mirror of
https://github.com/PRVTPRO/Amnezia-Web-Panel.git
synced 2026-10-23 03:37:36 +09:00
Максимов Владимир Сергеевич
553f41926d
Security: - reject existing sessions for disabled and record-only accounts - enforce protocol and instance ownership when downloading configurations - store CAPTCHA answers server-side with expiry and replay protection - revoke share authorization after password changes or sharing is disabled - restrict language-switch redirects and harden language cookies - limit JSON backup size and improve input validation - quote Telemt command arguments and SSH upload paths - use private temporary directories for sudo operations and backup downloads - selectively update dependencies to address confirmed vulnerabilities Fixes and localization: - fix service worker and static asset version paths in PyInstaller builds - complete French, Persian, and Chinese translations to match all 687 keys - translate remaining English strings in those locales - add security, bundled-resource, and translation completeness regression tests - add English and Russian security reports documenting fixes and remaining risks
50 lines
1.8 KiB
Python
50 lines
1.8 KiB
Python
"""Bundled PWA assets must not be resolved beside the executable."""
|
|
import os
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
import app as panel
|
|
|
|
|
|
STATIC = Path(panel.__file__).resolve().parent / 'static'
|
|
|
|
|
|
class PwaResourcePathTests(unittest.TestCase):
|
|
def test_service_worker_from_source(self):
|
|
response = TestClient(panel.app).get('/sw.js?v=123')
|
|
self.assert_worker(response)
|
|
|
|
def test_service_worker_when_executable_is_outside_bundle(self):
|
|
# PyInstaller puts __file__ in its extracted bundle, while
|
|
# application_path points at the directory containing the executable.
|
|
with tempfile.TemporaryDirectory() as executable_dir:
|
|
with patch.object(panel, 'application_path', executable_dir):
|
|
response = TestClient(panel.app).get('/sw.js?v=123')
|
|
self.assert_worker(response)
|
|
|
|
def assert_worker(self, response):
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertEqual(response.content, (STATIC / 'sw.js').read_bytes())
|
|
self.assertTrue(response.headers['content-type'].startswith('text/javascript'))
|
|
self.assertEqual(response.headers['cache-control'], 'no-cache')
|
|
self.assertEqual(response.headers['service-worker-allowed'], '/')
|
|
|
|
def test_static_version_when_executable_is_outside_bundle(self):
|
|
expected = str(int(max(
|
|
os.path.getmtime(Path(root) / name)
|
|
for root, _, files in os.walk(STATIC)
|
|
for name in files
|
|
)))
|
|
self.assertNotEqual(expected, '0')
|
|
with tempfile.TemporaryDirectory() as executable_dir:
|
|
with patch.object(panel, 'application_path', executable_dir):
|
|
self.assertEqual(panel.static_version(), expected)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|