Your Name
aa65f10c52
Audit docs:
- docs/reports/audit-phase-2{a-j}-line-walk.md: per-file line walk findings
- docs/reports/audit-phase-2-findings-matrix.md: 63 findings (52 fixed, 3 partial, 7 accepted)
- docs/reports/2026-05-23-full-audit-report.md: full audit consolidation
- docs/reports/audit-full-vs-phase2-reconciliation.md: cross-reference
- docs/reports/audit-phase-2-walk-closure.md: closure sign-off
Project docs:
- docs/project/phase-2-audit-remediation.md: SSOT for all fixes
- docs/project/alert-push-policy.md: dashboard alert design decisions
- docs/project/production-verification-checklist.md: first-deploy checklist
- docs/project/script-execution.md: script platform design
- docs/project/wsl-integration-test.md: WSL code-only verification guide
- docs/project/line-walk-audit-standard.md: audit methodology
- docs/project/mysql-mcp-setup.md: MCP config guide
Changelogs: 18 entries (2026-05-22 to 2026-05-23)
Project memory: CLAUDE.md, AGENTS.md updated to reflect current state
Deploy: nginx_https.conf template updated
Co-authored-by: Cursor <cursoragent@cursor.com>
1.3 KiB
1.3 KiB
Changelog — P1 安全修复（审计第二批）
日期: 2026-05-22
修复项
| ID | 修复 |
|---|---|
| F2b-01/02/03 | sync_engine_v2 sysctl/echo/cp 整段 shlex.quote；回滚路径白名单 |
| F2b-04/11/15 | 危险命令在 sync_v2、sync_engine_v2、scripts/exec 拒绝执行 |
| F2b-07/08 | Agent URL 随 API_BASE_URL 使用 HTTPS（agent_url.py） |
| F2b-09 | 凭据测试 API 不再返回含密码的 shell 命令 |
| F2a-07 | TOTP 关闭需当前密码 + TOTP 验证码；递增 token_version |
| F2a-08 | 安装完成后关闭 env-check/state；新装默认 SSH_STRICT_HOST_CHECKING=true |
| F2a-09 | create-admin 更新 .env 使用 _escape_env_value |
| F2a-16 | API Key 查看需重新输入管理员密码 + 审计 |
| F2a-14 | scripts 路由：/credentials 注册在 /{id} 之前 |
| F2c-02 | 安装向导写入严格 SSH 主机校验 |
| F2c-04 | Telegram 告警 HTML 转义 |
| — | web/agent：compare_digest + sudo sh -c 引用 |
涉及文件
server/application/services/sync_engine_v2.py,script_service.py,server_service.py,auth_service.pyserver/api/sync_v2.py,scripts.py,auth.py,settings.py,install.pyserver/infrastructure/agent_url.py,telegram/__init__.pyweb/agent/agent.py,web/app/settings.html