Bug502-YuGaoXiang #78

Closed
mrlan wants to merge 0 commits from Bug502-YuGaoXiang into master

Thanks

Thanks
mrlan added 2 commits 2023-01-10 22:10:10 +08:00
wuyuhan added 1 commit 2023-03-20 15:08:39 +08:00
wuyuhan added 5 commits 2023-03-20 20:17:17 +08:00
wuyuhan added 1 commit 2023-03-20 20:20:05 +08:00
mrlan reviewed 2023-03-20 21:33:48 +08:00
@ -0,0 +72,4 @@
def add_article(content, source="manual_input", question="No question"):
with db_session:
# add one atricle to sqlite
Poster
Owner

@wuyuhan

atricle 应该是 article

蓝珲

@wuyuhan `atricle` 应该是 `article` 蓝珲
wuyuhan marked this conversation as resolved
mrlan reviewed 2023-03-20 21:34:35 +08:00
@ -0,0 +5,4 @@
from Login import md5
from datetime import datetime
# ? from difficulty import text_difficulty_level
Poster
Owner

@wuyuhan

如果第8行用不到,可以删除。

蓝珲

@wuyuhan 如果第8行用不到,可以删除。 蓝珲
wuyuhan marked this conversation as resolved
mrlan reviewed 2023-03-20 21:40:29 +08:00
@ -0,0 +81,4 @@
question=question,
)
# ? There is a question that:
# ? How can i get one article level?
Poster
Owner

@wuyuhan

这个 level 是 admin_index.html 表单中手动输入的。

SQLite 数据库 article 表中有 level 字段用于存储文章 level 的,表示文章的困难度(由输入文章的人 admin 决定一个值)。

蓝珲

@wuyuhan 这个 level 是 `admin_index.html` 表单中手动输入的。 SQLite 数据库 `article` 表中有 `level` 字段用于存储文章 level 的,表示文章的困难度(由输入文章的人 admin 决定一个值)。 蓝珲
wuyuhan marked this conversation as resolved
mrlan reviewed 2023-03-20 21:42:10 +08:00
@ -0,0 +94,4 @@
article.first().delete()
def get_articles_len():
Poster
Owner

@wuyuhan

Thanks

函数名改为 get_number_of_articles(), 避免 len 的歧义(容易理解为某篇文章的长度)。

蓝珲

@wuyuhan Thanks 函数名改为 `get_number_of_articles`(), 避免 `len` 的歧义(容易理解为某篇文章的长度)。 蓝珲
wuyuhan marked this conversation as resolved
mrlan added 1 commit 2023-03-21 11:44:21 +08:00
mrlan added 1 commit 2023-03-21 11:48:16 +08:00
mrlan reviewed 2023-03-21 11:55:21 +08:00
app/model.py Outdated
@ -0,0 +1,30 @@
from pony.orm import *
db = Database()
db.bind("sqlite", "./static/wordfreqapp.db", create_db=True) # bind sqlit file
Poster
Owner

@wuyuhan

sqlit 改为 sqlite

@wuyuhan `sqlit` 改为 `sqlite`
wuyuhan marked this conversation as resolved
mrlan reviewed 2023-03-21 12:10:15 +08:00
@ -0,0 +52,4 @@
context["text_list"] = get_page_articles(_cur_page, _page_size)
if request.method == "GET":
if delete_id := int(request.args.get("delete_id", 0)): # delete article
Poster
Owner

@wuyuhan

:= 是啥?

@wuyuhan `:=` 是啥?

sorry,我刚刚才看到dockerfile中的python版本是3.6。
:= 是python3.8新支持的海象运算符,功能是在某个表达式中直接申明变量,化简变量申明过程
考虑到docker中运行的python版本是3.6,我将会修复这个bug

sorry,我刚刚才看到dockerfile中的python版本是3.6。 := 是python3.8新支持的`海象运算符`,功能是在某个表达式中直接申明变量,化简变量申明过程 考虑到docker中运行的python版本是3.6,我将会修复这个bug
mrlan marked this conversation as resolved
wuyuhan added 2 commits 2023-03-21 12:36:09 +08:00
wuyuhan added 1 commit 2023-03-21 12:43:12 +08:00
wuyuhan added 1 commit 2023-03-21 12:46:11 +08:00
mrlan reviewed 2023-03-21 16:16:10 +08:00
@ -27,2 +26,3 @@
<a href="/{{session['username']}}">{{session['username']}}</a> <a href="/admin">管理</a></p>
{% else %}
<p><a href="/login">登录</a> <a href="/signup">注册</a> <a href="/static/usr/instructions.html">使用说明</a></p >
<p><a href="/admin">管理</a> <a href="/login">登录</a> <a href="/signup">注册</a> <a href="/static/usr/instructions.html">使用说明</a></p >
Poster
Owner

@wuyuhan

首页还需要“管理”这个链接吗?因为指定用户名的人登录后自动成为管理员。
没有这个链接会不会更安全?

@wuyuhan 首页还需要“管理”这个链接吗?因为指定用户名的人登录后自动成为管理员。 没有这个链接会不会更安全?

fine, I will do it

fine, I will do it
wuyuhan marked this conversation as resolved
mrlan added 3 commits 2023-03-21 16:24:10 +08:00
mrlan reviewed 2023-03-21 16:28:33 +08:00
@ -0,0 +71,4 @@
<textarea id="content" name="content" class="form-control" placeholder="请输入文章内容"></textarea>
<label for="exampleInputEmail1" class="form-label">文章来源</label>
<textarea id="source" name="source" class="form-control" placeholder="请输入来源"></textarea>
<label for="exampleInputEmail1" class="form-label">文章等级</label>
Poster
Owner

@wuyuhan

文章等级是否换为下拉菜单会比较好?提供1、2、3、4四个等级。

@wuyuhan **文章等级**是否换为下拉菜单会比较好?提供1、2、3、4四个等级。

fine, I will do it

fine, I will do it
wuyuhan marked this conversation as resolved
wuyuhan added 1 commit 2023-03-23 13:32:23 +08:00
wuyuhan added 1 commit 2023-03-23 13:35:22 +08:00
wuyuhan added 1 commit 2023-03-23 13:40:33 +08:00
wuyuhan added 1 commit 2023-03-23 13:48:03 +08:00
wuyuhan added 1 commit 2023-03-23 13:58:27 +08:00
wuyuhan added 3 commits 2023-03-23 17:13:50 +08:00
wuyuhan added 1 commit 2023-03-23 17:34:45 +08:00
mrlan added 3 commits 2023-03-23 21:55:18 +08:00
mrlan added 1 commit 2023-03-23 22:05:46 +08:00
wuyuhan added 3 commits 2023-03-25 21:31:53 +08:00
mrlan added 2 commits 2023-03-25 23:12:01 +08:00
mrlan added 1 commit 2023-03-26 09:45:16 +08:00
mrlan added 1 commit 2023-03-26 09:59:23 +08:00
mrlan added 1 commit 2023-03-26 18:59:22 +08:00
mrlan added 1 commit 2023-03-26 19:06:10 +08:00
mrlan added 3 commits 2023-03-26 21:05:19 +08:00
mrlan added 1 commit 2023-03-26 21:14:33 +08:00
wuyuhan added 1 commit 2023-03-31 13:39:44 +08:00
mrlan added 1 commit 2023-04-01 16:08:05 +08:00
liyufeng reviewed 2023-04-26 19:11:38 +08:00
@ -0,0 +116,4 @@
if request.method == "POST":
data = request.form
username = data.get("username","")
new_password = data.get("new_password", "")

当前端的密码包含&,',",<,>等符号时,此处得到的new_password可能包含错误的文本,例如&会被替换为&amp;,会因此产生问题

当前端的密码包含&,',",<,>等符号时,此处得到的new_password可能包含错误的文本,例如`&`会被替换为`&amp;`,会因此产生问题

并不是new_password处理密码导致文本不匹配,这里没有进行任何转义处理

真正导致重制密码后无法登录的原因是:

  • account_service.py中,使用了escape函数将字符转义。(虽然我并不理解这里转义的目的,但是他会对一些特殊字符进行转义...)
  • 688ed72473/app/account_service.py (L73)

修复这个Bug的方法分为两种

  • new_password进行escape转义
  • 删除account_service.py中的escape

至于选择哪一种方法,再说吧...

并不是`new_password`处理密码导致文本不匹配,这里没有进行任何转义处理 真正导致重制密码后无法登录的原因是: - 在`account_service.py`中,使用了`escape`函数将字符转义。(虽然我并不理解这里转义的目的,但是他会对一些特殊字符进行转义...) - http://121.4.94.30:3000/mrlan/EnglishPal/src/commit/688ed724734fddb4a07e9dd0dc5b6b2ace16e645/app/account_service.py#L73 修复这个Bug的方法分为两种 - 对`new_password`进行`escape`转义 - 删除`account_service.py`中的`escape` 至于选择哪一种方法,再说吧...
Poster
Owner

Thanks

account_service.py 中的 escape 可能是为了防止 SQL injection。

最简单的处理方法, 去掉 generatePassword(688ed72473/app/templates/admin_manage_user.html (L71)) 函数中的 &>, <

下面是各个字符转义后的结果

b	b
c	c
d	d
e	e
f	f
g	g
h	h
i	i
j	j
k	k
l	l
m	m
n	n
o	o
p	p
q	q
r	r
s	s
t	t
u	u
v	v
w	w
x	x
y	y
z	z
A	A
B	B
C	C
D	D
E	E
F	F
G	G
H	H
I	I
J	J
K	K
L	L
M	M
N	N
O	O
P	P
Q	Q
R	R
S	S
T	T
U	U
V	V
W	W
X	X
Y	Y
Z	Z
0	0
1	1
2	2
3	3
4	4
5	5
6	6
7	7
8	8
9	9
!	!
@	@
#	#
$	$
%	%
^	^
&	&amp;
*	*
(	(
)	)
_	_
+	+
~	~
`	`
|	|
}	}
{	{
[	[
]	]
\	\
:	:
;	;
?	?
>	&gt;
<	&lt;
,	,
.	.
/	/
-	-
=	=
Thanks account_service.py 中的 escape 可能是为了防止 SQL injection。 最简单的处理方法, 去掉 [generatePassword](https://)(http://121.4.94.30:3000/mrlan/EnglishPal/src/commit/688ed724734fddb4a07e9dd0dc5b6b2ace16e645/app/templates/admin_manage_user.html#L71) 函数中的 `&`, `>`, `<`。 下面是各个字符转义后的结果 ``` b b c c d d e e f f g g h h i i j j k k l l m m n n o o p p q q r r s s t t u u v v w w x x y y z z A A B B C C D D E E F F G G H H I I J J K K L L M M N N O O P P Q Q R R S S T T U U V V W W X X Y Y Z Z 0 0 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 ! ! @ @ # # $ $ % % ^ ^ & &amp; * * ( ( ) ) _ _ + + ~ ~ ` ` | | } } { { [ [ ] ] \ \ : : ; ; ? ? > &gt; < &lt; , , . . / / - - = = ```
zhouhaojie requested changes 2023-05-06 17:21:28 +08:00
@ -0,0 +68,4 @@
<script>
// 密码生成器
function generatePassword(length) {
var charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+~`|}{[]\:;?><,./-=";

为了修复产生的Bug 531,将上述的charset修改为

const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^*()_+~`|}{[]\:;?,./-=";

同时需要使用const来修饰常量遵守ES6语法规范

为了修复产生的[Bug 531](http://118.25.96.118/bugzilla/show_bug.cgi?id=531),将上述的charset修改为 ```js const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^*()_+~`|}{[]\:;?,./-="; ``` 同时需要使用`const`来修饰常量遵守ES6语法规范
@ -0,0 +69,4 @@
// 密码生成器
function generatePassword(length) {
var charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+~`|}{[]\:;?><,./-=";
var password = "";

应使用let来修饰局部变量,遵守ES6规范

应使用`let`来修饰局部变量,遵守ES6规范
@ -0,0 +70,4 @@
function generatePassword(length) {
var charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+~`|}{[]\:;?><,./-=";
var password = "";
for (var i = 0; i < length; i++) {

同理。var i改为let i

同理。`var i`改为`let i`
wuyuhan added 1 commit 2023-05-06 17:25:28 +08:00
wuyuhan requested review from zhouhaojie 2023-05-06 17:27:31 +08:00
zhouhaojie requested changes 2023-05-06 17:40:58 +08:00
@ -0,0 +91,4 @@
question = data.get("question", "")
level = data.get("level", "4")
if content:
try: # check level

这里的try except如果仅仅是想用来判断level是否正确,只需要用if判断,而不需要raise异常

if level not in ['1', '2', '3', '4']:
   return "Level must be between 1 and 4."
这里的try except如果仅仅是想用来判断level是否正确,只需要用if判断,而不需要raise异常 ```python if level not in ['1', '2', '3', '4']: return "Level must be between 1 and 4." ```
wuyuhan added 1 commit 2023-05-06 17:42:17 +08:00
wuyuhan requested review from zhouhaojie 2023-05-06 17:42:28 +08:00
Poster
Owner

已经并入 Alpha-snapshot

已经并入 Alpha-snapshot
mrlan closed this pull request 2023-07-06 21:58:11 +08:00

Pull request closed

Sign in to join this conversation.
No reviewers
No Label
No Milestone
No project
No Assignees
4 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: mrlan/EnglishPal#78
There is no content yet.