mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-22 02:27:57 +00:00
zhangwenjian
dcc2c8e175
The answer was written at info level on every captcha request, so a currently valid answer sat in the application log. Anyone able to read the log - an operator, a log aggregator, anything that ships logs off the host - could bypass the check the captcha exists to enforce. The default log level records it, so this was not limited to debug builds.
41 lines
1.1 KiB
Go
41 lines
1.1 KiB
Go
package apis
|
|
|
|
import (
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/go-admin-team/go-admin-core/v2/captcha"
|
|
"github.com/go-admin-team/go-admin-core/v2/sdk/api"
|
|
)
|
|
|
|
type System struct {
|
|
api.Api
|
|
}
|
|
|
|
// GenerateCaptchaHandler 获取验证码
|
|
// @Summary 获取验证码
|
|
// @Description 获取验证码
|
|
// @Tags 登陆
|
|
// @Success 200 {object} response.Response{data=string,id=string,msg=string} "{"code": 200, "data": [...]}"
|
|
// @Router /api/v1/captcha [get]
|
|
func (e System) GenerateCaptchaHandler(c *gin.Context) {
|
|
if err := e.MakeContext(c).Errors; err != nil {
|
|
e.Error(500, err, "服务初始化失败！")
|
|
return
|
|
}
|
|
// The answer is deliberately discarded rather than logged. It used to be
|
|
// written at info level, which put a currently valid captcha answer in the
|
|
// application log - anyone able to read the log could bypass the check the
|
|
// captcha exists to enforce.
|
|
id, b64s, _, err := captcha.DriverDigitFunc()
|
|
if err != nil {
|
|
e.Logger.Errorf("DriverDigitFunc error, %s", err.Error())
|
|
e.Error(500, err, "验证码获取失败")
|
|
return
|
|
}
|
|
e.Custom(gin.H{
|
|
"code": 200,
|
|
"data": b64s,
|
|
"id": id,
|
|
"msg": "success",
|
|
})
|
|
}
|