FIX : 用户信息password字段隐藏.避免安全隐患. #297
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
SystemUserService.php: 1. 重写 token-key 正则匹配 2. kickUser 保证获取到所有token，一次性全部下线。 3. hasTokenBlack 只判断传入token所在scene的情况，否则会导致判断多重scene而导致在线用户监控列表出错。
dosubot
bot
added
size:M
dosubot
bot
added
size:XS
dosubot
bot
added
size:S
zds-s
previously approved these changes
Jul 5, 2024
zds-s
approved these changes
Jul 5, 2024
|
感谢 |
|
再次感谢，提一个小小建议。如果后面还有功能建议的话，从 master 迁出一份分支再往主仓库提交 具体可以参考 |
littlezo
approved these changes
Jul 5, 2024
zds-s
added a commit
that referenced
this pull request
Jul 9, 2024
* Fix(filterExecuteAttributes): Utilizing memory address pointers (#294) * LoginListener.php: 修复因为多点登录复用同一个token导致该账号最近一次登录的设备登出就无法获得正确的用户在线情况 (#295) SystemUserService.php: 1. 重写 token-key 正则匹配 2. kickUser 保证获取到所有token，一次性全部下线。 3. hasTokenBlack 只判断传入token所在scene的情况，否则会导致判断多重scene而导致在线用户监控列表出错。 * FIX : 用户信息password字段隐藏.避免安全隐患. (#297) * LoginListener.php: 修复因为多点登录复用同一个token导致该账号最近一次登录的设备登出就无法获得正确的用户在线情况 SystemUserService.php: 1. 重写 token-key 正则匹配 2. kickUser 保证获取到所有token，一次性全部下线。 3. hasTokenBlack 只判断传入token所在scene的情况，否则会导致判断多重scene而导致在线用户监控列表出错。 * fix 用户返回信息会出现password字段，虽然是加密过的字段，但依旧存在安全隐患。故隐藏。 * UserAuthService.php 修复因为隐藏password导致user模型 toarray之后无法获取password导致登录流程出错的问题 * UserAuthService.php fix:获取主键value 而不是主键 key （Tab 按快了） * Fix: 优化 is_in_container 函数(#298) --------- Co-authored-by: PeopleSea <70972819+People-Sea@users.noreply.github.com> Co-authored-by: ShaBaoFa <wlfpanda1012@gmail.com> Co-authored-by: clq321 <405292878@qq.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
起因：在线监控发现返回的用户信息包含password，个人认为应该没有场景需要返回加密（或未加密）的密码信息。所以直接在model层进行了hidden处理。