Upload 7 files

app.py

@@ -7,8 +7,13 @@ import signal
 import queue
 from datetime import datetime
 from flask import Flask, render_template, request, jsonify, send_file, abort, redirect, url_for
-from flask_socketio import SocketIO, emit
+from flask_socketio import SocketIO, emit, join_room, leave_room
 import sys
+import logging
+
+# 配置日志
+logging.basicConfig(level=logging.DEBUG, format='%(asctime)s - %(levelname)s - %(message)s')
+logger = logging.getLogger(__name__)
 
 app = Flask(__name__)
 app.config['SECRET_KEY'] = 'webshell-secret-key-2024'
@@ -25,21 +30,27 @@ class Terminal:
         self.output_queue = queue.Queue()
         self.input_queue = queue.Queue()
         self.running = False
+        logger.info(f"创建终端实例: {session_id}, Windows: {self.is_windows}")
         
     def spawn(self):
         """启动终端进程"""
         try:
+            logger.info(f"启动终端进程 {self.session_id}")
             if self.is_windows:
-                # Windows环境使用cmd
+                # Windows环境使用cmd，使用简化的参数
                 self.process = subprocess.Popen(
-                    'cmd',
+                    ['cmd.exe', '/Q'],  # /Q 参数关闭回显
                     stdin=subprocess.PIPE,
                     stdout=subprocess.PIPE,
                     stderr=subprocess.STDOUT,
                     text=True,
-                    shell=True,
-                    bufsize=0
+                    shell=False,
+                    bufsize=1,    # 行缓冲
+                    universal_newlines=True,
+                    cwd=os.getcwd(),
+                    env=os.environ.copy()
                 )
+                logger.info(f"CMD进程已启动，PID: {self.process.pid}")
             else:
                 # Unix/Linux环境使用bash
                 import pty
@@ -50,6 +61,7 @@ class Terminal:
                 else:
                     # 父进程
                     self.set_winsize(24, 80)
+                    logger.info(f"PTY进程已启动，PID: {self.child_pid}")
             
             self.running = True
             
@@ -57,41 +69,92 @@ class Terminal:
             if self.is_windows:
                 self._start_output_thread()
                 self._start_input_thread()
+            else:
+                self._start_pty_thread()
             
+            logger.info(f"终端 {self.session_id} 启动成功")
             return True
         except Exception as e:
-            print(f"启动终端失败: {e}")
+            logger.error(f"启动终端失败: {e}")
             return False
     
     def _start_output_thread(self):
         """启动输出读取线程（Windows）"""
         def read_output():
+            logger.info(f"输出读取线程启动 {self.session_id}")
             while self.running and self.process and self.process.poll() is None:
                 try:
-                    line = self.process.stdout.readline()
-                    if line:
-                        self.output_queue.put(line)
+                    # 检查进程是否还活着
+                    if self.process.poll() is not None:
+                        logger.warning(f"进程已退出: {self.process.poll()}")
+                        break
+                    
+                    # 尝试读取一行
+                    try:
+                        line = self.process.stdout.readline()
+                        if line:
+                            logger.debug(f"读取到输出: {repr(line)}")
+                            self.output_queue.put(line)
+                        else:
+                            # 没有数据时短暂等待
+                            time.sleep(0.05)
+                    except Exception as read_err:
+                        logger.error(f"读取stdout错误: {read_err}")
+                        time.sleep(0.1)
+                        
                 except Exception as e:
-                    print(f"读取输出错误: {e}")
+                    logger.error(f"输出线程异常: {e}")
                     break
                     
+            logger.info(f"输出读取线程结束 {self.session_id}")
+                    
         threading.Thread(target=read_output, daemon=True).start()
     
     def _start_input_thread(self):
         """启动输入处理线程（Windows）"""
         def process_input():
+            logger.info(f"输入处理线程启动 {self.session_id}")
             while self.running and self.process and self.process.poll() is None:
                 try:
                     if not self.input_queue.empty():
                         data = self.input_queue.get(timeout=0.1)
+                        logger.debug(f"写入命令: {repr(data)}")
                         if self.process.stdin:
                             self.process.stdin.write(data)
                             self.process.stdin.flush()
-                except:
-                    pass
+                            logger.debug(f"命令已写入并刷新缓冲区")
+                            
+                            # 立即发送回显
+                            if not data.endswith('\n'):
+                                # 如果不是完整命令，发送回显
+                                self.output_queue.put(data)
+                except Exception as e:
+                    logger.error(f"处理输入错误: {e}")
                 time.sleep(0.01)
+            logger.info(f"输入处理线程结束 {self.session_id}")
                     
         threading.Thread(target=process_input, daemon=True).start()
+    
+    def _start_pty_thread(self):
+        """启动PTY线程（Linux）"""
+        def pty_thread():
+            logger.info(f"PTY线程启动 {self.session_id}")
+            while self.running:
+                try:
+                    import select
+                    ready, _, _ = select.select([self.fd], [], [], 0.1)
+                    if ready:
+                        data = os.read(self.fd, 1024)
+                        if data:
+                            output = data.decode('utf-8', errors='ignore')
+                            logger.debug(f"PTY输出: {repr(output)}")
+                            self.output_queue.put(output)
+                except Exception as e:
+                    logger.error(f"PTY线程错误: {e}")
+                    break
+            logger.info(f"PTY线程结束 {self.session_id}")
+                    
+        threading.Thread(target=pty_thread, daemon=True).start()
             
     def set_winsize(self, rows, cols):
         """设置终端窗口大小"""
@@ -102,52 +165,48 @@ class Terminal:
                 import fcntl
                 winsize = struct.pack("HHHH", rows, cols, 0, 0)
                 fcntl.ioctl(self.fd, termios.TIOCSWINSZ, winsize)
-            except:
-                pass
+                logger.debug(f"设置终端窗口大小: {rows}x{cols}")
+            except Exception as e:
+                logger.error(f"设置窗口大小失败: {e}")
                 
     def read(self):
         """读取终端输出"""
         try:
-            if self.is_windows:
-                output = ""
-                while not self.output_queue.empty():
-                    try:
-                        line = self.output_queue.get_nowait()
-                        output += line
-                    except queue.Empty:
-                        break
-                return output
-            else:
-                # Unix/Linux
-                if hasattr(self, 'fd'):
-                    try:
-                        import select
-                        ready, _, _ = select.select([self.fd], [], [], 0.1)
-                        if ready:
-                            data = os.read(self.fd, 1024)
-                            return data.decode('utf-8', errors='ignore')
-                    except:
-                        pass
-                return ''
+            output = ""
+            count = 0
+            while not self.output_queue.empty() and count < 10:  # 限制一次读取的数量
+                try:
+                    data = self.output_queue.get_nowait()
+                    output += data
+                    count += 1
+                except queue.Empty:
+                    break
+            if output:
+                logger.debug(f"读取到输出 {self.session_id}: {repr(output[:100])}")
+            return output
         except Exception as e:
-            print(f"读取终端输出错误: {e}")
+            logger.error(f"读取终端输出错误: {e}")
             return ''
             
     def write(self, data):
         """写入终端输入"""
         try:
+            logger.info(f"接收到输入 {self.session_id}: {repr(data)}")
             if self.is_windows:
                 self.input_queue.put(data)
+                logger.debug(f"命令已放入输入队列，队列大小: {self.input_queue.qsize()}")
             else:
                 # Unix/Linux
                 if hasattr(self, 'fd'):
                     os.write(self.fd, data.encode('utf-8'))
+                    logger.debug(f"命令已写入PTY")
         except Exception as e:
-            print(f"写入终端输入错误: {e}")
+            logger.error(f"写入终端输入错误: {e}")
     
     def close(self):
         """关闭终端"""
         try:
+            logger.info(f"关闭终端 {self.session_id}")
             self.running = False
             if self.is_windows:
                 if self.process:
@@ -162,7 +221,7 @@ class Terminal:
                     except:
                         pass
         except Exception as e:
-            print(f"关闭终端错误: {e}")
+            logger.error(f"关闭终端错误: {e}")
 
 @app.route('/')
 def index():
@@ -180,31 +239,49 @@ def terminal():
 def list_files():
     path = request.args.get('path', '.')
     try:
-        # 安全检查：防止路径遍历攻击
+        # 获取绝对路径
         abs_path = os.path.abspath(path)
-        if not abs_path.startswith(os.getcwd()):
-            # 限制在当前工作目录内
+        
+        # 确保路径存在
+        if not os.path.exists(abs_path):
             abs_path = os.getcwd()
             
         items = []
-        for item in os.listdir(abs_path):
-            item_path = os.path.join(abs_path, item)
-            try:
-                stat = os.stat(item_path)
-                items.append({
-                    'name': item,
-                    'type': 'directory' if os.path.isdir(item_path) else 'file',
-                    'size': stat.st_size,
-                    'modified': datetime.fromtimestamp(stat.st_mtime).strftime('%Y-%m-%d %H:%M:%S'),
-                    'path': os.path.relpath(item_path, os.getcwd()).replace('\\', '/')
-                })
-            except:
-                continue
+        
+        # 添加返回上级目录的选项（除非已经在根目录）
+        parent_path = os.path.dirname(abs_path)
+        if abs_path != parent_path:  # 不在根目录
+            items.append({
+                'name': '..',
+                'type': 'directory',
+                'size': 0,
+                'modified': '',
+                'path': parent_path.replace('\\', '/')
+            })
+        
+        # 列出当前目录下的文件和文件夹
+        try:
+            for item in os.listdir(abs_path):
+                item_path = os.path.join(abs_path, item)
+                try:
+                    stat = os.stat(item_path)
+                    items.append({
+                        'name': item,
+                        'type': 'directory' if os.path.isdir(item_path) else 'file',
+                        'size': stat.st_size,
+                        'modified': datetime.fromtimestamp(stat.st_mtime).strftime('%Y-%m-%d %H:%M:%S'),
+                        'path': item_path.replace('\\', '/')
+                    })
+                except (PermissionError, OSError):
+                    # 跳过无权限访问的文件
+                    continue
+        except PermissionError:
+            return jsonify({'success': False, 'error': '没有权限访问此目录'})
         
         return jsonify({
             'success': True,
-            'path': os.path.relpath(abs_path, os.getcwd()).replace('\\', '/'),
-            'items': sorted(items, key=lambda x: (x['type'] != 'directory', x['name'].lower()))
+            'path': abs_path.replace('\\', '/'),
+            'items': sorted(items, key=lambda x: (x['name'] != '..', x['type'] != 'directory', x['name'].lower()))
         })
     except Exception as e:
         return jsonify({'success': False, 'error': str(e)})
@@ -214,10 +291,7 @@ def create_file():
     data = request.json
     try:
         file_path = data['path']
-        # 安全检查
         abs_path = os.path.abspath(file_path)
-        if not abs_path.startswith(os.getcwd()):
-            return jsonify({'success': False, 'error': '路径不被允许'})
             
         if data['type'] == 'directory':
             os.makedirs(abs_path, exist_ok=True)
@@ -235,8 +309,6 @@ def delete_file():
     try:
         file_path = data['path']
         abs_path = os.path.abspath(file_path)
-        if not abs_path.startswith(os.getcwd()):
-            return jsonify({'success': False, 'error': '路径不被允许'})
             
         if os.path.isdir(abs_path):
             import shutil
@@ -253,9 +325,6 @@ def rename_file():
     try:
         old_path = os.path.abspath(data['oldPath'])
         new_path = os.path.abspath(data['newPath'])
-        
-        if not old_path.startswith(os.getcwd()) or not new_path.startswith(os.getcwd()):
-            return jsonify({'success': False, 'error': '路径不被允许'})
             
         os.rename(old_path, new_path)
         return jsonify({'success': True})
@@ -267,8 +336,6 @@ def read_file():
     file_path = request.args.get('path')
     try:
         abs_path = os.path.abspath(file_path)
-        if not abs_path.startswith(os.getcwd()):
-            return jsonify({'success': False, 'error': '路径不被允许'})
             
         with open(abs_path, 'r', encoding='utf-8') as f:
             content = f.read()
@@ -290,8 +357,6 @@ def write_file():
         file_path = data['path']
         content = data['content']
         abs_path = os.path.abspath(file_path)
-        if not abs_path.startswith(os.getcwd()):
-            return jsonify({'success': False, 'error': '路径不被允许'})
             
         with open(abs_path, 'w', encoding='utf-8') as f:
             f.write(content)
@@ -304,8 +369,6 @@ def download_file():
     file_path = request.args.get('path')
     try:
         abs_path = os.path.abspath(file_path)
-        if not abs_path.startswith(os.getcwd()):
-            abort(403)
         return send_file(abs_path, as_attachment=True)
     except Exception as e:
         abort(404)
@@ -316,8 +379,6 @@ def upload_file():
         file = request.files['file']
         path = request.form.get('path', '.')
         abs_path = os.path.abspath(path)
-        if not abs_path.startswith(os.getcwd()):
-            return jsonify({'success': False, 'error': '路径不被允许'})
             
         file_path = os.path.join(abs_path, file.filename)
         file.save(file_path)
@@ -328,63 +389,93 @@ def upload_file():
 # WebSocket事件处理
 @socketio.on('connect')
 def on_connect():
-    print(f'客户端连接: {request.sid}')
+    logger.info(f'客户端连接: {request.sid}')
 
 @socketio.on('disconnect')
 def on_disconnect():
-    print(f'客户端断开: {request.sid}')
+    session_id = request.sid
+    logger.info(f'客户端断开: {session_id}')
+    
+    # 离开房间
+    leave_room(session_id)
+    
     # 清理终端进程
-    if request.sid in terminals:
-        terminals[request.sid].close()
-        del terminals[request.sid]
+    if session_id in terminals:
+        terminals[session_id].close()
+        del terminals[session_id]
 
 @socketio.on('start_terminal')
 def on_start_terminal():
     session_id = request.sid
+    logger.info(f'启动终端请求: {session_id}')
+    
+    # 将客户端加入专用房间
+    join_room(session_id)
+    logger.info(f'客户端 {session_id} 加入房间')
+    
     terminal = Terminal(session_id)
     
     if terminal.spawn():
         terminals[session_id] = terminal
         
-        # 发送初始提示
+        # 立即发送测试消息
+        emit('terminal_output', {'data': '=== WebShell Terminal Started ===\n'})
+        emit('terminal_output', {'data': f'Session ID: {session_id}\n'})
+        emit('terminal_output', {'data': f'Working Directory: {os.getcwd()}\n'})
+        emit('terminal_output', {'data': 'Type commands below:\n'})
+        
         if os.name == 'nt':
-            socketio.emit('terminal_output', {'data': f'Microsoft Windows [版本 {os.environ.get("OS", "Windows")}]\n'}, room=session_id)
-            socketio.emit('terminal_output', {'data': f'(c) Microsoft Corporation. 保留所有权利。\n\n'}, room=session_id)
-            socketio.emit('terminal_output', {'data': f'{os.getcwd()}>'}, room=session_id)
+            emit('terminal_output', {'data': 'C:\\> '})
         else:
-            socketio.emit('terminal_output', {'data': f'WebShell Terminal - Linux\n'}, room=session_id)
-            socketio.emit('terminal_output', {'data': f'Current directory: {os.getcwd()}\n'}, room=session_id)
-            socketio.emit('terminal_output', {'data': f'$ '}, room=session_id)
+            emit('terminal_output', {'data': '$ '})
         
         # 启动读取线程
         def read_thread():
+            logger.info(f'读取线程启动: {session_id}')
             while session_id in terminals and terminals[session_id].running:
                 try:
                     terminal_instance = terminals[session_id]
                     output = terminal_instance.read()
                     if output:
+                        logger.info(f'发送输出到客户端 {session_id}: {repr(output)}')
+                        # 发送到特定房间
                         socketio.emit('terminal_output', {'data': output}, room=session_id)
-                    time.sleep(0.1)
+                    time.sleep(0.05)  # 减少延迟
                 except Exception as e:
-                    print(f"读取线程错误: {e}")
+                    logger.error(f"读取线程错误: {e}")
                     break
+            logger.info(f'读取线程结束: {session_id}')
         
         threading.Thread(target=read_thread, daemon=True).start()
         emit('terminal_ready')
+        logger.info(f'终端就绪: {session_id}')
     else:
         emit('terminal_error', {'error': '无法启动终端'})
+        logger.error(f'终端启动失败: {session_id}')
 
 @socketio.on('terminal_input')
 def on_terminal_input(data):
     session_id = request.sid
+    command = data['data']
+    logger.info(f"收到终端输入 {session_id}: {repr(command)}")
+    
     if session_id in terminals:
-        command = data['data']
-        print(f"收到命令: {repr(command)}")
-        terminals[session_id].write(command)
+        terminal = terminals[session_id]
+        terminal.write(command)
+        
+        # 检查进程状态
+        if terminal.is_windows and terminal.process:
+            poll_result = terminal.process.poll()
+            logger.debug(f"进程状态 {session_id}: {poll_result}, PID: {terminal.process.pid}")
+            if poll_result is not None:
+                logger.warning(f"进程已终止 {session_id}: 退出码 {poll_result}")
+    else:
+        logger.warning(f"终端不存在: {session_id}")
 
 @socketio.on('terminal_resize')
 def on_terminal_resize(data):
     session_id = request.sid
+    logger.debug(f'终端调整大小: {session_id}, {data["rows"]}x{data["cols"]}')
     if session_id in terminals:
         terminals[session_id].set_winsize(data['rows'], data['cols'])
 
@@ -403,5 +494,5 @@ if __name__ == '__main__':
     host = os.environ.get('HOST', '0.0.0.0')
     debug = os.environ.get('DEBUG', 'False').lower() == 'true'
     
-    print(f"🚀 WebShell 启动在 {host}:{port}")
+    logger.info(f"🚀 WebShell 启动在 {host}:{port}")
     socketio.run(app, host=host, port=port, debug=debug, allow_unsafe_werkzeug=True) 

templates/terminal.html

@@ -279,31 +279,73 @@
         
         // 初始化终端连接
         function initializeTerminal() {
-            socket = io();
+            console.log('初始化WebSocket连接...');
+            
+            // 获取当前页面的主机和端口
+            const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+            const host = window.location.hostname;
+            const port = window.location.port || (window.location.protocol === 'https:' ? '443' : '80');
+            
+            console.log('连接参数:', { protocol, host, port });
+            
+            // 创建Socket.IO连接，明确指定端口
+            socket = io({
+                forceNew: true,
+                reconnection: true,
+                timeout: 5000
+            });
             
             socket.on('connect', function() {
+                console.log('WebSocket已连接, ID:', socket.id);
                 updateConnectionStatus('connected');
-                addOutput('已连接到服务器', '#27ca3f');
+                addOutput('已连接到服务器\n', '#27ca3f');
+                console.log('发送start_terminal事件...');
                 socket.emit('start_terminal');
             });
             
             socket.on('disconnect', function() {
+                console.log('WebSocket已断开连接');
                 updateConnectionStatus('disconnected');
-                addOutput('与服务器断开连接', '#ff5f56');
+                addOutput('与服务器断开连接\n', '#ff5f56');
             });
             
             socket.on('terminal_ready', function() {
-                addOutput('终端已准备就绪', '#6a9955');
+                console.log('收到terminal_ready事件');
+                addOutput('终端已准备就绪\n', '#6a9955');
                 updatePrompt();
             });
             
             socket.on('terminal_output', function(data) {
-                addOutput(data.data, '#cccccc', false);
-                updatePrompt();
+                console.log('收到terminal_output事件:', data);
+                if (data && data.data) {
+                    // 确保文本正确显示
+                    console.log('输出内容:', JSON.stringify(data.data));
+                    addOutput(data.data, '#cccccc', false);
+                    updatePrompt();
+                } else {
+                    console.error('terminal_output数据格式错误:', data);
+                }
+            });
+            
+            socket.on('terminal_error', function(error) {
+                console.error('收到terminal_error事件:', error);
+                addOutput('错误: ' + (error.error || error) + '\n', '#ff5f56');
             });
             
             socket.on('error', function(error) {
-                addOutput('错误: ' + error, '#ff5f56');
+                console.error('WebSocket错误:', error);
+                addOutput('连接错误: ' + error + '\n', '#ff5f56');
+            });
+            
+            socket.on('connect_error', function(error) {
+                console.error('连接失败:', error);
+                updateConnectionStatus('disconnected');
+                addOutput('连接失败: ' + error + '\n', '#ff5f56');
+            });
+            
+            // 添加调试事件监听
+            socket.onAny((event, ...args) => {
+                console.log('收到WebSocket事件:', event, args);
             });
         }
         
@@ -399,22 +441,29 @@
         
         // 添加输出
         function addOutput(text, color = '#cccccc', addNewline = true) {
+            console.log('添加输出:', text, '颜色:', color);
             const output = document.getElementById('terminalOutput');
-            const div = document.createElement('div');
             
-            if (color) {
-                div.style.color = color;
+            if (!text) {
+                console.warn('尝试添加空文本到终端');
+                return;
             }
             
-            div.textContent = text;
-            if (addNewline && !text.endsWith('\n')) {
-                div.appendChild(document.createElement('br'));
+            // 创建文本节点而不是div，保持原始格式
+            const textNode = document.createTextNode(text);
+            const span = document.createElement('span');
+            
+            if (color) {
+                span.style.color = color;
             }
             
-            output.appendChild(div);
+            span.appendChild(textNode);
+            output.appendChild(span);
             
             // 自动滚动到底部
             output.scrollTop = output.scrollHeight;
+            
+            console.log('输出已添加到终端');
         }
         
         // 更新连接状态