Commit Graph

2032 Commits

Author SHA1 Message Date
Copilot
c482b6c0a2
Merge 236dad75e6 into 275d8af4e2 2026-03-02 02:51:06 +08:00
whyour
275d8af4e2 更新版本 v2.20.2 2026-03-01 20:35:25 +08:00
whyour
544c432f49 修复 PATH 环境变量 2026-03-01 20:35:19 +08:00
Copilot
6bec52dca1
Fix /open/user/init auth bypass allowing credential reset on initialized systems (#2941)
* Initial plan

* fix: add /open/user/init paths to init guard to prevent auth bypass

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
Co-authored-by: whyour <imwhyour@gmail.com>
2026-03-01 18:02:21 +08:00
rockymelody
ce599d306f
青龙面板鉴权绕过漏洞已修复 (#2935)
已实施的安全加固措施
第一层防御:启用Express严格路由(第17-18行)
app.set('case sensitive routing', true);  // 路由大小写敏感
app.set('strict routing', true);           // 严格路由匹配
第二层防御:路径标准化检查中间件(第23-37行)
app.use((req, res, next) => {
  const originalPath = req.path;
  const normalizedPath = originalPath.toLowerCase();

  // 检测并拦截大小写混淆攻击
  if (originalPath !== normalizedPath &&
      (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
    return res.status(400).json({
      code: 400,
      message: 'Invalid path format'
    });
  }

  next();
});
作用:主动检测并拒绝含有大小写变体的恶意请求
第三层防御:JWT中间件正则表达式修复(第59行)
// 修复前:
path: [...config.apiWhiteList, /^\/(?!api\/).*/],

// 修复后:添加大小写不敏感标志 'i'
path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
作用:防御正则匹配层面的绕过
第四层防御:自定义Token中间件路径标准化(第74-87行)
// 修复前:
if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {

// 修复后:统一转小写比较
const pathLower = req.path.toLowerCase();
if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
}
作用:确保Token验证逻辑对所有路径变体生效

第五层防御:初始化接口路径检查修复(第122-123行)
// 修复前:
if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {

// 修复后:
const pathLower = req.path.toLowerCase();
if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) {
2026-03-01 17:44:03 +08:00
whyour
d53437d169 更新 2.20.1 2025-12-26 21:17:30 +08:00
whyour
d526602d19 修复运行中任务停止操作 2025-12-26 01:07:08 +08:00
whyour
91b44914f6 修复环境变量排序 2025-12-26 00:41:32 +08:00
whyour
4f6c93cc1c 更新 workflow 2025-12-24 01:03:21 +08:00
whyour
e326d89571 修复 apiWhiteList 路径 2025-12-23 00:58:09 +08:00
whyour
5f0dafa010 修复 cron-parser import,websocket basepath 2025-12-23 00:28:16 +08:00
Copilot
dc0b3f2eb2
Fix QlBaseUrl: use URL rewrite for base path support (#2876)
* Initial plan

* Add QlBaseUrl support to backend routes

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Fix whitelist check to use base-URL-aware paths

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Update websocket and frontend to support base URL

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Address code review feedback: fix JWT regex and path construction

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Fix path construction: use req.path directly for whitelist check

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add clarifying comments and improve code readability

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Apply code review suggestions: improve clarity and simplify logic

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Simplify baseUrl implementation using URL rewrite

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-12-22 23:44:29 +08:00
Copilot
3db716763d
Fix cron-parser v5 bundling incompatibility causing validation failures (#2877)
* Initial plan

* Fix: Use default import for cron-parser to ensure browser compatibility

Changed from named export `{ CronExpressionParser }` to default export `cronParser` and access `CronExpressionParser` through it. This ensures compatibility with webpack/UmiJS bundling for browser environments while maintaining backend functionality.

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-12-22 23:43:54 +08:00
Copilot
fae226745e
Add missing larkSecret field to gRPC NotificationInfo proto (#2880)
* Initial plan

* Add larkSecret field to NotificationInfo proto definition

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-12-22 23:38:42 +08:00
Copilot
9330650163
Fix TG_PROXY_AUTH concatenation in notify.js - add missing @ separator (#2882)
* Initial plan

* Fix TG_PROXY_AUTH handling in notify.js to match notify.py logic

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Apply prettier formatting to notify.js

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-12-22 23:05:06 +08:00
Copilot
073de76a4a
Fix validation error when saving scripts in debug window (v2.20.0 regression) (#2862)
* 更新版本 2.20.0

* Initial plan

* Fix validation error when saving scripts by allowing unknown fields in POST /scripts

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Revert version.yaml to 2.19.2 - should not include version bump in bug fix PR

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: whyour <imwhyour@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-12-22 22:43:48 +08:00
Copilot
c61d1aa828
Fix enum value 0 causing type filter to fail for NodeJS dependencies (#2869)
* Initial plan

* Fix: Prevent Python3 dependencies from appearing in NodeJs tab

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-12-15 18:21:14 +08:00
whyour
33fa3aca99 更新版本 2.20.0 2025-12-11 01:53:17 +08:00
whyour
c772fc9527 修复脚本调试保存文件错误 2025-12-11 01:52:47 +08:00
whyour
c5d2aa3aba 更新 pipeline 2025-12-10 00:34:35 +08:00
Copilot
02a05f06bd
Add signature verification support for Feishu bot notifications (#2856)
* Initial plan

* Add signature verification support for Feishu bot notifications

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add clarifying comments about Feishu signature algorithm

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add i18n translations for larkSecret configuration field

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-27 01:10:04 +08:00
whyour
236dad75e6 support flowgram 2025-11-24 01:49:59 +08:00
copilot-swe-agent[bot]
d22803ea66 Fix: Correct import name from NODE_TYPES to WorkflowNodeType
Fixed build error:
- Changed import from NODE_TYPES to WorkflowNodeType (actual export name)
- Matches the enum exported from nodes/constants.ts
- Resolves "No matching export" build error

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 13:45:39 +00:00
copilot-swe-agent[bot]
eccda4da1a Fix: Refactor tools plugin following Flowgram demo patterns
Comprehensive fixes based on feedback:
1. Fixed zoom: use playgroundTools.zoom for reading, playgroundTools.config.updateZoom for setting
2. Created useAddNode hook following Flowgram pattern for proper node addition
3. Added Minimap component to DemoTools (removed from useEditorProps plugin)
4. Fixed createHistoryNodePlugin to accept opts parameter
5. Updated createPanelManagerPlugin to create custom tools panel
6. Created NodePanel component following Flowgram demo pattern
7. Updated createFreeNodePanelPlugin with renderer parameter
8. All components now follow official Flowgram.ai patterns exactly

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 13:40:08 +00:00
copilot-swe-agent[bot]
a1b21e81f6 Add custom tools plugin following Flowgram demo pattern
Created DemoTools plugin with comprehensive toolbar:
- Plugin structure following @flowgram.ai/panel-manager-plugin pattern
- Positioned at top-center matching Flowgram demo screenshot
- Integrated with Flowgram's history, playground, and viewport APIs
- Tools include: fit view, grid view, zoom controls, lock/unlock, comments
- Undo/Redo with real-time state management
- Add Node dropdown with all node types
- Test Run button (green)
- Added 13 new translation keys (zh-CN + en-US)
- Removed old bottom-left tools component
- Plugin automatically renders via layer system

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 11:06:14 +00:00
copilot-swe-agent[bot]
54e2468c7a Refactor: Replace custom toolbar with Flowgram-style tools component
Following Flowgram demo structure:
- Created tools component directory with index, styles, zoom-select, add-node-dropdown
- Implemented FloatingTools positioned at bottom-left (like Flowgram demo)
- Added undo/redo buttons with history integration
- Added zoom selector dropdown (50%, 100%, 150%, 200%)
- Added fit-view button for canvas fitting
- Added Add Node dropdown with all node types
- Updated FlowgramEditor to use new tools component
- Removed old toolbar from editor
- Added 6 new translation keys (zh-CN + en-US)
- Following exact Flowgram UI patterns with styled-components

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 10:57:29 +00:00
copilot-swe-agent[bot]
b356069e6c Add DockedPanelLayer to workflow editor for panel management
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 10:48:13 +00:00
copilot-swe-agent[bot]
47e887cf83 Fix: Add toolbar and fix minimap positioning in workflow editor
- Added toolbar with node creation buttons (HTTP, Script, Condition, Delay, Loop)
- Added zoom controls (Zoom In, Zoom Out, Fit to Canvas)
- Fixed minimap positioning to stay within modal bounds
- Updated CSS to ensure proper containment
- Added 9 new translation keys for toolbar (zh-CN and en-US)

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 10:42:59 +00:00
whyour
81f6f84891 fix scenario style 2025-11-23 18:37:29 +08:00
copilot-swe-agent[bot]
a691951f6d Fix: Update plugin configuration - add history plugin and configure minimap size
- Changed plugins to function returning array
- Added createHistoryNodePlugin for undo/redo support
- Configured minimap with smaller size (150x100px)
- Updated createPanelManagerPlugin with factories and layerProps
- All plugin creation functions now receive proper parameters

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 10:18:38 +00:00
copilot-swe-agent[bot]
829727ad33 Changes before error encountered
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 06:17:47 +00:00
copilot-swe-agent[bot]
e1b903b6db Fix: Add ScenarioModel sync to database loader and migration for status column
- Import and sync ScenarioModel in back/loaders/db.ts
- Add migration to ensure 'status' column exists in Scenarios table
- Fixes SQLITE_ERROR: table Scenarios has no column named status

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 06:12:21 +00:00
copilot-swe-agent[bot]
95780bd3ad Add Flowgram integration documentation
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 06:06:17 +00:00
copilot-swe-agent[bot]
a0a70703bc Refactor workflow editor to use Flowgram.ai library
- Installed @flowgram.ai packages (free-layout-editor and plugins)
- Created node registries following Flowgram pattern
- Implemented FlowgramEditor component with proper integration
- Simplified workflowEditorModal to use Flowgram
- Added necessary translations
- All builds succeed

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 06:05:24 +00:00
copilot-swe-agent[bot]
99829240d3 Add comprehensive implementation summary with testing results
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 05:47:55 +00:00
copilot-swe-agent[bot]
f026242ff2 Add comprehensive architecture documentation
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 05:45:56 +00:00
copilot-swe-agent[bot]
e6b36b0a1b Final i18n fixes: Use consistent translation approach for all user messages
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 05:44:11 +00:00
copilot-swe-agent[bot]
46feac1765 Fix i18n: Replace hardcoded strings with internationalized translations
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 05:38:13 +00:00
copilot-swe-agent[bot]
af88062219 Add Scenario Mode with workflow editor - backend and frontend implementation
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-23 05:32:56 +00:00
copilot-swe-agent[bot]
a4712f2b96 Initial plan 2025-11-23 05:22:31 +00:00
whyour
3b0f55caf4 修复任务实例默认值 2025-11-23 12:45:02 +08:00
Copilot
6a3dd4f83c
Fix null log_name issue by omitting it from shell command when not set (#2849)
* Initial plan

* Fix null log_name handling in runSingle method

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Update cron.log_name before makeCommand to avoid passing null to shell

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Fix: Only pass log_name to shell when it has a value

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Fix uniqPath calculation in runSingle for null log_name

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Improve comment clarity in makeCommand

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Refactor: Move no_tee and ID to initial commandVariable declaration

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Refactor: Simplify uniqPath ternary expression

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-22 12:06:01 +08:00
whyour
177cd3de81 更新 docker 日志 2025-11-22 01:05:28 +08:00
Copilot
d473c3ae88
Fix SSH global private key matching before subscription-specific keys (#2845)
* Initial plan

* Fix SSH global private key loading order by using zzz_ prefix

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Use tilde (~) prefix for global SSH config to ensure it loads last

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-21 01:53:58 +08:00
Copilot
ee2fbe5335
Add global SSH key configuration in system settings (#2840)
* Initial plan

* Add backend support for global SSH keys

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add frontend UI for global SSH keys management

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add SshKeyModel to database initialization

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add SSH config generation for global SSH keys

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add internationalization support for SSH key management UI

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Simplify to single global SSH key in system settings

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-20 10:09:01 +08:00
Copilot
48abf44ceb
feat: Support multiple concurrent login sessions per platform (#2816)
* Initial plan

* Implement multi-device login support - allow multiple concurrent sessions

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Address code review feedback - extract constants and utility functions

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add validation and logging improvements based on code review

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Revert unnecessary file changes - keep only multi-device login feature files

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-19 00:18:29 +08:00
Copilot
03c7031a3c
Fix task duplication: add single/multi-instance support with UI configuration and stop all running instances (#2837)
* Initial plan

* Stop running tasks before starting new scheduled instance

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add multi-instance support and fix stop to kill all running instances

- Add allow_multiple_instances field to Crontab model (default: 0 for single instance)
- Add validation for new field in commonCronSchema
- Add getAllPids and killAllTasks utility functions
- Update stop method to kill ALL running instances of a task
- Update runCron to respect allow_multiple_instances config
- Backward compatible: defaults to single instance mode

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add UI support for allow_multiple_instances configuration

- Add allow_multiple_instances field to ICrontab interface
- Add instance mode selector in task creation/edit modal
- Add translations for instance mode in Chinese and English
- Default to single instance mode for backward compatibility

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Add allow_multiple_instances column migration and optimize db.ts

- Add allow_multiple_instances column to Crontabs table migration
- Refactor migration code to use data-driven approach
- Replace 11 individual try-catch blocks with single loop
- Improve code maintainability and readability

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-19 00:10:27 +08:00
whyour
0e5de4a824 更新启动日志 2025-11-16 21:31:52 +08:00
whyour
af96bd98ac 修复系统提示 2025-11-16 21:26:14 +08:00
Copilot
08ef509e27
Optimize log file writes using stream pooling (#2835)
* Initial plan

* Implement LogStreamManager for optimized log writing

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

* Fix error handler in LogStreamManager to avoid race conditions

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
2025-11-16 21:11:10 +08:00