fix: address code review feedback - improve notifyType logic and typing

Agent-Logs-Url: https://github.com/whyour/qinglong/sessions/4c9f0ab1-8b0e-4b94-b295-39c90ed942c2

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

back/api/system.ts

@@ -374,6 +374,19 @@ export default (app: Router) => {
     },
   );
 
+  route.get(
+    '/notify-log',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const systemService = Container.get(SystemService);
+        const data = await systemService.getNotifyLog();
+        res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
   route.delete(
     '/log',
     async (req: Request, res: Response, next: NextFunction) => {

back/data/system.ts

@@ -28,6 +28,12 @@ export enum AuthDataType {
   'removeLogFrequency' = 'removeLogFrequency',
   'systemConfig' = 'systemConfig',
   'authConfig' = 'authConfig',
+  'notifyLog' = 'notifyLog',
+}
+
+export enum NotifyStatus {
+  'success',
+  'fail',
 }
 
 export interface SystemConfigInfo {
@@ -49,6 +55,14 @@ export interface LoginLogInfo {
   status?: LoginStatus;
 }
 
+export interface NotifyLogInfo {
+  timestamp?: number;
+  title?: string;
+  content?: string;
+  status?: NotifyStatus;
+  notifyType?: string;
+}
+
 export interface TokenInfo {
   value: string;
   timestamp: number;
@@ -81,6 +95,7 @@ export interface AuthInfo {
 export type SystemModelInfo = SystemConfigInfo &
   Partial<NotificationInfo> &
   LoginLogInfo &
+  Partial<NotifyLogInfo> &
   Partial<AuthInfo>;
 
 export interface SystemInstance

back/loaders/express.ts

@@ -13,9 +13,29 @@ import { isValidToken } from '../shared/auth';
 import path from 'path';
 
 export default ({ app }: { app: Application }) => {
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
   app.set('trust proxy', 'loopback');
   app.use(cors());
   
+  // Security: Path normalization middleware to prevent case variation attacks
+  app.use((req, res, next) => {
+    const originalPath = req.path;
+    const normalizedPath = originalPath.toLowerCase();
+    
+    // Block requests with case variations on protected paths
+    if (originalPath !== normalizedPath && 
+        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+      return res.status(400).json({
+        code: 400,
+        message: 'Invalid path format'
+      });
+    }
+    
+    next();
+  });
+  
   // Rewrite URLs to strip baseUrl prefix if configured
   // This allows the rest of the app to work without baseUrl awareness
   if (config.baseUrl) {
@@ -36,7 +56,7 @@ export default ({ app }: { app: Application }) => {
       secret: config.jwt.secret,
       algorithms: ['HS384'],
     }).unless({
-      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
     }),
   );
 
@@ -51,19 +71,20 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req: Request, res, next) => {
-    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
       return next();
     }
 
     const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
       const apps = await shareStore.getApps();
       const doc = apps?.filter((x) =>
         x.tokens?.find((y) => y.value === headerToken),
       )?.[0];
       if (doc && doc.tokens && doc.tokens.length > 0) {
         const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
         const key = keyMatch && keyMatch[1];
         if (
           doc.scopes.includes(key as any) &&
@@ -98,7 +119,15 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(req.path)
+    ) {
       return next();
     }
     const authInfo =
@@ -123,11 +152,7 @@ export default ({ app }: { app: Application }) => {
   app.use(rewrite('/open/*', '/api/$1'));
   app.use(config.api.prefix, routes());
 
-  app.get('*', (req, res, next) => {
-    // Don't serve index.html for API routes
-    if (req.path.startsWith('/api/')) {
-      return next();
-    }
+  app.get('*', (_, res, next) => {
     const indexPath = path.join(frontendPath, 'index.html');
     res.sendFile(indexPath, (err) => {
       if (err) {

back/loaders/initData.ts

@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
   const [authConfig] = await SystemModel.findOrCreate({
     where: { type: AuthDataType.authConfig },
   });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
     let authInfo = {
       username: 'admin',
       password: 'admin',

back/services/cron.ts

@@ -29,7 +29,7 @@ import { logStreamManager } from '../shared/logStreamManager';
 
 @Service()
 export default class CronService {
-  constructor(@Inject('logger') private logger: winston.Logger) {}
+  constructor(@Inject('logger') private logger: winston.Logger) { }
 
   private isNodeCron(cron: Crontab) {
     const { schedule, extra_schedules } = cron;
@@ -165,7 +165,7 @@ export default class CronService {
       let cron;
       try {
         cron = await this.getDb({ id });
-      } catch (err) {}
+      } catch (err) { }
       if (!cron) {
         continue;
       }
@@ -467,7 +467,10 @@ export default class CronService {
     for (const doc of docs) {
       // Kill all running instances of this task
       try {
-        const command = this.makeCommand(doc);
+        if (doc.pid) {
+          await killTask(doc.pid);
+        }
+        const command = doc.command.replace(/\s+/g, ' ').trim();
         await killAllTasks(command);
         this.logger.info(
           `[panel][停止所有运行中的任务实例] 任务ID: ${doc.id}, 命令: ${command}`,

back/services/env.ts

@@ -13,10 +13,11 @@ import {
   stepPosition,
 } from '../data/env';
 import { writeFileWithLock } from '../shared/utils';
+import { sequelize } from '../data';
 
 @Service()
 export default class EnvService {
-  constructor(@Inject('logger') private logger: winston.Logger) {}
+  constructor(@Inject('logger') private logger: winston.Logger) { }
 
   public async create(payloads: Env[]): Promise<Env[]> {
     const envs = await this.envs();
@@ -146,7 +147,7 @@ export default class EnvService {
     }
     try {
       const result = await this.find(condition, [
-        ['isPinned', 'DESC'],
+        [sequelize.literal('COALESCE(`isPinned`, 0)'), 'DESC'],
         ['position', 'DESC'],
         ['createdAt', 'ASC'],
       ]);

back/services/system.ts

@@ -30,6 +30,8 @@ import {
   SystemInstance,
   SystemModel,
   SystemModelInfo,
+  NotifyStatus,
+  NotifyLogInfo,
 } from '../data/system';
 import taskLimit from '../shared/pLimit';
 import NotificationService from './notify';
@@ -389,11 +391,34 @@ export default class SystemService {
     if (notificationInfo && typeString) {
       notificationInfo.type = typeString;
     }
+
+    let notifyType: string | undefined;
+    if (notificationInfo?.type) {
+      notifyType = typeString || (notificationInfo.type as string);
+    } else {
+      try {
+        const notifConfig = await this.getDb({ type: AuthDataType.notification });
+        notifyType = notifConfig.info?.type as string | undefined;
+      } catch (e) {}
+    }
+
     const isSuccess = await this.notificationService.notify(
       title,
       content,
       notificationInfo,
     );
+
+    await SystemModel.create({
+      type: AuthDataType.notifyLog,
+      info: {
+        timestamp: Date.now(),
+        title,
+        content,
+        status: isSuccess ? NotifyStatus.success : NotifyStatus.fail,
+        notifyType,
+      },
+    });
+
     if (isSuccess) {
       return { code: 200, message: '通知发送成功' };
     } else {
@@ -401,6 +426,18 @@ export default class SystemService {
     }
   }
 
+  public async getNotifyLog(): Promise<Array<NotifyLogInfo>> {
+    const docs = await SystemModel.findAll({
+      where: { type: AuthDataType.notifyLog },
+      order: [['id', 'DESC']],
+    });
+    if (docs.length > 200) {
+      const ids = docs.slice(200).map((x) => x.id!);
+      await SystemModel.destroy({ where: { id: ids } });
+    }
+    return docs.slice(0, 200).map((x) => ({ ...x.info, id: x.id }));
+  }
+
   public async run({ command, logPath }: { command: string; logPath?: string }, callback: TaskCallbacks) {
     if (!command.startsWith(TASK_COMMAND)) {
       command = `${TASK_COMMAND} ${command}`;

docker/310.Dockerfile

@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -83,6 +84,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/Dockerfile

@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -83,6 +84,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/docker-entrypoint.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-export PATH="$HOME/bin:$PATH"
-
 dir_shell=/ql/shell
 . $dir_shell/share.sh
 

package.json

@@ -77,9 +77,9 @@
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "multer": "1.4.5-lts.1",
+    "multer": "2.1.1",
     "node-schedule": "^2.1.0",
-    "nodemailer": "^6.9.16",
+    "nodemailer": "^8.0.1",
     "p-queue-cjs": "7.3.4",
     "@bufbuild/protobuf": "^2.10.0",
     "ps-tree": "^1.2.0",

src/pages/setting/index.tsx

@@ -26,6 +26,7 @@ import {
 } from '@ant-design/icons';
 import SecuritySettings from './security';
 import LoginLog from './loginLog';
+import NotifyLog from './notifyLog';
 import NotificationSetting from './notification';
 import Other from './other';
 import About from './about';
@@ -125,6 +126,7 @@ const Setting = () => {
   const [editedApp, setEditedApp] = useState<any>();
   const [tabActiveKey, setTabActiveKey] = useState('security');
   const [loginLogData, setLoginLogData] = useState<any[]>([]);
+  const [notifyLogData, setNotifyLogData] = useState<any[]>([]);
   const [notificationInfo, setNotificationInfo] = useState<any>();
   const containergRef = useRef<HTMLDivElement>(null);
   const [height, setHeight] = useState<number>(0);
@@ -253,6 +255,8 @@ const Setting = () => {
       getApps();
     } else if (activeKey === 'login') {
       getLoginLog();
+    } else if (activeKey === 'notifylog') {
+      getNotifyLog();
     } else if (activeKey === 'notification') {
       getNotification();
     }
@@ -271,6 +275,19 @@ const Setting = () => {
       });
   };
 
+  const getNotifyLog = () => {
+    request
+      .get(`${config.apiPrefix}system/notify-log`)
+      .then(({ code, data }) => {
+        if (code === 200) {
+          setNotifyLogData(data);
+        }
+      })
+      .catch((error: any) => {
+        console.log(error);
+      });
+  };
+
   useEffect(() => {
     if (isDemoEnv) {
       getApps();
@@ -344,6 +361,11 @@ const Setting = () => {
               label: intl.get('登录日志'),
               children: <LoginLog height={height} data={loginLogData} />,
             },
+            {
+              key: 'notifylog',
+              label: intl.get('通知日志'),
+              children: <NotifyLog height={height} data={notifyLogData} />,
+            },
             {
               key: 'dependence',
               label: intl.get('依赖设置'),

src/pages/setting/notifyLog.tsx

@@ -0,0 +1,103 @@
+import intl from 'react-intl-universal';
+import React from 'react';
+import { Table, Tag } from 'antd';
+import dayjs from 'dayjs';
+
+interface NotifyLogItem {
+  id?: number;
+  timestamp?: number;
+  title?: string;
+  content?: string;
+  status?: number;
+  notifyType?: string;
+}
+
+const NotifyStatusLabel: Record<number, string> = {
+  0: '成功',
+  1: '失败',
+};
+
+const NotifyStatusColor: Record<number, string> = {
+  0: 'success',
+  1: 'error',
+};
+
+const columns = [
+  {
+    title: intl.get('序号'),
+    width: 50,
+    render: (text: string, record: any, index: number) => {
+      return index + 1;
+    },
+  },
+  {
+    title: intl.get('发送时间'),
+    dataIndex: 'timestamp',
+    key: 'timestamp',
+    width: 160,
+    render: (text: string, record: any) => {
+      return dayjs(record.timestamp).format('YYYY-MM-DD HH:mm:ss');
+    },
+  },
+  {
+    title: intl.get('标题'),
+    dataIndex: 'title',
+    key: 'title',
+    width: 200,
+  },
+  {
+    title: intl.get('内容'),
+    dataIndex: 'content',
+    key: 'content',
+    render: (text: string) => {
+      if (!text) return '';
+      return text.length > 100 ? text.slice(0, 100) + '...' : text;
+    },
+  },
+  {
+    title: intl.get('推送渠道'),
+    dataIndex: 'notifyType',
+    key: 'notifyType',
+    width: 120,
+  },
+  {
+    title: intl.get('发送状态'),
+    dataIndex: 'status',
+    key: 'status',
+    width: 90,
+    render: (text: string, record: NotifyLogItem) => {
+      const statusKey = record.status ?? 1;
+      return (
+        <Tag
+          color={NotifyStatusColor[statusKey]}
+          style={{ marginRight: 0 }}
+        >
+          {intl.get(NotifyStatusLabel[statusKey])}
+        </Tag>
+      );
+    },
+  },
+];
+
+const NotifyLog = ({
+  data,
+  height,
+}: {
+  data: Array<NotifyLogItem>;
+  height: number;
+}) => {
+  return (
+    <>
+      <Table
+        columns={columns}
+        pagination={false}
+        dataSource={data}
+        rowKey="id"
+        size="middle"
+        scroll={{ x: 1000, y: height }}
+      />
+    </>
+  );
+};
+
+export default NotifyLog;

version.yaml

@@ -1,47 +1,6 @@
-version: 2.20.0
-changeLogLink: https://t.me/jiao_long/432
-publishTime: 2025-12-10 01:05
+version: 2.20.2
+changeLogLink: https://t.me/jiao_long/434
+publishTime: 2026-03-01 1800
 changeLog: |
-  1. 定时任务（cron / task）相关的大量修复 & 增强
-
-  修复 cron 解析错误（修复 parse cron / 升级 cron-parser）
-  修复集群模式下定时任务可能不执行（race condition）
-  定时任务支持订阅筛选
-  定时任务支持排序调整
-  定时任务支持自定义日志文件或无日志
-  修复任务实例默认值
-  任务支持单实例 / 多实例模式
-  修复 task 命令软链可能失败问题
-
-  2. 日志系统相关的大更新
-
-  修复日志目录逻辑
-  修复 pm2 日志目录
-  优化日志写入（stream pooling）
-
-  3. 环境变量（env）系统的改进与修复
-
-  修复环境变量复制到剪贴板时可能失败
-  添加环境变量“置顶”功能
-  修复 QlPort 与 QlGrpcPort 环境变量在 host network 模式下被忽略
-  增加全局 SSH 私钥配置
-
-  4. Docker / 非 root 用户 / Alpine 兼容性增强
-
-  新增非 root Docker 用户支持，自动初始化命令
-  修复 Alpine 容器 DNS 解析失败（设置 ndots:0）
-  修复 PM2 在 ARM 路由器（Node.js 不兼容）上的启动失败
-  移除 nginx（可能是考虑更轻量的镜像运行）
-
-  5. API 安全与校验增强
-
-  Dependencies GET endpoint 增加校验
-  Script API routes 增加输入校验
-  修复 JWT 认证问题
-  Feishu 机器人通知增加签名校验
-  QLAPI 增加 cron task 管理功能
-  修复 URIError（错误 cookie 导致白屏）
-
-  6. 系统设置
-
-  新增多终端/多平台的并发登录会话支持
+  1. 修复 path 安全漏洞（重要）
+