Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

core: allowCors option for Handler

Browse Source
This commit is contained in:
undefined committed 2023-02-15 15:06:32 +08:00
1 parent c347d36e99
commit cafe9246c2
2 files changed
+10 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/hydrooj/src/service/layers/user.ts
+2 -6
View File
@@ -1,4 +1,4 @@
import { CsrfTokenError, NotFoundError } from '../../error'; import { NotFoundError } from '../../error';
import avatar from '../../lib/avatar'; import avatar from '../../lib/avatar';
import { PERM } from '../../model/builtin'; import { PERM } from '../../model/builtin';
import UserModel from '../../model/user'; import UserModel from '../../model/user';
@@ -6,7 +6,7 @@ import type { KoaContext } from '../server';
export default async (ctx: KoaContext, next) => { export default async (ctx: KoaContext, next) => {
// User Layer // User Layer
const { request, args, domain } = ctx.HydroContext; const { args, domain } = ctx.HydroContext;
const domainId = domain ? args.domainId : 'system'; const domainId = domain ? args.domainId : 'system';
let user = await UserModel.getById(domainId, ctx.session.uid, ctx.session.scope); let user = await UserModel.getById(domainId, ctx.session.uid, ctx.session.scope);
if (!user) { if (!user) {
@@ -21,9 +21,5 @@ export default async (ctx: KoaContext, next) => {
ctx.pendingError = new NotFoundError(args.domainId); ctx.pendingError = new NotFoundError(args.domainId);
args.domainId = 'system'; args.domainId = 'system';
} }
if (request.method === 'post' && request.headers.referer && !ctx.cors) {
const host = new URL(request.headers.referer).host;
if (host !== request.host) ctx.pendingError = new CsrfTokenError(host);
}
await next(); await next();
}; };
packages/hydrooj/src/service/server.ts
+8 -3
View File
@@ -12,9 +12,9 @@ import WebSocket from 'ws';
import { Counter, isClass, parseMemoryMB } from '@hydrooj/utils/lib/utils'; import { Counter, isClass, parseMemoryMB } from '@hydrooj/utils/lib/utils';
import { Context, Service } from '../context'; import { Context, Service } from '../context';
import { import {
HydroError, InvalidOperationError, MethodNotAllowedError, CsrfTokenError, HydroError, InvalidOperationError,
NotFoundError, PermissionError, PrivilegeError, MethodNotAllowedError, NotFoundError, PermissionError,
UserFacingError, PrivilegeError, UserFacingError,
} from '../error'; } from '../error';
import { DomainDoc } from '../interface'; import { DomainDoc } from '../interface';
import { Types } from '../lib/validator'; import { Types } from '../lib/validator';
@@ -170,6 +170,7 @@ export class HandlerCommon {
export class Handler extends HandlerCommon { export class Handler extends HandlerCommon {
loginMethods: any; loginMethods: any;
noCheckPermView = false; noCheckPermView = false;
allowCors = false;
__param: Record<string, decorators.ParamOption<any>[]>; __param: Record<string, decorators.ParamOption<any>[]>;
back(body?: any) { back(body?: any) {
@@ -185,6 +186,10 @@ export class Handler extends HandlerCommon {
} }
async init() { async init() {
if (this.request.method === 'post' && this.request.headers.referer && !this.context.cors && !this.allowCors) {
const host = new URL(this.request.headers.referer).host;
if (host !== this.request.host) this.context.pendingError = new CsrfTokenError(host);
}
if (!argv.options.benchmark) await this.limitRate('global', 5, 100); if (!argv.options.benchmark) await this.limitRate('global', 5, 100);
if (!this.noCheckPermView && !this.user.hasPriv(PRIV.PRIV_VIEW_ALL_DOMAIN)) this.checkPerm(PERM.PERM_VIEW); if (!this.noCheckPermView && !this.user.hasPriv(PRIV.PRIV_VIEW_ALL_DOMAIN)) this.checkPerm(PERM.PERM_VIEW);
this.loginMethods = Object.keys(global.Hydro.module.oauth) this.loginMethods = Object.keys(global.Hydro.module.oauth)