mirror of
https://github.com/MengMengCode/CLICD.git
synced 2026-08-05 05:36:07 +08:00
MengMengCode
38debab1aa
- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected. - Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies. - Add NAT network configuration with validation for RFC1918 compliance and subnet parsing. - Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers. - Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests. - Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives. - Include comprehensive tests for all new functionalities to ensure reliability and correctness.
40 lines
1001 B
Go
40 lines
1001 B
Go
package server
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"clicd/internal/config"
|
|
)
|
|
|
|
func panelAccessMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
decision := config.EvaluatePanelAccess(
|
|
config.AppConfig.PanelAccessPolicy,
|
|
r.RemoteAddr,
|
|
config.ForwardedClientHeaders{
|
|
ForwardedFor: r.Header.Get("X-Forwarded-For"),
|
|
RealIP: r.Header.Get("X-Real-IP"),
|
|
CFConnectingIP: r.Header.Get("CF-Connecting-IP"),
|
|
},
|
|
)
|
|
if decision.Allowed {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
if strings.HasPrefix(r.URL.Path, "/api/") {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"success": false,
|
|
"message": "Access denied by panel source policy",
|
|
})
|
|
return
|
|
}
|
|
http.Error(w, "Access denied by panel source policy", http.StatusForbidden)
|
|
})
|
|
}
|