okooooooo/team-api
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permissions):修复后端权限漏洞

Browse Source
This commit is contained in:
chengqian committed 2026-09-03 15:05:31 +08:00
1 parent 9d61abda86
commit e703c9a044
21 files changed
+233 -136
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/logic/admin/admin_user.go
+9 -2
View File
@@ -411,17 +411,24 @@ func (s *sAdmin) UpdateUserStatus(ctx context.Context, req *v1.AdminUserUpdateSt
}
// UnlockUser 清除管理员的登录锁定状态（重置失败计数与锁定截止时间）。
//
// 解锁是本文件里唯一漏掉 assertCanManageAdminUser 的账号处置动作：锁定本身是暴力破解
// 的防线，非超管若能解锁超级管理员账号，就等于可以无限次重置对方的失败计数继续爆破。
func (s *sAdmin) UnlockUser(ctx context.Context, req *v1.AdminUserUnlockReq) (*v1.AdminUserUnlockRes, error) {
var user *struct {
Id int64 `json:"id"`
Id int64 `json:"id"`
Role string `json:"role"`
}
err := dao.SysAdminUsers.Ctx(ctx).Where("id", req.Id).Scan(&user)
err := dao.SysAdminUsers.Ctx(ctx).Where("id", req.Id).Fields("id, role").Scan(&user)
if err = common.IgnoreScanNoRows(err); err != nil {
return nil, err
}
if user == nil {
return nil, common.NewNotFoundError("管理员")
}
if err := assertCanManageAdminUser(ctx, req.Id, user.Role); err != nil {
return nil, err
}
_, err = dao.SysAdminUsers.Ctx(ctx).Where("id", req.Id).Data(map[string]interface{}{
"failed_attempts": 0,
internal/logic/admin/permission.go
+6 -57
View File
@@ -133,7 +133,7 @@ var predefinedPermissionGroups = []v1.PermissionGroup{
Name: "member",
Label: "成员管理",
Permissions: []string{
"member:view", "member:import", "member:model_scope",
"member:view", "member:import", "member:manage", "member:model_scope",
},
},
{
@@ -272,62 +272,6 @@ func (s *sAdmin) UpdateUserPermissions(ctx context.Context, req *v1.AdminPermiss
return nil, nil
}
// UpdateUserDataScopes updates data scopes for an admin user.
func (s *sAdmin) UpdateUserDataScopes(ctx context.Context, req *v1.AdminDataScopeUpdateReq) (*v1.AdminDataScopeUpdateRes, error) {
// Check if target is super_admin
var user *struct {
Role string `json:"role"`
}
err := dao.SysAdminUsers.Ctx(ctx).
Where("id", req.Id).Scan(&user)
if err = common.IgnoreScanNoRows(err); err != nil {
return nil, err
}
if user == nil {
return nil, common.NewNotFoundError("用户")
}
if user.Role == "super_admin" {
return nil, common.NewBadRequestError("超级管理员无需配置数据范围")
}
if err := assertCanManageAdminUser(ctx, req.Id, user.Role); err != nil {
return nil, err
}
// 事务采用 ctx 传播式写法：闭包内统一使用 dao.Xxx.Ctx(ctx)，事务由 ctx 自动挂载。
err = g.DB().Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
// Delete existing data scopes
_, err := dao.SysAdminDataScopes.Ctx(ctx).
Where("admin_user_id", req.Id).
Delete()
if err != nil {
return err
}
// Insert new data scopes
if len(req.DataScopes) > 0 {
data := make([]do.SysAdminDataScopes, len(req.DataScopes))
for i, sc := range req.DataScopes {
data[i] = do.SysAdminDataScopes{
AdminUserId: req.Id,
ScopeType: sc.ScopeType,
ScopeValue: sc.ScopeValue,
}
}
_, err = dao.SysAdminDataScopes.Ctx(ctx).Data(data).Insert()
if err != nil {
return err
}
}
return nil
})
if err != nil {
return nil, err
}
return nil, nil
}
// tierLabels 是档位的中文标签，随元数据下发给前端，避免前端硬编码一份。
var tierLabels = map[string]string{
TierNone: "无",
@@ -393,6 +337,11 @@ func HasPermission(ctx context.Context, userID int64, role string, permission st
// GetDataScopes returns data scopes for an admin user.
// super_admin always returns "all".
//
// ⚠️ 当前无调用方：数据范围只被存储与回显，没有任何查询按它过滤，配置了也不生效。
// 写接口已随之下线（见 api/admin/v1/permission.go）。要让这个特性真正成立，
// 必须先把它接进各列表查询的 WHERE 条件，再恢复配置入口 —— 在那之前不要仅凭
// 本函数存在就认为数据范围已被强制执行。
func GetDataScopes(ctx context.Context, userID int64, role string) ([]v1.DataScopeItem, error) {
if role == "super_admin" {
return []v1.DataScopeItem{{ScopeType: "all"}}, nil
internal/logic/admin/role.go
+3 -2
View File
@@ -47,8 +47,8 @@ var tierPermissions = map[string]map[string][]string{
},
"member": {
TierRead: {"member:view"},
TierOperate: {"member:view", "member:import"},
TierFull: {"member:view", "member:import", "member:model_scope"},
TierOperate: {"member:view", "member:import", "member:manage"},
TierFull: {"member:view", "member:import", "member:manage", "member:model_scope"},
},
"channel": {
TierRead: {"channel:view"},
@@ -137,6 +137,7 @@ var dangerousPermissions = map[string]string{
"user:create": "可创建管理员账号",
"user:edit": "可修改管理员账号与其角色（含提权）",
"user:delete": "可删除管理员账号",
"member:manage": "可重置任意租户成员的密码（等同接管该成员账号）",
}
// tierOrder 定义档位由低到高的顺序，用于「权限点集合 → 档位」的反向推导。
internal/logic/admin/role_crud.go
+2 -2
View File
@@ -30,7 +30,7 @@ var builtinRoleDefaults = map[string][]string{
"channel:view", "channel:create", "channel:edit", "channel:test", "channel:delete",
"model:view", "model:create", "model:edit", "model:delete",
"tenant:view", "tenant:create", "tenant:edit", "tenant:suspend", "tenant:delete", "tenant:close",
"member:view", "member:import", "member:model_scope",
"member:view", "member:import", "member:manage", "member:model_scope",
"plan:view", "plan:create", "plan:edit", "plan:delete",
"billing:view", "billing:export", "billing:refund",
"order:view", "order:refund",
@@ -52,7 +52,7 @@ var builtinRoleDefaults = map[string][]string{
"channel:view", "channel:create", "channel:edit", "channel:test", "channel:delete",
"model:view", "model:create", "model:edit", "model:delete",
"tenant:view", "tenant:create", "tenant:edit", "tenant:suspend",
"member:view", "member:import", "member:model_scope",
"member:view", "member:import", "member:manage", "member:model_scope",
"plan:view", "plan:create", "plan:edit", "plan:delete",
"billing:view",
"order:view",
internal/logic/tenant/member.go
+8
View File
@@ -815,7 +815,15 @@ func (s *sTenant) UpdateMemberRole(ctx context.Context, req *v1.TenantMemberUpda
}
// ResetMemberPassword resets a member's password. Only admins can reset other members' passwords.
//
// 角色校验此前缺失：只挡了「不能重置自己」和「不能重置 owner」，任意 member 都能改掉
// 同组织 admin 的密码并登录该账号，等于组织内横向提权。与相邻的 UnlockMember /
// RemoveMember / UpdateMemberRole 保持同一道闸门。
func (s *sTenant) ResetMemberPassword(ctx context.Context, req *v1.TenantMemberResetPasswordReq) (*v1.TenantMemberResetPasswordRes, error) {
role := middleware.GetUserRole(ctx)
if role != "owner" && role != "admin" {
return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
}
if err := requireTeamEnabled(ctx); err != nil {
return nil, err
}
internal/logic/tenant/member_import.go
+7
View File
@@ -34,7 +34,14 @@ type ImportResult struct {
}
// MemberImport parses CSV content, validates, creates an import record.
//
// 角色校验此前缺失：批量导入会直接创建租户成员账号（并按套餐占用席位），
// 与 MemberCreate / MemberInvite 是同一类动作，必须同为 owner/admin。
func (s *sTenant) MemberImport(ctx context.Context, req *v1.TenantMemberImportReq) (*v1.TenantMemberImportRes, error) {
role := middleware.GetUserRole(ctx)
if role != "owner" && role != "admin" {
return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
}
if err := requireTeamEnabled(ctx); err != nil {
return nil, err
}
internal/logic/tenant/plugin.go
+23
View File
@@ -5,6 +5,7 @@ import (
v1 "github.com/qianfree/team-api/api/tenant/v1"
"github.com/qianfree/team-api/internal/dao"
"github.com/qianfree/team-api/internal/logic/common"
"github.com/qianfree/team-api/internal/middleware"
"github.com/qianfree/team-api/internal/plugin"
@@ -76,7 +77,23 @@ func (s *sTenant) TenantPluginDetail(ctx context.Context, req *v1.TenantPluginDe
}, nil
}
// assertPluginManager 校验插件的写操作权限。
//
// 插件配置与启停是【组织级】设置：一次改动对整个租户的全部成员生效，配置里还可能包含
// 第三方凭据。此前三个写接口只取了 tenantID 就直接落库，任意 member 都能改掉或关停
// 全组织的插件，与 List/Detail（读）同权。读保持全员可见，写收敛到 owner/admin。
func assertPluginManager(ctx context.Context) error {
role := middleware.GetUserRole(ctx)
if role != "owner" && role != "admin" {
return common.NewForbiddenError("需要 owner 或 admin 权限")
}
return nil
}
func (s *sTenant) TenantPluginConfigUpdate(ctx context.Context, req *v1.TenantPluginConfigUpdateReq) (*v1.TenantPluginConfigUpdateRes, error) {
if err := assertPluginManager(ctx); err != nil {
return nil, err
}
tenantID := middleware.GetTenantID(ctx)
if err := plugin.UpdatePluginConfigForTenant(ctx, req.Name, tenantID, req.Config); err != nil {
return nil, err
@@ -85,6 +102,9 @@ func (s *sTenant) TenantPluginConfigUpdate(ctx context.Context, req *v1.TenantPl
}
func (s *sTenant) TenantPluginEnable(ctx context.Context, req *v1.TenantPluginEnableReq) (*v1.TenantPluginEnableRes, error) {
if err := assertPluginManager(ctx); err != nil {
return nil, err
}
tenantID := middleware.GetTenantID(ctx)
if err := plugin.EnableForTenant(ctx, req.Name, tenantID); err != nil {
return nil, err
@@ -93,6 +113,9 @@ func (s *sTenant) TenantPluginEnable(ctx context.Context, req *v1.TenantPluginEn
}
func (s *sTenant) TenantPluginDisable(ctx context.Context, req *v1.TenantPluginDisableReq) (*v1.TenantPluginDisableRes, error) {
if err := assertPluginManager(ctx); err != nil {
return nil, err
}
tenantID := middleware.GetTenantID(ctx)
if err := plugin.DisableForTenant(ctx, req.Name, tenantID); err != nil {
return nil, err
internal/logic/tenant/project.go
+7
View File
@@ -355,7 +355,14 @@ func (s *sTenant) ProjectArchive(ctx context.Context, req *v1.TenantProjectArchi
}
// ProjectUnarchive restores an archived project. Keys are NOT auto-restored.
//
// 角色校验此前缺失：Create/Update/Archive 都要求 owner/admin，唯独恢复归档没拦，
// 任意 member 都能把管理员刚归档的项目恢复回来（归档是治理动作，撤销它同样是）。
func (s *sTenant) ProjectUnarchive(ctx context.Context, req *v1.TenantProjectUnarchiveReq) (*v1.TenantProjectUnarchiveRes, error) {
role := middleware.GetUserRole(ctx)
if role != "owner" && role != "admin" {
return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
}
tenantID := middleware.GetTenantID(ctx)
var project *struct {