Merge pull request #3321 from jumpserver/pr@v3.4@fix_msg_subscribe_for_xss

fix: 修复系统设置 > 消息订阅 > 修改订阅人 因为用户名导致的 xss

src/components/FormFields/JSONManyToManySelect/AttrFormDialog.vue

@@ -65,8 +65,7 @@ export default {
                 // 变化会影响 match 的选项
                 const attr = this.attrs.find(attr => attr.name === val)
                 if (!attr) return
-                const matchSupports = vm.updateMatchOptions(attr)
-                const matchOption = matchSupports.find(item => item.value === vm.form.match) || matchSupports[0]
+                const matchOption = vm.updateMatchOptions(attr)
                 setTimeout(() => {
                   updateForm({ match: matchOption.value })
                 }, 10)
@@ -143,8 +142,9 @@ export default {
       })
       this.formConfig.fields[2].el.attr = attr
       const supports = attrMatchOptions.filter(option => !option.hidden)
-      this.formConfig.fields[2].el.match = supports[0].value
-      return supports
+      const matchOption = supports.find(item => item.value === this.form.match) || supports[0]
+      this.formConfig.fields[2].el.match = matchOption.value
+      return matchOption
     }
   }
 }

src/components/FormFields/JSONManyToManySelect/ValueField.vue

@@ -81,6 +81,7 @@ export default {
     changeValueType() {
       this.loading = true
       this.type = this.getType()
+      console.log('Type is: ', this.type, this.match)
       this.$nextTick(() => {
         this.loading = false
       })

src/i18n/langs/en.json

@@ -1378,6 +1378,8 @@
     "UserLoginAclCreate": "Create user login acl",
     "UserLoginAclUpdate": "Update user login acl",
     "UserLoginAclList": "User login acl",
+    "UserLoginAclDetail": "User login acl detail",
+    "ConnectMethodAclDetail": "Connect method acl detail",
     "ConnectMethodAclCreate": "Create connect method acl",
     "ConnectMethodAclList": "Connect method acl",
     "ConnectMethodAclUpdate": "Update connect method acl"

src/i18n/langs/ja.json

@@ -1375,6 +1375,8 @@
     "UserLoginAclList": "ユーザーログイン",
     "ConnectMethodAclCreate": "接続方式制御の作成",
     "ConnectMethodAclList": "接続方式",
+    "ConnectMethodAclDetail": "接続方式制御の詳細",
+    "UserLoginAclDetail": "ユーザーログイン制御の詳細",
     "ConnectMethodAclUpdate": "接続方式制御ルールの更新"
   },
   "rbac": {

src/i18n/langs/zh.json

@@ -1159,8 +1159,10 @@
     "Acls": "访问控制",
     "UserLoginAclCreate": "创建用户登录控制",
     "UserLoginAclList": "用户登录",
+    "UserLoginAclDetail": "用户登录控制详情",
     "UserLoginAclUpdate": "更新用户登录控制",
     "ConnectMethodAclList": "连接方式",
+    "ConnectMethodAclDetail": "连接方式控制详情",
     "ConnectMethodAclCreate": "创建连接方式控制",
     "ConnectMethodAclUpdate": "更新连接方式控制",
     "AppletDetail": "远程应用",

src/router/console/acls.js

@@ -38,7 +38,7 @@ export default [
         component: () => import('@/views/acl/UserLoginACL/UserDetail/index'),
         hidden: true,
         meta: {
-          title: i18n.t('route.AssetAclDetail'),
+          title: i18n.t('route.UserLoginAclDetail'),
           app: 'acls',
           resource: 'loginacl'
         }
@@ -219,7 +219,7 @@ export default [
         name: 'ConnectMethodAclDetail',
         component: () => import('@/views/acl/ConnectMethodAcl/ConnectMethodAclDetail/index'),
         hidden: true,
-        meta: { title: i18n.t('route.AssetAclDetail') }
+        meta: { title: i18n.t('route.ConnectMethodAclDetail') }
       },
       {
         path: ':id/update',

src/utils/org.js

@@ -35,7 +35,10 @@ async function changeOrg(org, reload = true, vm = null) {
   }
   // 替换 Path 中的 UUID
   const idRegex = /\/?([a-fA-F0-9]{8}-(?:[a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12})|(-?\d+(\.\d+)?)\/?/
-  path = path.replace(idRegex, '')
+  const i = path.search(idRegex)
+  if (i !== -1) {
+    path = path.slice(0, i + 1)
+  }
 
   // 替换 Query 中的 UUID
   const newQuery = {}

src/views/assets/Asset/AssetList/components/BaseList.vue

@@ -192,8 +192,8 @@ export default {
                   can: ({ row }) =>
                     this.$hasPerm('assets.test_assetconnectivity') &&
                     !this.$store.getters.currentOrgIsRoot &&
-                    row['auto_config'].ansible_enabled &&
-                    row['auto_config'].ping_enabled,
+                    row?.auto_config?.ansible_enabled &&
+                    row?.auto_config?.ping_enabled,
                   callback: ({ row }) => {
                     if (row.platform.name === 'Gateway') {
                       this.GatewayVisible = true

src/views/profile/ProfileUpdate/PasswordUpdate.vue

@@ -45,7 +45,10 @@ export default {
         new_password: {
           label: this.$t('users.NewPassword'),
           rules: [rules.RequiredChange],
-          component: UserPassword
+          component: UserPassword,
+          el: {
+            userIsOrgAdmin: false
+          }
         },
         new_password_again: {
           label: this.$t('users.ConfirmPassword'),
@@ -57,6 +60,9 @@ export default {
       }
     }
   },
+  mounted() {
+    this.fieldsMeta.new_password.el.userIsOrgAdmin = this.object['is_org_admin']
+  },
   methods: {
     submitMethod() {
       return 'put'

src/views/sessions/SessionList/BaseList.vue

@@ -27,6 +27,7 @@ export default {
       tableConfig: {
         url: this.url,
         columnsExtra: ['index', 'duration'],
+        columnsExclude: ['terminal'],
         columnsShow: {
           min: ['id', 'actions'],
           default: [

src/views/settings/Message/SelectDialog.vue

@@ -2,13 +2,13 @@
   <Dialog
     ref="myDialog"
     :destroy-on-close="true"
-    width="790px"
     height="720px"
     v-bind="$attrs"
+    width="790px"
     @confirm="submit"
     v-on="$listeners"
   >
-    <krryPaging ref="pageTransfer" v-bind="pagingTransfer" class="transfer" />
+    <krryPaging ref="pageTransfer" class="transfer" v-bind="pagingTransfer" />
   </Dialog>
 </template>
 
@@ -16,6 +16,7 @@
 import Dialog from '@/components/Dialog'
 import { krryPaging } from 'krry-transfer'
 import { getUserList } from '@/api/users'
+
 export default {
   name: 'ListSelect',
   components: {
@@ -47,7 +48,7 @@ export default {
           }
           const data = await getUserList(params)
           const results = data['results'].map(item => {
-            return { id: item.id, label: `${item.name}(${item.username})` }
+            return { id: item.id, label: _.escape(`${item.name}(${item.username})`) }
           })
           return results
         },
@@ -62,7 +63,7 @@ export default {
           }
           const data = await getUserList(params)
           const results = data['results'].map(item => {
-            return { id: item.id, label: `${item.name}(${item.username})` }
+            return { id: item.id, label: _.escape(`${item.name}(${item.username})`) }
           })
           return results
         },

src/views/settings/Terminal/Endpoint/EndpointCreateUpdate.vue

@@ -37,7 +37,7 @@ export default {
       ],
       fieldsMeta: {
         host: {
-          disabled: ({ row }) => row.id === '00000000-0000-0000-0000-000000000001'
+          disabled: this.$route.params.id === '00000000-0000-0000-0000-000000000001'
         },
         oracle_port_range: {
           disabled: true
@@ -47,6 +47,7 @@ export default {
     }
   },
   computed: {},
+  created() {},
   methods: {}
 }
 </script>

src/views/users/User/UserCreateUpdate.vue

@@ -55,10 +55,13 @@ export default {
         password: {
           component: UserPassword,
           hidden: (formValue) => {
-            if (formValue.password_strategy === 'custom') {
+            if (formValue.source !== 'local') {
+              return true
+            }
+            if (formValue.password_strategy === 'custom' || formValue.update_password) {
               return false
             }
-            return !formValue.update_password || formValue.source !== 'local'
+            return true
           },
           el: {
             required: false,
@@ -79,10 +82,13 @@ export default {
             }
           ],
           hidden: (formValue) => {
-            if (formValue.password_strategy === 'custom') {
+            if (formValue.source !== 'local') {
+              return true
+            }
+            if (formValue.password_strategy === 'custom' || formValue.update_password || this.user.can_public_key_auth) {
               return false
             }
-            return !formValue.update_password || !this.user.can_public_key_auth
+            return true
           }
         },
         set_public_key: {
@@ -193,7 +199,7 @@ export default {
   methods: {
     afterGetUser(user) {
       this.user = user
-      this.fieldsMeta.password.el.userIsOrgAdmin = user.role === 'Admin' || user.org_roles.indexOf('Admin') !== -1
+      this.fieldsMeta.password.el.userIsOrgAdmin = user['is_org_admin']
       if (this.$route.query.clone_from) {
         this.user.groups = []
       }