feat: Update v3.5.5

fix: 修复系统设置 > 消息订阅 > 修改订阅人 因为用户名导致的 xss

.github/workflows/release-drafter.yml

@@ -42,7 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@v2
       - name: Build it and upload
-        uses: jumpserver/action-build-upload-assets@node10
+        uses: jumpserver/action-build-upload-assets@node14.16
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

GITSHA

@@ -0,0 +1 @@
+2360da53dd0386ea7f8ec4e26f649aa3451bd8f0

src/components/AccountCreateUpdateForm/index.vue

@@ -304,6 +304,9 @@ export default {
       form.secret = form[secretType]
       form.secret = this.encryptPassword ? encryptPassword(form.secret) : form.secret
 
+      // 如果不删除会明文显示
+      delete form[secretType]
+
       if (!form.secret) {
         delete form['secret']
       }

src/views/sessions/CommandList.vue

@@ -49,7 +49,7 @@ export default {
         },
         columns: [
           'expandCol', 'input', 'risk_level', 'user', 'remote_addr',
-          'asset', 'session', 'timestamp'
+          'asset', 'account', 'session', 'timestamp'
         ],
         extraQuery: {
           date_to: dateTo,

src/views/settings/Message/SelectDialog.vue

@@ -2,13 +2,13 @@
   <Dialog
     ref="myDialog"
     :destroy-on-close="true"
-    width="790px"
     height="720px"
     v-bind="$attrs"
+    width="790px"
     @confirm="submit"
     v-on="$listeners"
   >
-    <krryPaging ref="pageTransfer" v-bind="pagingTransfer" class="transfer" />
+    <krryPaging ref="pageTransfer" class="transfer" v-bind="pagingTransfer" />
   </Dialog>
 </template>
 
@@ -16,6 +16,7 @@
 import Dialog from '@/components/Dialog'
 import { krryPaging } from 'krry-transfer'
 import { getUserList } from '@/api/users'
+
 export default {
   name: 'ListSelect',
   components: {
@@ -47,7 +48,7 @@ export default {
           }
           const data = await getUserList(params)
           const results = data['results'].map(item => {
-            return { id: item.id, label: `${item.name}(${item.username})` }
+            return { id: item.id, label: _.escape(`${item.name}(${item.username})`) }
           })
           return results
         },
@@ -62,7 +63,7 @@ export default {
           }
           const data = await getUserList(params)
           const results = data['results'].map(item => {
-            return { id: item.id, label: `${item.name}(${item.username})` }
+            return { id: item.id, label: _.escape(`${item.name}(${item.username})`) }
           })
           return results
         },