From 2ead64e8587e28731736c8e6d246e037e0034acf Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Thu, 13 Aug 2026 17:55:55 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E7=A7=BB=E9=99=A4=20core.User?= =?UTF-8?q?=20=E9=BB=98=E8=AE=A4=E5=AF=86=E7=A0=81=E5=93=88=E5=B8=8C?= =?UTF-8?q?=E5=90=8E=E9=97=A8=EF=BC=8C=E5=BC=82=E5=B8=B8=E5=A0=86=E6=A0=88?= =?UTF-8?q?=E6=94=B9=20logging=20=E8=90=BD=E7=9B=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - UserPassword 默认值改为空串（防默认口令，须经注册/重置流程设置） - exception_handler print→logging（日志可审计） - ip_filter 默认 disabled 语义注释（生产需显式配置并挂载） --- gvsds/apps/core/models.py | 2 +- gvsds/exception_handler.py | 9 +++++---- gvsds/ip_filter.py | 2 ++ 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/gvsds/apps/core/models.py b/gvsds/apps/core/models.py index 7978aee0..1d979d08 100644 --- a/gvsds/apps/core/models.py +++ b/gvsds/apps/core/models.py @@ -125,7 +125,7 @@ class User(QModel): UserUUID = UUIDField(primary_key=True, verbose_name='用户UUID') UserName = models.CharField(max_length=256, unique=True, verbose_name='用户名') - UserPassword = models.CharField(max_length=60, default='$2b$12$f4aPWFkTnL60G28TANMEHef7d3Qzp2/AycY0gVK30ufgRrahwygEGS', verbose_name='密码') + UserPassword = models.CharField(max_length=60, default='', verbose_name='密码') # 无默认密码（防默认口令后门），须经注册/重置流程设置 UserPositionStatus = models.SmallIntegerField(default=0, verbose_name='职位状态') UserPersonalSignature = models.CharField(max_length=1024, default='尚未及提笔自叙，浅墨先勾鹤影', verbose_name='个人签名') UserEmail = models.CharField(max_length=256, default='', verbose_name='邮箱') diff --git a/gvsds/exception_handler.py b/gvsds/exception_handler.py index 6e5acb96..f2ca6085 100644 --- a/gvsds/exception_handler.py +++ b/gvsds/exception_handler.py @@ -1,16 +1,17 @@ -import traceback +import logging from rest_framework.views import exception_handler from rest_framework.response import Response from rest_framework import status from django.conf import settings +logger = logging.getLogger(__name__) + def custom_exception_handler(exc, context): - # 始终打印异常堆栈，便于排查问题 + # 始终记录异常堆栈（走 logging，日志落盘可审计，替代 print） view = context.get('view', None) if context else None view_name = view.__class__.__name__ if view else 'Unknown' - print(f"[EXCEPTION] {view_name}: {exc}") - traceback.print_exc() + logger.error('[EXCEPTION] %s: %s', view_name, exc, exc_info=True) response = exception_handler(exc, context) diff --git a/gvsds/ip_filter.py b/gvsds/ip_filter.py index 804ab7ad..f8e141c4 100644 --- a/gvsds/ip_filter.py +++ b/gvsds/ip_filter.py @@ -66,6 +66,8 @@ class IPFilterMiddleware: def __init__(self, get_response): self.get_response = get_response + # 默认 disabled（安全默认值权衡：避免漏配即拒绝服务）。 + # 生产环境应显式配置 MODE=production/whitelist 并挂载中间件（见 app.ini [middleware]）。 self.mode = _app_get('ip_filter', 'MODE', fallback='disabled').lower() self.whitelist = _ParseIPList(_app_getlist('ip_filter', 'WHITELIST', fallback=[])) self.blacklist = _ParseIPList(_app_getlist('ip_filter', 'BLACKLIST', fallback=[]))