gaoxiaopei
/
monitor-ai
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: LDAP 登录 cookie secure 属性 + role 白名单校验

This commit is contained in:
aiyimickey 2026-07-03 13:32:00 +08:00
parent 8625850781
commit 2afb98ff1d
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/app/api/admin/users/[id]/route.ts
View File

@ -35,6 +35,11 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
if (existing[0].username === 'admin' || existing[0].username === 'localadmin') { if (existing[0].username === 'admin' || existing[0].username === 'localadmin') {
return NextResponse.json({ error: '不能修改系统保留用户的角色' }, { status: 400 }) return NextResponse.json({ error: '不能修改系统保留用户的角色' }, { status: 400 })
} }
// role 白名单校验
const validRoles = ['admin', 'editor', 'viewer']
if (!validRoles.includes(role)) {
return NextResponse.json({ error: `无效角色，允许值: ${validRoles.join(', ')}` }, { status: 400 })
}
updates.push(`role = '${role.replace(/'/g, "''")}'`) updates.push(`role = '${role.replace(/'/g, "''")}'`)
details.role = role details.role = role
} }

2
src/app/api/auth/login/route.ts
View File

@ -88,7 +88,7 @@ export async function POST(request: NextRequest) {
user: { username, role, displayName: result.displayName || username }, user: { username, role, displayName: result.displayName || username },
}) })
response.cookies.set('tlyq_session', token, { response.cookies.set('tlyq_session', token, {
httpOnly: true, secure: false, sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800, httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
}) })
return response return response
} }