yumoqing f5b9d697b3 security: 移除 /rbac/add_superuser.dspy 未授权超管创建后门 ...

该端点被授权给 any 角色且文件内零鉴权：任何未登录者裸调 URL 即可创建
superuser/111111（角色 owner.superuser+admin）→ 登录后完全接管平台
→ 经 agent run_shell/终端可达 RCE。等同奇安信 QVD-2026-57410(DSH 9.8) 危害。

超管初始化改为部署期本地 CLI（宿主应用 scripts/create_superuser.py），
不再经 HTTP 暴露。load_path.py 同步移除该路径注册。

2026-08-25 14:46:50 +08:00

..

api

fix(rbac): userrole CRUD roleid display — align valueField/textField with data columns

2026-07-16 18:06:20 +08:00

imgs

bugfix

2025-08-01 17:09:41 +08:00

user

feat(rbac): 登录检查refer，非用户点击登录成功后不刷新页面

2026-08-20 14:41:18 +08:00

usersync

bugfix

2026-05-22 16:54:08 +08:00

add_adminuser.dspy

bugfix

2026-03-24 15:56:41 +08:00

add_adminuser.ui

bugfix

2026-05-18 16:00:42 +08:00

add_provider.dspy

bugfix

2026-04-26 12:29:35 +08:00

add_provider.ui

bugfix

2026-04-23 12:51:51 +08:00

add_reseller.dspy

first commit

2025-07-16 14:19:12 +08:00

admin_menu.ui

feat: add RBAC tools — list_path_roles and find_unauth_files

2026-05-26 09:12:33 +08:00

find_unauth_files.dspy

fix(rbac): find_unauth_files 用 ref_real_path 替代 __file__ + seed user_status 字典(init/data.json)

2026-08-21 17:09:51 +08:00

gen_sms_code.dspy

fix(rbac): gen_sms_code.dspy — remove TEST MODE, call sms_engine directly

2026-07-16 15:50:04 +08:00

get_all_roles.dspy

bugfix

2026-03-21 16:09:48 +08:00

get_normal_roles.dspy

bugfix

2026-03-21 16:09:48 +08:00

get_provider.dspy

bugfix

2026-03-25 14:11:46 +08:00

get_reseller.dspy

first commit

2025-07-16 14:19:12 +08:00

list_path_roles.dspy

refactor: move RBAC tools logic to rbac/rbac_tools.py, dspy files call via request._run_ns

2026-05-26 09:32:38 +08:00

list_path_roles.ui

feat: add RBAC tools — list_path_roles and find_unauth_files

2026-05-26 09:12:33 +08:00

login.css

fix: 暗色主题输入框颜色全局优化

2026-05-30 14:32:11 +08:00

phone_login.dspy

feat: 注册时检查促销码并绑定客户归属关系

2026-06-24 00:56:33 +08:00

qr_scan.ui

fix: 改用event.params.text直接取值，不用${text}占位符

2026-07-06 14:04:32 +08:00

refresh_userperm.dspy

bugfix

2026-03-20 21:15:39 +08:00

stat_active_users.ui

feat: add RBAC tools — list_path_roles, find_unauth_files, and permission registration script

2026-05-26 09:18:04 +08:00

stat_total_orgs.ui

feat: add RBAC tools — list_path_roles, find_unauth_files, and permission registration script

2026-05-26 09:18:04 +08:00

stat_total_users.ui

feat: add RBAC tools — list_path_roles, find_unauth_files, and permission registration script

2026-05-26 09:18:04 +08:00

usermenu.ui

rbac: 完善信息弹窗修复双窗口+添加标题

2026-06-18 11:09:46 +08:00

userpassword_login.dspy

feat(rbac): add login tracking, lockout, secure cache

2026-04-26 10:49:01 +08:00

userpassword_login.ui

bugfix

2026-05-18 16:00:42 +08:00