoqing
de21b9fd38 feat: 手机验证码登录对接 + 注册tab + user_logined事件派发 
- 新增 code_login.dspy: 接收前端表单(cell_no/codeid/check_code)
  映射到sms_engine验证，返回UI widget含自动登录binds
- 修复 login.ui 手机验证码tab: gen_code按钮改用script调用
  gen_sms_code.dspy并回写key到隐藏字段，submit指向code_login.dspy
- login.ui 新增注册tab: 用户名/手机号/密码/确认密码表单
- register.dspy: 注册成功后自动remember_user并返回含binds的
  Message widget（加载userinfo、销毁登录窗、派发user_logined）
- up_login.dspy: 补充user_logined事件派发bind
- load_path.py: code_login.dspy加入any权限，gen_sms_code.dspy
  从logined移至any（验证码发送在登录前）
 2026-05-28 13:50:17 +08:00
yumoqing
0a5bfa4c64 feat: add load_path.py RBAC permission registration script 2026-05-27 13:16:09 +08:00