21 lines
924 B
Markdown
21 lines
924 B
Markdown
|
# Changelog — P0 安全修复（审计先行修复）
|
|||
|
|
|
|||
|
|
**日期**: 2026-05-22
|
|||
|
|
|
|||
|
|
## 修复项
|
|||
|
|
|
|||
|
|
| ID | 问题 | 修复 |
|
|||
|
|
|----|------|------|
|
|||
|
|
| F2a-01 | WebSSH IDOR：普通 JWT 可连任意 server_id | `POST /api/auth/webssh-token` 签发 `purpose=webssh` + `server_id`；`webssh.py` 强制匹配 |
|
|||
|
|
| F2a-02 | 中心机 `/api/agent/exec` 本机 RCE | 删除该路由；远程执行仅 `web/agent/agent.py` `/exec` |
|
|||
|
|
| F2c-01 | 解密失败返回密文当密码 | `decrypt_value` 失败抛 `ValueError` |
|
|||
|
|
| F2b-06 | `batch_push` 缺 `nonlocal` | `sync_service.py` 添加 `nonlocal completed` |
|
|||
|
|
| — | Agent 调用 URL 错误 | `script_service` 改为 `http://host:port/exec` |
|
|||
|
|
|
|||
|
|
## 涉及文件
|
|||
|
|
|
|||
|
|
- `server/api/webssh.py`, `server/api/auth.py`, `server/api/agent.py`
|
|||
|
|
- `server/application/services/auth_service.py`, `sync_service.py`, `script_service.py`
|
|||
|
|
- `server/infrastructure/database/crypto.py`
|
|||
|
|
- `web/app/terminal.html`
|