fix: 存量 background 值不再阻塞后台设置保存（#514 升级回归） - #528
Merged
Merged
Conversation
#514 began validating `background` as an http(s) URL against the *merged* config, so a value stored by an older release (a relative path, or one containing a space/parenthesis — all legal before) made every subsequent settings save return 400, including saves that never touched `background`. Existing deployments could not change any setting at all. Validate only values that actually change: an untouched legacy value is kept as-is (it is still html-escaped on render), while any edit must pass validation. Regression tests cover both directions and fail without this change. Also treat OverflowError from hashlib.scrypt as a non-matching hash so a hand-crafted n/r/p cannot disturb the login path on runtimes that raise it.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题（合并 #514 后引入的升级回归）
#514 把
background配置校验为 http(s) 完整 URL，但校验的是合并后的配置，且在每次保存时执行：
旧版本允许相对路径、含空格或括号的
background（例如/static/bg image.png）。这类存量部署在升级后，任何设置保存都会 400（
background 必须是 http(s) 完整 URL 或留空），即使这次保存根本没碰
background—— 后台等于无法改任何配置。修复
只校验真正发生变化的取值：未改动的存量值原样保留（渲染侧仍然
html.escape，且值仍被限制在
style="..."属性内），任何修改都必须通过校验。因此：老值不动 → 正常保存；改成恶意值 → 仍然 400；改成合法值 → 通过。
测试
LegacyBackgroundUpgradeTests两个用例（存量值不阻塞保存 / 修改仍受校验）。已确认这两个用例在未修复的 master 上失败（
1 failed, 5 passed），修复后通过。verify_password的超范围n/r/p用例加了断言：实测解释器抛TypeError（原代码已捕获），
OverflowError属于部分构建的防御性兜底，不是已复现的 500。106 passed, 2 skipped（基线 104 + 新增 2），ruff check .通过。