fix

domain_admin/api/address_api.py

@@ -11,7 +11,7 @@
 from domain_admin.model.address_model import AddressModel
 from domain_admin.model.domain_model import DomainModel
 from domain_admin.service import domain_service, auth_service
-from domain_admin.utils.flask_ext.app_exception import AppException
+from domain_admin.utils.flask_ext.app_exception import AppException, DataNotFoundAppException, ForbiddenAppException
 
 
 @auth_service.permission(role=RoleEnum.USER)
@@ -28,6 +28,15 @@ def get_address_list_by_domain_id():
     page = request.json.get('page', 1)
     size = request.json.get('size', 10)
 
+    # check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise ForbiddenAppException()
+
     query = AddressModel.select().where(
         AddressModel.domain_id == domain_id,
     )
@@ -56,6 +65,7 @@ def get_address_list_by_domain_id():
         "total": total
     }
 
+
 @auth_service.permission(role=RoleEnum.USER)
 def add_address():
     """
@@ -74,7 +84,14 @@ def add_address():
     # ssl_auto_update = request.json.get('ssl_auto_update', True)
     # ssl_expire_monitor = request.json.get('ssl_expire_monitor', True)
 
-    domain_row = DomainModel.get_by_id(domain_id)
+    # check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise ForbiddenAppException()
 
     data = {
         'domain_id': domain_id,
@@ -110,11 +127,19 @@ def delete_address_by_id():
     # update to cert
     address_row = AddressModel.get_by_id(address_id)
 
+    # check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == address_row.domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise ForbiddenAppException()
+
     AddressModel.delete().where(
         AddressModel.id == address_id
     ).execute()
 
-    domain_row = DomainModel.get_by_id(address_row.domain_id)
     domain_service.sync_address_info_to_domain_info(domain_row)
 
 
@@ -131,7 +156,9 @@ def delete_address_by_ids():
     address_ids = request.json['address_ids']
 
     # update to cert
-    address_rows = AddressModel.select(AddressModel.domain_id).where(
+    address_rows = AddressModel.select(
+        AddressModel.domain_id
+    ).where(
         AddressModel.id.in_(address_ids)
     )
 
@@ -142,7 +169,8 @@ def delete_address_by_ids():
     domain_ids = [row.domain_id for row in address_rows]
 
     domain_rows = DomainModel.select().where(
-        DomainModel.id.in_(domain_ids)
+        DomainModel.id.in_(domain_ids),
+        DomainModel.user_id == current_user_id
     )
 
     for domain_row in domain_rows:

domain_admin/api/certificate_api.py

@@ -9,7 +9,7 @@
 from domain_admin.enums.role_enum import RoleEnum
 from domain_admin.model.certificate_model import CertificateModel
 from domain_admin.service import certificate_service, auth_service
-from domain_admin.utils.flask_ext.app_exception import AppException, DataNotFoundAppException
+from domain_admin.utils.flask_ext.app_exception import AppException, DataNotFoundAppException, ForbiddenAppException
 
 
 @auth_service.permission(role=RoleEnum.USER)
@@ -28,6 +28,9 @@ def get_certificate_list():
     order_prop = request.json.get('order_prop') or 'create_time'
     order_type = request.json.get('order_type') or 'desc'
 
+    if order_prop not in ['create_time']:
+        raise AppException('params error: order_prop')
+
     if order_type not in ['desc', 'asc']:
         raise AppException('params error: order_type')
 
@@ -116,7 +119,7 @@ def update_certificate_by_id():
     ).first()
 
     if not certificate_row:
-        raise AppException('数据不存在')
+        raise DataNotFoundAppException()
 
     data = {
         'domain': domain,
@@ -151,7 +154,7 @@ def delete_certificate_by_id():
     ).first()
 
     if not certificate_row:
-        raise AppException('数据不存在')
+        raise DataNotFoundAppException()
 
     # delete
     CertificateModel.delete().where(

domain_admin/api/dns_api.py

@@ -9,7 +9,7 @@
 from domain_admin.enums.role_enum import RoleEnum
 from domain_admin.model.dns_model import DnsModel
 from domain_admin.service import auth_service
-from domain_admin.utils.flask_ext.app_exception import AppException
+from domain_admin.utils.flask_ext.app_exception import AppException, DataNotFoundAppException
 
 
 @auth_service.permission(role=RoleEnum.USER)
@@ -50,13 +50,14 @@ def update_dns_by_id():
     access_key = request.json['access_key']
     secret_key = request.json['secret_key']
 
+    # data check
     dns_row = DnsModel.select().where(
         DnsModel.id == dns_id,
         DnsModel.user_id == current_user_id
     ).first()
 
     if not dns_row:
-        raise AppException('数据不存在')
+        raise DataNotFoundAppException()
 
     DnsModel.update(
         dns_type_id=dns_type_id,
@@ -83,7 +84,7 @@ def get_dns_by_id():
     ).first()
 
     if not dns_row:
-        raise AppException('数据不存在')
+        raise DataNotFoundAppException()
 
     return dns_row
 
@@ -103,7 +104,7 @@ def delete_dns_by_id():
     ).first()
 
     if not dns_row:
-        raise AppException('数据不存在')
+        raise DataNotFoundAppException()
 
     return DnsModel.delete_by_id(dns_row.id)
 

domain_admin/api/domain_api.py

@@ -22,7 +22,7 @@
 from domain_admin.service import file_service
 from domain_admin.utils import datetime_util, domain_util
 from domain_admin.utils.cert_util import cert_consts
-from domain_admin.utils.flask_ext.app_exception import AppException
+from domain_admin.utils.flask_ext.app_exception import AppException, DataNotFoundAppException
 
 
 @auth_service.permission(role=RoleEnum.USER)
@@ -111,7 +111,14 @@ def update_domain_by_id():
     data['update_time'] = datetime_util.get_datetime()
     data['group_id'] = data.get('group_id') or 0
 
-    before_domain_row = DomainModel.get_by_id(domain_id)
+    # data check
+    before_domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not before_domain_row:
+        raise DataNotFoundAppException()
 
     DomainModel.update(data).where(
         DomainModel.id == domain_id
@@ -139,14 +146,23 @@ def update_domain_expire_monitor_by_id():
 
     domain_id = request.json.get('domain_id')
 
+    # data check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise DataNotFoundAppException()
+
     data = {
         "is_monitor": request.json.get('is_monitor', True)
     }
 
     DomainModel.update(
         data
     ).where(
-        DomainModel.id == domain_id
+        DomainModel.id == domain_row.id
     ).execute()
 
 
@@ -175,8 +191,17 @@ def update_domain_field_by_id():
         field: value,
     }
 
+    # data check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise DataNotFoundAppException()
+
     DomainModel.update(data).where(
-        DomainModel.id == domain_id
+        DomainModel.id == domain_row.id
     ).execute()
 
 
@@ -193,12 +218,16 @@ def update_domain_field_by_ids():
     field = request.json.get('field')
     value = request.json.get('value')
 
+    if field not in ['auto_update']:
+        raise AppException("not allow field")
+
     data = {
         field: value,
     }
 
     DomainModel.update(data).where(
-        DomainModel.id.in_(domain_ids)
+        DomainModel.id.in_(domain_ids),
+        DomainModel.user_id == current_user_id
     ).execute()
 
 
@@ -219,10 +248,16 @@ def delete_domain_by_id():
 
     # domain_service.check_permission_and_get_row(domain_id, current_user_id)
 
-    DomainModel.delete().where(
+    # data check
+    domain_row = DomainModel.select().where(
         DomainModel.id == domain_id,
-        DomainModel.user_id == current_user_id,
-    ).execute()
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise DataNotFoundAppException()
+
+    DomainModel.delete_by_id(domain_row.id)
 
     # 同时移除主机信息
     AddressModel.delete().where(
@@ -268,9 +303,19 @@ def get_domain_by_id():
     domain_id = request.json.get('domain_id') or request.json['id']
 
     # row = domain_service.check_permission_and_get_row(domain_id, current_user_id)
-    row = DomainModel.get_by_id(domain_id)
+    # row = DomainModel.get_by_id(domain_id)
+
+    # data check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise DataNotFoundAppException()
+
     row = model_to_dict(
-        model=row,
+        model=domain_row,
         extra_attrs=[
             'real_time_expire_days',
             'domain_url',
@@ -316,6 +361,7 @@ def update_all_domain_cert_info():
     domain_service.update_all_domain_cert_info()
 
 
+@auth_service.permission(role=RoleEnum.USER)
 def update_all_domain_cert_info_of_user():
     """
     更新当前用户的所有域名信息
@@ -340,9 +386,18 @@ def update_domain_row_info_by_id():
     domain_id = request.json.get('domain_id') or request.json['id']
 
     # row = domain_service.check_permission_and_get_row(domain_id, current_user_id)
-    row = DomainModel.get_by_id(domain_id)
+    # row = DomainModel.get_by_id(domain_id)
+
+    # data check
+    domain_row = DomainModel.select().where(
+        DomainModel.id == domain_id,
+        DomainModel.user_id == current_user_id
+    ).first()
+
+    if not domain_row:
+        raise DataNotFoundAppException()
 
-    domain_service.update_domain_row(row)
+    domain_service.update_domain_row(domain_row=domain_row)
 
 
 @auth_service.permission(role=RoleEnum.USER)
@@ -465,7 +520,8 @@ def domain_relation_group():
     DomainModel.update(
         group_id=group_id
     ).where(
-        DomainModel.id.in_(domain_ids)
+        DomainModel.id.in_(domain_ids),
+        DomainModel.user_id == current_user_id
     ).execute()