bwadmin/pear-admin-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修补日志的xss漏洞

Browse Source
This commit is contained in:
mkg
2021-10-13 19:38:28 +08:00
parent c7f266a482
commit 7eb41e9754
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/common/admin_log.py
+5 -4
View File
@@ -1,5 +1,6 @@
from flask_login import current_user from flask_login import current_user
from applications.common.utils.validate import xss_escape
from applications.extensions import db from applications.extensions import db
from applications.models import AdminLog from applications.models import AdminLog
@@ -9,8 +10,8 @@ def login_log(request, uid, is_access):
'method': request.method, 'method': request.method,
'url': request.path, 'url': request.path,
'ip': request.remote_addr, 'ip': request.remote_addr,
'user_agent': request.headers.get('User-Agent'), 'user_agent': xss_escape(request.headers.get('User-Agent')),
'desc': request.form.get('username'), 'desc': xss_escape(request.form.get('username')),
'uid': uid, 'uid': uid,
'success': int(is_access) 'success': int(is_access)
@@ -35,8 +36,8 @@ def admin_log(request, is_access):
'method': request.method, 'method': request.method,
'url': request.path, 'url': request.path,
'ip': request.remote_addr, 'ip': request.remote_addr,
'user_agent': request.headers.get('User-Agent'), 'user_agent': xss_escape(request.headers.get('User-Agent')),
'desc': str(dict(request.values)), 'desc': xss_escape(str(dict(request.values))),
'uid': current_user.id, 'uid': current_user.id,
'success': int(is_access) 'success': int(is_access)