diff --git a/.gitignore b/.gitignore
index d7596c5..1c8777a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,4 +24,7 @@ cmake-build-debug
server.exe
+embalming_girl_server.exe
+embalming_girl_server_linux
+
diff --git a/admin/admin.go b/admin/admin.go
index 77fd4d8..ed3a683 100644
--- a/admin/admin.go
+++ b/admin/admin.go
@@ -2,35 +2,76 @@ package admin
import (
"Embalming_Girl_Server/db"
+ "crypto/rand"
+ "encoding/hex"
"encoding/json"
- "fmt"
"net/http"
)
-const AdminPassword = "admin123"
+const AdminPassword = "Qwer123456789!"
+
+var adminSession string
+
+func genSession() string {
+ b := make([]byte, 32)
+ rand.Read(b)
+ return hex.EncodeToString(b)
+}
+
+func isAuth(r *http.Request) bool {
+ c, err := r.Cookie("admin_session")
+ return err == nil && c.Value != "" && c.Value == adminSession
+}
+
+func authWrap(h http.HandlerFunc) http.HandlerFunc {
+ return func(w http.ResponseWriter, r *http.Request) {
+ if !isAuth(r) {
+ w.WriteHeader(401)
+ json.NewEncoder(w).Encode(map[string]interface{}{"error": "unauthorized"})
+ return
+ }
+ h(w, r)
+ }
+}
func Register(mux *http.ServeMux, getStats func() map[string]interface{}) {
mux.HandleFunc("/admin", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/html; charset=utf-8")
- fmt.Fprint(w, adminHTML)
+ w.Write([]byte(adminHTML))
})
mux.HandleFunc("/api/admin/login", func(w http.ResponseWriter, r *http.Request) {
var req struct {
Password string `json:"password"`
}
json.NewDecoder(r.Body).Decode(&req)
+ w.Header().Set("Content-Type", "application/json")
if req.Password != AdminPassword {
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false})
return
}
+ adminSession = genSession()
+ http.SetCookie(w, &http.Cookie{
+ Name: "admin_session", Value: adminSession,
+ Path: "/", MaxAge: 86400, HttpOnly: true,
+ })
json.NewEncoder(w).Encode(map[string]interface{}{"ok": true})
})
- mux.HandleFunc("/api/admin/stats", func(w http.ResponseWriter, r *http.Request) {
+ mux.HandleFunc("/api/admin/logout", func(w http.ResponseWriter, r *http.Request) {
+ adminSession = ""
+ http.SetCookie(w, &http.Cookie{Name: "admin_session", Value: "", Path: "/", MaxAge: -1})
+ w.Header().Set("Content-Type", "application/json")
+ json.NewEncoder(w).Encode(map[string]interface{}{"ok": true})
+ })
+ mux.HandleFunc("/api/admin/check_session", func(w http.ResponseWriter, r *http.Request) {
+ w.Header().Set("Content-Type", "application/json")
+ json.NewEncoder(w).Encode(map[string]interface{}{"ok": isAuth(r)})
+ })
+ mux.HandleFunc("/api/admin/stats", authWrap(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(getStats())
- })
- mux.HandleFunc("/api/admin/users", func(w http.ResponseWriter, r *http.Request) {
- rows, err := db.DB.Query("SELECT id, username, nickname, bio, avatar, created_at, last_login FROM users ORDER BY id DESC")
+ }))
+ mux.HandleFunc("/api/admin/users", authWrap(func(w http.ResponseWriter, r *http.Request) {
+ rows, err := db.DB.Query("SELECT id,username,nickname,bio,avatar,created_at,last_login FROM users ORDER BY id DESC")
if err != nil {
json.NewEncoder(w).Encode([]int{})
return
@@ -49,70 +90,129 @@ func Register(mux *http.ServeMux, getStats func() map[string]interface{}) {
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(users)
- })
- mux.HandleFunc("/api/admin/delete_user", func(w http.ResponseWriter, r *http.Request) {
+ }))
+ mux.HandleFunc("/api/admin/delete_user", authWrap(func(w http.ResponseWriter, r *http.Request) {
var req struct {
ID int64 `json:"id"`
}
json.NewDecoder(r.Body).Decode(&req)
db.DB.Exec("DELETE FROM sessions WHERE user_id=?", req.ID)
db.DB.Exec("DELETE FROM users WHERE id=?", req.ID)
+ w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": true})
- })
+ }))
}
-const adminHTML = `管理面板
+const adminHTML = `Embalming Girl - Admin
-管理面板
-
-Embalming Girl 管理面板
-
-
-
+
Embalming Girl
Server Admin Panel
+
+
+