gandc/x-ui
1
0
Fork 0
mirror of https://github.com/alireza0/x-ui.git synced 2026-03-14 05:23:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

safe login #1365

Browse Source
This commit is contained in:
Alireza Ahmadi
2024-07-14 03:19:12 +02:00
parent 073bfb8991
commit 84ecdae7ca
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
web/controller/index.go
View File

@@ -2,6 +2,7 @@ package controller
import ( import (
"net/http" "net/http"
"text/template"
"time" "time"
"x-ui/logger" "x-ui/logger"
@@ -62,14 +63,16 @@ func (a *IndexController) login(c *gin.Context) {
user := a.userService.CheckUser(form.Username, form.Password) user := a.userService.CheckUser(form.Username, form.Password)
timeStr := time.Now().Format("2006-01-02 15:04:05") timeStr := time.Now().Format("2006-01-02 15:04:05")
safeUser := template.HTMLEscapeString(form.Username)
safePass := template.HTMLEscapeString(form.Password)
if user == nil { if user == nil {
logger.Infof("wrong username or password: \"%s\" \"%s\"", form.Username, form.Password) logger.Infof("wrong username or password: \"%s\" \"%s\"", safeUser, safePass)
a.tgbot.UserLoginNotify(form.Username, getRemoteIp(c), timeStr, 0) a.tgbot.UserLoginNotify(safeUser, getRemoteIp(c), timeStr, 0)
pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.wrongUsernameOrPassword")) pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.wrongUsernameOrPassword"))
return return
} else { } else {
logger.Infof("%s Successful Login ,Ip Address: %s\n", form.Username, getRemoteIp(c)) logger.Infof("%s Successful Login ,Ip Address: %s\n", safeUser, getRemoteIp(c))
a.tgbot.UserLoginNotify(form.Username, getRemoteIp(c), timeStr, 1) a.tgbot.UserLoginNotify(safeUser, getRemoteIp(c), timeStr, 1)
} }
sessionMaxAge, err := a.settingService.GetSessionMaxAge() sessionMaxAge, err := a.settingService.GetSessionMaxAge()

3
web/session/session.go
View File

@@ -19,6 +19,9 @@ func init() {
func SetLoginUser(c *gin.Context, user *model.User) error { func SetLoginUser(c *gin.Context, user *model.User) error {
s := sessions.Default(c) s := sessions.Default(c)
s.Options(sessions.Options{
HttpOnly: true,
})
s.Set(loginUser, user) s.Set(loginUser, user)
return s.Save() return s.Save()
} }