tcjlj/flvx
1
0
Fork 0
mirror of https://github.com/Sagit-chu/flvx.git synced 2026-10-07 02:06:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: permission checks for speedId and inPort + multi-node IP constraints (#261)

Browse Source 
* feat: restrict user permissions and multi-node IP constraints

- Non-admin users cannot set speedId or inPort on forward create/update
- Multi-entrance tunnels disable custom listen IP for forwards
- Multi-exit tunnels disable custom connect IP
- Multi-node hop chains disable custom connect IP per hop
- Remove tunnel-first-IP fallback in forward ingress resolution
- Add contract tests for non-admin permission restrictions

Entire-Checkpoint: 133693290660

* fix: allow non-admin users to submit null speedId and zero inPort

- Backend: Check speedId is not nil before rejecting non-admin requests
- Backend: Only reject inPort if value > 0 for non-admin users
- Frontend: Only include speedId and inPort in payload for admin users
- Tests: Add contract tests for null speedId and zero inPort cases
This commit is contained in:
sagit
2026-03-04 14:50:36 +08:00
committed by GitHub
parent 348900de01
commit a43653f252
48 changed files with 93608 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go-backend/internal/http/handler/mutations.go
+14 -8
View File
@@ -1154,13 +1154,16 @@ func (h *Handler) forwardCreate(w http.ResponseWriter, r *http.Request) {
return
}
if roleID != 0 {
if _, ok := req["speedId"]; ok {
if speedIDVal, ok := req["speedId"]; ok && speedIDVal != nil {
response.WriteJSON(w, response.Err(-1, "普通用户无法设置限速规则"))
return
}
if _, ok := req["inPort"]; ok {
response.WriteJSON(w, response.Err(-1, "普通用户无法设置自定义端口"))
return
if inPortVal, ok := req["inPort"]; ok {
port := asInt(inPortVal, 0)
if port > 0 {
response.WriteJSON(w, response.Err(-1, "普通用户无法设置自定义端口"))
return
}
}
}
speedID := asAnyToInt64Ptr(req["speedId"])
@@ -1274,13 +1277,16 @@ func (h *Handler) forwardUpdate(w http.ResponseWriter, r *http.Request) {
strategy = forward.Strategy
}
if actorRole != 0 {
if _, ok := req["speedId"]; ok {
if speedIDVal, ok := req["speedId"]; ok && speedIDVal != nil {
response.WriteJSON(w, response.Err(-1, "普通用户无法修改限速规则"))
return
}
if _, ok := req["inPort"]; ok {
response.WriteJSON(w, response.Err(-1, "普通用户无法修改自定义端口"))
return
if inPortVal, ok := req["inPort"]; ok {
port := asInt(inPortVal, 0)
if port > 0 {
response.WriteJSON(w, response.Err(-1, "普通用户无法修改自定义端口"))
return
}
}
}
speedID := asAnyToInt64Ptr(req["speedId"])