yan/archived-rttys-zhaojh329
1
0
Fork 0
mirror of https://github.com/netfun2000/rttys_zhaojh329.git synced 2026-02-27 09:53:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

improve authentication logic for empty password

Browse Source 
- Move empty password check from httpLogin to httpAuth
- httpLogin now only validates actual password comparison
- httpAuth handles empty password as authentication bypass
- This ensures consistent authentication behavior across all endpoints

Previously, empty password would always return true in httpLogin,
now it's properly handled at the authentication middleware level.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
This commit is contained in:
Jianhui Zhao
2025-07-19 15:32:23 +08:00
parent dd10162d34
commit 3efb274902
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api.go
+5 -1
View File
@@ -351,7 +351,7 @@ func callUserHookUrl(cfg *Config, c *gin.Context) bool {
} }
func httpLogin(cfg *Config, password string) bool { func httpLogin(cfg *Config, password string) bool {
return cfg.Password == "" || cfg.Password == password return cfg.Password == password
} }
func isLocalRequest(c *gin.Context) bool { func isLocalRequest(c *gin.Context) bool {
@@ -364,6 +364,10 @@ func httpAuth(cfg *Config, c *gin.Context) bool {
return true return true
} }
if cfg.Password == "" {
return true
}
sid, err := c.Cookie("sid") sid, err := c.Cookie("sid")
if err != nil || !httpSessions.Exists(sid) { if err != nil || !httpSessions.Exists(sid) {
return false return false