Spaces:

hijnu
/

exec

Paused

App Files Files Community

aigems commited on Sep 22, 2024

Commit

da5d623

1 Parent(s): 158961a

ok

Browse files

Files changed (4) hide show

Dockerfile +2 -0
package.json +1 -1
public/index.html +28 -16
routes/command.js +6 -5

Dockerfile CHANGED Viewed

@@ -11,6 +11,8 @@ RUN npm install
 COPY . .
 EXPOSE 7860
 ENV ADMIN_USERNAME=${ADMIN_USERNAME}

 COPY . .
+RUN mkdir -p /app/data && chown -R node:node /app /app/data
 EXPOSE 7860
 ENV ADMIN_USERNAME=${ADMIN_USERNAME}

package.json CHANGED Viewed

@@ -21,6 +21,6 @@
         "jest": "^27.0.6"
     },
     "engines": {
-        "node": ">=14.0.0"
     }
 }

         "jest": "^27.0.6"
     },
     "engines": {
+        "node": ">=18.0.0"
     }
 }

public/index.html CHANGED Viewed

@@ -7,32 +7,44 @@
     <title>Web 命令执行</title>
     <script src="https://cdn.tailwindcss.com"></script>
     <script src="https://cdn.jsdelivr.net/npm/xss@1.0.14/dist/xss.min.js"></script>
 </head>
-<body class="bg-gray-100 p-8">
-    <div class="max-w-2xl mx-auto bg-white p-6 rounded-lg shadow-md">
-        <h1 class="text-3xl font-bold mb-4">Web 命令执行</h1>
-        <div id="loginForm">
-            <input type="text" id="username" placeholder="用户名" class="p-2 border rounded mb-2 w-full">
-            <input type="password" id="password" placeholder="密码" class="p-2 border rounded mb-2 w-full">
-            <button id="loginButton" class="bg-blue-500 text-white px-4 py-2 rounded hover:bg-blue-600">登录</button>
         </div>
-        <div id="commandInterface" style="display: none;">
-            <p class="mb-4">此应用允许您在服务器上执行特定的命令。请在下方输入命令并点击"执行"或按回车键。</p>
-            <div class="flex mb-4">
                 <input type="text" id="command" placeholder="输入命令"
-                    class="flex-grow p-2 border rounded-l focus:outline-none focus:ring-2 focus:ring-blue-500">
                 <button id="executeButton"
-                    class="bg-blue-500 text-white px-4 py-2 rounded-r hover:bg-blue-600 focus:outline-none focus:ring-2 focus:ring-blue-500">执行</button>
             </div>
-            <div id="loadingIndicator" class="text-center mb-4" style="display: none;">
                 <div class="inline-block animate-spin rounded-full h-8 w-8 border-t-2 border-b-2 border-blue-500"></div>
             </div>
-            <div id="output" class="bg-gray-200 p-4 rounded h-64 overflow-y-auto font-mono mb-4"></div>
-            <h2 class="text-2xl font-bold mb-2">命令历史</h2>
-            <ul id="history" class="list-disc pl-5"></ul>
         </div>
     </div>

     <title>Web 命令执行</title>
     <script src="https://cdn.tailwindcss.com"></script>
     <script src="https://cdn.jsdelivr.net/npm/xss@1.0.14/dist/xss.min.js"></script>
+    <style>
+        @import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC:wght@400;700&display=swap');
+        body {
+            font-family: 'Noto Sans SC', sans-serif;
+        }
+    </style>
 </head>
+<body class="bg-gradient-to-r from-blue-100 to-purple-100 min-h-screen flex items-center justify-center">
+    <div class="max-w-2xl w-full mx-auto bg-white p-8 rounded-lg shadow-xl">
+        <h1 class="text-4xl font-bold mb-6 text-center text-blue-600">Web 命令执行</h1>
+        <div id="loginForm" class="space-y-4">
+            <input type="text" id="username" placeholder="用户名"
+                class="p-3 border rounded w-full focus:ring-2 focus:ring-blue-300 transition">
+            <input type="password" id="password" placeholder="密码"
+                class="p-3 border rounded w-full focus:ring-2 focus:ring-blue-300 transition">
+            <button id="loginButton"
+                class="w-full bg-blue-500 text-white px-4 py-3 rounded hover:bg-blue-600 transition">登录</button>
         </div>
+        <div id="commandInterface" style="display: none;" class="space-y-6">
+            <p class="text-gray-600">此应用允许您在服务器上执行命令。请在下方输入命令并点击"执行"或按回车键。</p>
+            <div class="flex">
                 <input type="text" id="command" placeholder="输入命令"
+                    class="flex-grow p-3 border rounded-l focus:outline-none focus:ring-2 focus:ring-blue-300 transition">
                 <button id="executeButton"
+                    class="bg-green-500 text-white px-6 py-3 rounded-r hover:bg-green-600 focus:outline-none focus:ring-2 focus:ring-green-300 transition">执行</button>
             </div>
+            <div id="loadingIndicator" class="text-center" style="display: none;">
                 <div class="inline-block animate-spin rounded-full h-8 w-8 border-t-2 border-b-2 border-blue-500"></div>
             </div>
+            <div id="output" class="bg-gray-100 p-4 rounded h-64 overflow-y-auto font-mono text-sm"></div>
+            <div>
+                <h2 class="text-2xl font-bold mb-3 text-blue-600">命令历史</h2>
+                <ul id="history" class="list-disc pl-5 space-y-2 text-gray-700"></ul>
+            </div>
         </div>
     </div>

routes/command.js CHANGED Viewed

@@ -10,7 +10,7 @@ const logger = require('../utils/logger');
 const allowedCommands = ['ls', 'pwd', 'whoami', 'date', 'echo', 'cat'];
 // 历史命令文件路径
-const historyFilePath = path.join(__dirname, '..', 'command_history.json');
 router.get('/command-history', async (req, res) => {
     try {
@@ -26,10 +26,11 @@ router.post('/execute', async (req, res) => {
     const { command } = req.body;
     const baseCommand = command.split(' ')[0];
-    if (!allowedCommands.includes(baseCommand)) {
-        logger.warn(`用户 ${req.user.username} 尝试执行未授权的命令: ${command}`);
-        return res.status(403).json({ error: '未授权的命令' });
-    }
     execFile(baseCommand, command.split(' ').slice(1), { timeout: 5000 }, async (error, stdout, stderr) => {
         if (error) {

 const allowedCommands = ['ls', 'pwd', 'whoami', 'date', 'echo', 'cat'];
 // 历史命令文件路径
+const historyFilePath = path.join(__dirname, '..', 'data', 'command_history.json');
 router.get('/command-history', async (req, res) => {
     try {
     const { command } = req.body;
     const baseCommand = command.split(' ')[0];
+    // 白名单检查的部分
+    // if (!allowedCommands.includes(baseCommand)) {
+    //     logger.warn(`用户 ${req.user.username} 尝试执行未授权的命令: ${command}`);
+    //     return res.status(403).json({ error: '未授权的命令' });
+    // }
     execFile(baseCommand, command.split(' ').slice(1), { timeout: 5000 }, async (error, stdout, stderr) => {
         if (error) {