mirror of
https://github.com/jumpserver/jumpserver.git
synced 2025-09-28 08:06:27 +00:00
perf: Validate connection token id
This commit is contained in:
@@ -618,6 +618,8 @@ class SuperConnectionTokenViewSet(ConnectionTokenViewSet):
|
||||
|
||||
token_id = request.data.get('id') or ''
|
||||
token = ConnectionToken.get_typed_connection_token(token_id)
|
||||
if not token:
|
||||
raise PermissionDenied('Token {} is not valid'.format(token))
|
||||
token.is_valid()
|
||||
serializer = self.get_serializer(instance=token)
|
||||
|
||||
|
@@ -4,6 +4,7 @@ from datetime import timedelta
|
||||
|
||||
from django.conf import settings
|
||||
from django.core.cache import cache
|
||||
from django.core.exceptions import ValidationError
|
||||
from django.db import models
|
||||
from django.shortcuts import get_object_or_404
|
||||
from django.utils import timezone
|
||||
@@ -76,7 +77,10 @@ class ConnectionToken(JMSOrgBaseModel):
|
||||
|
||||
@classmethod
|
||||
def get_typed_connection_token(cls, token_id):
|
||||
token = get_object_or_404(cls, id=token_id)
|
||||
try:
|
||||
token = get_object_or_404(cls, id=token_id)
|
||||
except ValidationError:
|
||||
return None
|
||||
|
||||
if token.type == ConnectionTokenType.ADMIN.value:
|
||||
token = AdminConnectionToken.objects.get(id=token_id)
|
||||
|
Reference in New Issue
Block a user