rogue/3x-ui-agent
1
0
Fork 0
Code Issues Pull Requests Actions 20 Packages Projects Releases 2 Wiki Activity

精简: 去掉双重验证(2FA): 登录校验/设置守卫/VerifyTwoFactorCode/CLI resetTwoFactor 标志

Browse Source
This commit is contained in:
Muse
2026-10-20 10:05:29 +00:00
parent 7ece6e079b
commit 981ba8abe1
6 changed files with 28 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/setting.go
+10 -35
View File
@@ -4,7 +4,6 @@ import (
"errors"
"net/http"
"strconv"
"strings"
"time"
"github.com/mhsanaei/3x-ui/v3/internal/logger"
@@ -21,22 +20,20 @@ import (
// updateUserForm represents the form for updating user credentials.
type updateUserForm struct {
OldUsername string `json:"oldUsername" form:"oldUsername"`
OldPassword string `json:"oldPassword" form:"oldPassword"`
NewUsername string `json:"newUsername" form:"newUsername"`
NewPassword string `json:"newPassword" form:"newPassword"`
TwoFactorCode string `json:"twoFactorCode" form:"twoFactorCode"`
OldUsername string `json:"oldUsername" form:"oldUsername"`
OldPassword string `json:"oldPassword" form:"oldPassword"`
NewUsername string `json:"newUsername" form:"newUsername"`
NewPassword string `json:"newPassword" form:"newPassword"`
}
// updateSettingForm carries the persisted settings plus request-scoped fields
// that must never land in the settings table: the 2FA confirmation code and
// the explicit clear flags for redacted secrets (a blank secret alone means
// "unchanged", so clearing needs its own signal — see #5724).
// updateSettingForm carries the persisted settings plus the explicit clear
// flags for redacted secrets, which must never land in the settings table (a
// blank secret alone means "unchanged", so clearing needs its own signal —
// see #5724).
type updateSettingForm struct {
entity.AllSetting
TwoFactorCode string `json:"twoFactorCode" form:"twoFactorCode"`
ClearTgBotToken bool `json:"clearTgBotToken" form:"clearTgBotToken"`
ClearSmtpPassword bool `json:"clearSmtpPassword" form:"clearSmtpPassword"`
ClearTgBotToken bool `json:"clearTgBotToken" form:"clearTgBotToken"`
ClearSmtpPassword bool `json:"clearSmtpPassword" form:"clearSmtpPassword"`
}
type validateRegexForm struct {
@@ -124,33 +121,15 @@ func (a *SettingController) updateSetting(c *gin.Context) {
return
}
allSetting := &form.AllSetting
oldTwoFactor, twoFactorErr := a.settingService.GetTwoFactorEnable()
oldPanelOutbound, _ := a.settingService.GetPanelOutbound()
oldTgEnable, _ := a.settingService.GetTgbotEnabled()
oldTgToken, _ := a.settingService.GetTgBotToken()
oldTgChatId, _ := a.settingService.GetTgBotChatId()
oldTgAPIServer, _ := a.settingService.GetTgBotAPIServer()
if twoFactorErr == nil && oldTwoFactor {
// Rebinding the authenticator is the same class of change as turning 2FA
// off, so both need a current code. Blank still means "unchanged".
submittedToken := strings.TrimSpace(allSetting.TwoFactorToken)
storedToken, _ := a.settingService.GetTwoFactorToken()
if !allSetting.TwoFactorEnable || (submittedToken != "" && submittedToken != storedToken) {
if err := a.settingService.VerifyTwoFactorCode(form.TwoFactorCode); err != nil {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
return
}
}
}
err := a.settingService.UpdateAllSetting(allSetting, service.SecretClears{
TgBotToken: form.ClearTgBotToken,
SmtpPassword: form.ClearSmtpPassword,
})
if err == nil && twoFactorErr == nil && !oldTwoFactor && allSetting.TwoFactorEnable {
if bumpErr := a.userService.BumpLoginEpoch(); bumpErr != nil {
err = bumpErr
}
}
if err == nil && form.PanelOutbound != oldPanelOutbound {
// The egress bridge lives in the generated config; reconcile the
// running core. One SOCKS inbound plus one routing rule — both
@@ -189,10 +168,6 @@ func (a *SettingController) updateUser(c *gin.Context) {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.userPassMustBeNotEmpty")))
return
}
if err := a.settingService.VerifyTwoFactorCode(form.TwoFactorCode); err != nil {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), err)
return
}
err = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)
if err == nil {
user.Username = form.NewUsername