Comments (5)
"""
将登录票据设置为不合法
"""
bk_token = request.COOKIES.get(settings.BK_COOKIE_NAME, None)
if bk_token:
bk_token = urllib.parse.unquote(bk_token)
BkToken.objects.filter(token=bk_token).update(is_logout=True)
from bk-user.
已确认,该问题确实存在,但是提交的PR方案可能我们还需要讨论一下
方案1:加密上确保不存在可被转义的特殊字符
方案2:对bk_token从cookie获取后进行unquote
from bk-user.
从目前django的源码来看,是有对cookie进行unquote的,还需要进一步排查
from bk-user.
已确认,这里的cookie._unquote与urllib.parse.unquote并非相同作用,所以PR https://github.com/TencentBlueKing/bk-user/pull/951/files 是�OK的
from bk-user.
@nannan00 这里是要讨论下,因为从Cookies里面拿数据是经常的行为,每个地方都unquote是不太方便。建议先这样处理,其他地方如果有问题了,再统一搞一个合适的方案。
from bk-user.
Related Issues (20)
- [Release 3.0] 前端-登录配置
- [Release 3.0] 登录流程
- [Release 3.0] 前端-消息通知
- [Release 3.0] 前端-版本日志
- 部署前置初始化
- 点击返回首页
- [Release 3.0] 前端-跨租户协同
- [Release 3.0] API - 跨租户协同
- [讨论] 在用户删除后重新同步或录入后 UserID 是否变更
- 3.x 版本 自测体验 & 修复优化
- helm 部署文档链接跳转 404 HOT 1
- 配置AD登录,使用AD用户登录非常慢,如何排查? HOT 1
- 用户管理审计日志
- 日志配置规范化
- 支持用户 DisplayName 功能
- 产品页面涉及创建编辑支持实时校验
- 支持未有过登录历史的用户配置权限
- 用户设置账号有效期可设定为特定的日期 HOT 3
- 支持租户管理员设置个人账号有效期
- --
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bk-user.