Skip to content

v2.8.0

Latest
Latest

Choose a tag to compare

View all tags
@wenjianzhang wenjianzhang released this 08 Oct 12:51
· 4 commits to master since this release
v2.8.0
5f0c359
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Three route groups that skipped the role check are fixed, the code generator's routes now go through it, and the SQLite quick start works from a fresh clone. Run migrate when you upgrade; read the section below first.

⚠️ Before you upgrade

1. Run migrate. Two migrations are new, 1786700011000 and 1786700012000. They bind the code generator's APIs, /role-status, /job/start and /job/remove to the menus that expose them, and grant them to every role that already holds one of those menus. Without them, a non-admin role holding those menus is refused by the endpoints the pages call. #955 #962

2. Five routes now require a login and a role check. GET /api/v1/job/start/:id and /job/remove/:id had neither; PUT /api/v1/role-status, PUT /api/v1/roledatascope and GET/PUT /api/v1/set-config only checked the login. If a script or an external scheduler calls the two job routes without a token, it now gets 401 and must send one. A role without the matching menu (修改角色, 参数设置, or the job menus) now gets 403 from them; give it the menu to restore access. admin is unaffected. #962

3. Every code generator route goes through the role check. Before, any account that could log in reached all thirteen. A role that holds 代码生成 or 代码生成修改 keeps working after migrate; a role that holds neither now gets 403. #955

  • 🔒 Security
    • 🔒 /job/start/:id and /job/remove/:id ran without authentication, so an anonymous request could start or stop a scheduled job. #962
    • 🔒 PUT /role-status, PUT /roledatascope and /set-config checked the login but not the role, so any logged-in user could change another role's status or data scope, and read and overwrite the system settings. #962
    • 🔒 The code generator's writes stay inside the working directory and gen.frontpath, symlinks included, and its package, table and business names are validated on the server on import, save and generate. #955
    • 🔒 All thirteen code generator routes go through the role check; the captcha stays public. #955
  • Generic CRUD actions
    • ✨ actions.Index, View, ViewAs, Create, Update and Delete are type-parameterised, so a model paired with the wrong request does not compile and a request no longer has to return a copy of itself. app/demo and app/jobs use them, the old five actions are marked Deprecated and behave as before, and AGENTS.md and docs/contract.md teach the new ones. #956
    • 🐛 Queries were given the pooled *gin.Context as their context, which gin hands to the next request when the handler returns. Writes could race with it on SQLite and PostgreSQL; they now use c.Request.Context(). #956
    • 🐛 The new actions answer 500 instead of an empty 200 when there is no database, and match the key as a value instead of handing a string to Where. #956
  • SQLite
    • ✨ Seed SQL is embedded in the binary, so migrate on an empty database no longer depends on the working directory containing config/. A file on disk still wins. #961
    • 🐛 SQLite connections get a busy timeout, WAL, synchronous=NORMAL and immediate transactions unless the source sets them, which stops database is locked under concurrent reads and writes. #961
    • 📝 The README's init command pointed at config/settings.dev.yml, which does not exist; it is config/settings.yml in all four READMEs. The startup section opens with a three-command SQLite quick start, and a default build that is given a sqlite3 config now says to rebuild with -tags sqlite3. #960
  • 🔧 The code generator's unused template/v4/actions router templates are removed. #957
  • ✅ Tests cover the operation log's truncation on a character boundary. #959

三组漏掉角色校验的路由已修复，代码生成器的路由也改为经过角色校验，SQLite 快速开始现在从全新克隆就能跑通。升级时需要执行 migrate，请先读下面这一节。

⚠️ 升级前

1. 执行 migrate。 新增 2 个迁移：1786700011000 和 1786700012000。它们把代码生成器的接口、/role-status、/job/start、/job/remove 绑定到暴露它们的菜单，并授予已持有这些菜单的角色。不执行的话，持有这些菜单的非 admin 角色会被页面调用的接口拒绝。#955 #962

2. 五个路由现在要求登录并检查角色。 GET /api/v1/job/start/:id 和 /job/remove/:id 此前两者都没有；PUT /api/v1/role-status、PUT /api/v1/roledatascope 和 GET/PUT /api/v1/set-config 此前只检查登录。如果有脚本或外部调度器不带 token 调用这两个任务路由，现在会得到 401，需要带上 token。没有对应菜单（修改角色、参数设置或定时任务菜单）的角色现在会得到 403，授予菜单即可恢复。admin 不受影响。#962

3. 代码生成器的所有路由都经过角色校验。 此前任何能登录的账号都能访问全部 13 个。持有"代码生成"或"代码生成修改"菜单的角色在 migrate 之后照常使用；两个菜单都没有的角色现在得到 403。#955

  • 🔒 安全
    • 🔒 /job/start/:id 和 /job/remove/:id 不需要认证，匿名请求就能启动或停止定时任务。#962
    • 🔒 PUT /role-status、PUT /roledatascope 和 /set-config 只检查登录、不检查角色，任何已登录用户都能修改他人角色的状态或数据范围，并读取、覆盖系统设置。#962
    • 🔒 代码生成器的写入限制在工作目录和 gen.frontpath 之内（包括符号链接），其包名、表名和业务名在导入、保存和生成时都由服务端校验。#955
    • 🔒 代码生成器的 13 个路由全部经过角色校验；验证码接口仍然公开。#955
  • 泛型 CRUD Action
    • ✨ actions.Index、View、ViewAs、Create、Update、Delete 带类型参数：模型与请求配错无法通过编译，请求也不再需要返回自身的副本。app/demo 和 app/jobs 已改用它们，原有五个 Action 标记为 Deprecated 且行为不变，AGENTS.md 和 docs/contract.md 改为介绍新的。#956
    • 🐛 查询把被池化的 *gin.Context 当作查询上下文传入，而 gin 在 handler 返回后会把它交给下一个请求。SQLite 和 PostgreSQL 上写操作可能与之竞争；现在改用 c.Request.Context()。#956
    • 🐛 新的 Action 在没有数据库时返回 500 而不是空的 200，并把主键当作值匹配，而不是把字符串交给 Where。#956
  • SQLite
    • ✨ 种子 SQL 内嵌在二进制中，空库上执行 migrate 不再依赖工作目录里有 config/；磁盘上的文件仍然优先。#961
    • 🐛 除非数据源自行设置，SQLite 连接默认带 busy timeout、WAL、synchronous=NORMAL 和 immediate 事务，解决并发读写时的 database is locked。#961
    • 📝 README 的初始化命令指向不存在的 config/settings.dev.yml，四份 README 均改为 config/settings.yml；启动说明开头新增三条命令的 SQLite 快速开始；默认构建遇到 sqlite3 配置时，现在会提示用 -tags sqlite3 重新构建。#960
  • 🔧 移除代码生成器里没人使用的 template/v4/actions 路由模板。#957
  • ✅ 新增测试，覆盖操作日志按字符边界截断。#959
Assets 2
Loading