@whyour/qinglong 2.20.2-3 → 2.21.0-10

package/static/build/loaders/deps.js

@@ -6,20 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const promises_1 = __importDefault(require("fs/promises"));
 const os_1 = __importDefault(require("os"));
-const chokidar_1 = __importDefault(require("chokidar"));
 const index_1 = __importDefault(require("../config/index"));
 const logger_1 = __importDefault(require("./logger"));
-async function linkToNodeModule(src, dst) {
-    const target = path_1.default.join(index_1.default.rootPath, 'node_modules', dst || src);
-    const source = path_1.default.join(index_1.default.rootPath, src);
-    try {
-        const stats = await promises_1.default.lstat(target);
-        if (!stats) {
-            await promises_1.default.symlink(source, target, 'dir');
-        }
-    }
-    catch (error) { }
-}
 async function linkCommand() {
     const homeDir = os_1.default.homedir();
     let userBinDir = path_1.default.join(homeDir, 'bin');
@@ -59,16 +47,7 @@ async function linkCommandToDir(commandDir) {
         await promises_1.default.rename(tmpTarget, target);
     }
 }
-exports.default = async (src = 'deps') => {
+exports.default = async () => {
     await linkCommand();
-    await linkToNodeModule(src);
-    const source = path_1.default.join(index_1.default.rootPath, src);
-    const watcher = chokidar_1.default.watch(source, {
-        ignored: /(^|[\/\\])\../,
-        persistent: true,
-    });
-    watcher
-        .on('add', () => linkToNodeModule(src))
-        .on('change', () => linkToNodeModule(src));
 };
 //# sourceMappingURL=deps.js.map

package/static/build/loaders/express.js

@@ -16,6 +16,7 @@ const serverEnv_1 = require("../config/serverEnv");
 const store_1 = require("../shared/store");
 const auth_1 = require("../shared/auth");
 const path_1 = __importDefault(require("path"));
+const i18n_1 = require("../shared/i18n");
 exports.default = ({ app }) => {
     // Security: Enable strict routing to prevent case-insensitive path bypass
     app.set('case sensitive routing', true);
@@ -77,14 +78,22 @@ exports.default = ({ app }) => {
                 const currentToken = doc.tokens.find((x) => x.value === headerToken);
                 const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
                 const key = keyMatch && keyMatch[1];
-                if (doc.scopes.includes(key) &&
-                    currentToken &&
-                    currentToken.expiration >= Math.round(Date.now() / 1000)) {
-                    return next();
+                if (!doc.scopes.includes(key)) {
+                    const err = new express_jwt_1.UnauthorizedError('credentials_bad_scheme', {
+                        message: (0, i18n_1.t)('暂无权限'),
+                    });
+                    return next(err);
                 }
+                if (!currentToken || currentToken.expiration < Math.round(Date.now() / 1000)) {
+                    const err = new express_jwt_1.UnauthorizedError('invalid_token', {
+                        message: (0, i18n_1.t)('Token 已失效'),
+                    });
+                    return next(err);
+                }
+                return next();
             }
         }
-        const originPath = `${req.baseUrl}${req.path === '/' ? '' : req.path}`;
+        const originPath = `${req.baseUrl}${pathLower === '/' ? '' : pathLower}`;
         if (!headerToken &&
             originPath &&
             config_1.default.apiWhiteList.includes(originPath)) {
@@ -96,8 +105,8 @@ exports.default = ({ app }) => {
         }
         const errorCode = headerToken ? 'invalid_token' : 'credentials_required';
         const errorMessage = headerToken
-            ? 'jwt malformed'
-            : 'No authorization token was found';
+            ? (0, i18n_1.t)('Token 已失效')
+            : (0, i18n_1.t)('请先登录');
         const err = new express_jwt_1.UnauthorizedError(errorCode, { message: errorMessage });
         next(err);
     });
@@ -108,18 +117,13 @@ exports.default = ({ app }) => {
             '/api/user/notification/init',
             '/open/user/init',
             '/open/user/notification/init',
-        ].includes(req.path)) {
+        ].includes(pathLower)) {
             return next();
         }
         const authInfo = (await store_1.shareStore.getAuthInfo()) || {};
-        let isInitialized = true;
-        if (Object.keys(authInfo).length === 2 &&
-            authInfo.username === 'admin' &&
-            authInfo.password === 'admin') {
-            isInitialized = false;
-        }
+        let isInitialized = !(0, auth_1.isDefaultAuthInfo)(authInfo);
         if (isInitialized) {
-            return res.send({ code: 450, message: '未知错误' });
+            return res.send({ code: 450, message: (0, i18n_1.t)('未知错误') });
         }
         else {
             return next();

package/static/build/loaders/initData.js

@@ -46,8 +46,10 @@ const open_1 = __importDefault(require("../services/open"));
 const store_1 = require("../shared/store");
 const logger_1 = __importDefault(require("./logger"));
 const open_2 = require("../data/open");
+const runningInstance_1 = require("../data/runningInstance");
+const i18n_1 = require("../shared/i18n");
 exports.default = async () => {
-    var _a, _b, _c, _d, _e, _f, _g;
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     const cronService = typedi_1.Container.get(cron_2.default);
     const envService = typedi_1.Container.get(env_1.default);
     const dependenceService = typedi_1.Container.get(dependence_1.default);
@@ -61,11 +63,14 @@ exports.default = async () => {
     if (!systemApp) {
         systemApp = await open_2.AppModel.create({
             name: 'system',
-            scopes: ['crons', 'system'],
+            scopes: ['crons', 'system', 'dashboard'],
             client_id: (0, util_1.createRandomString)(12, 12),
             client_secret: (0, util_1.createRandomString)(24, 24),
         });
     }
+    else if (!systemApp.scopes.includes('dashboard')) {
+        await open_2.AppModel.update({ scopes: [...systemApp.scopes, 'dashboard'] }, { where: { name: 'system' } });
+    }
     const [systemConfig] = await system_1.SystemModel.findOrCreate({
         where: { type: system_1.AuthDataType.systemConfig },
     });
@@ -146,6 +151,8 @@ exports.default = async () => {
     });
     // 初始化更新所有任务状态为空闲
     await cron_1.CrontabModel.update({ status: cron_1.CrontabStatus.idle }, { where: {} });
+    // 清空所有运行中的实例记录（服务重启后进程已不存在）
+    await runningInstance_1.RunningInstanceModel.update({ status: runningInstance_1.InstanceStatus.stopped }, { where: { status: runningInstance_1.InstanceStatus.running } });
     // 初始化时执行一次所有的 ql repo 任务
     cron_1.CrontabModel.findAll({
         where: {
@@ -199,6 +206,17 @@ exports.default = async () => {
             }
         }
     });
+    // 初始化语言（必须在 autosave_crontab 之前）
+    const lang = ((_h = systemConfig.info) === null || _h === void 0 ? void 0 : _h.lang) || (0, i18n_1.systemLang)();
+    (0, i18n_1.setLang)(lang);
+    // 确保 lang_env.sh 存在
+    try {
+        const langEnvExist = await (0, util_1.fileExist)(config_1.default.langEnvFile);
+        if (!langEnvExist) {
+            await (0, promises_1.writeFile)(config_1.default.langEnvFile, `export QL_LANG='${lang}'\n`);
+        }
+    }
+    catch (_j) { }
     // 初始化保存一次ck和定时任务数据
     await cronService.autosave_crontab();
     await envService.set_envs();

package/static/build/loaders/initFile.js

@@ -22,6 +22,7 @@ const uploadPath = path_1.default.join(dataPath, 'upload/');
 const bakPath = path_1.default.join(dataPath, 'bak/');
 const samplePath = path_1.default.join(rootPath, 'sample/');
 const tmpPath = path_1.default.join(logPath, '.tmp/');
+const rootTmpPath = path_1.default.join(rootPath, '.tmp/');
 const confFile = path_1.default.join(configPath, 'config.sh');
 const sampleConfigFile = path_1.default.join(samplePath, 'config.sample.sh');
 const sampleTaskShellFile = path_1.default.join(samplePath, 'task.sample.sh');
@@ -45,6 +46,7 @@ const directories = [
     preloadPath,
     logPath,
     tmpPath,
+    rootTmpPath,
     uploadPath,
     sshPath,
     bakPath,
@@ -115,6 +117,6 @@ exports.default = async () => {
             await (0, utils_1.writeFileWithLock)(item.target, content);
         }
     }
-    logger_1.default.info('✌️ Init file down');
+    logger_1.default.info('[boot] Init file down');
 };
 //# sourceMappingURL=initFile.js.map

package/static/build/loaders/initTask.js

@@ -11,6 +11,7 @@ const sshKey_1 = __importDefault(require("../services/sshKey"));
 const config_1 = __importDefault(require("../config"));
 const util_1 = require("../config/util");
 const path_1 = require("path");
+const i18n_1 = require("../shared/i18n");
 exports.default = async () => {
     const systemService = typedi_1.Container.get(system_1.default);
     const scheduleService = typedi_1.Container.get(schedule_1.default);
@@ -24,7 +25,7 @@ exports.default = async () => {
     }
     const cron = {
         id: NaN,
-        name: '生成token',
+        name: (0, i18n_1.t)('生成token'),
         command: tokenCommand,
         runOrigin: 'system',
     };
@@ -38,7 +39,7 @@ exports.default = async () => {
         if (data.info.logRemoveFrequency) {
             const rmlogCron = {
                 id: data.id,
-                name: '删除日志',
+                name: (0, i18n_1.t)('删除日志'),
                 command: `ql rmlog ${data.info.logRemoveFrequency}`,
                 runOrigin: 'system',
             };

package/static/build/loaders/server.js

@@ -7,7 +7,7 @@ const logger_1 = __importDefault(require("./logger"));
 const sock_1 = __importDefault(require("./sock"));
 exports.default = async ({ server }) => {
     await (0, sock_1.default)({ server });
-    logger_1.default.info('✌️ Sock loaded');
+    logger_1.default.info('[boot] Sock loaded');
     process.on('uncaughtException', (error) => {
         logger_1.default.error('Uncaught exception:', error);
     });

package/static/build/protos/api.js

@@ -33,6 +33,7 @@ var NotificationMode;
     NotificationMode[NotificationMode["chronocat"] = 18] = "chronocat";
     NotificationMode[NotificationMode["ntfy"] = 19] = "ntfy";
     NotificationMode[NotificationMode["wxPusherBot"] = 20] = "wxPusherBot";
+    NotificationMode[NotificationMode["wxPusherSpt"] = 21] = "wxPusherSpt";
     NotificationMode[NotificationMode["UNRECOGNIZED"] = -1] = "UNRECOGNIZED";
 })(NotificationMode || (exports.NotificationMode = NotificationMode = {}));
 function notificationModeFromJSON(object) {
@@ -100,6 +101,9 @@ function notificationModeFromJSON(object) {
         case 20:
         case "wxPusherBot":
             return NotificationMode.wxPusherBot;
+        case 21:
+        case "wxPusherSpt":
+            return NotificationMode.wxPusherSpt;
         case -1:
         case "UNRECOGNIZED":
         default:
@@ -151,6 +155,8 @@ function notificationModeToJSON(object) {
             return "ntfy";
         case NotificationMode.wxPusherBot:
             return "wxPusherBot";
+        case NotificationMode.wxPusherSpt:
+            return "wxPusherSpt";
         case NotificationMode.UNRECOGNIZED:
         default:
             return "UNRECOGNIZED";
@@ -2495,6 +2501,7 @@ function createBaseNotificationInfo() {
         wxPusherBotAppToken: undefined,
         wxPusherBotTopicIds: undefined,
         wxPusherBotUids: undefined,
+        wxPusherSptList: undefined,
     };
 }
 exports.NotificationInfo = {
@@ -2706,6 +2713,9 @@ exports.NotificationInfo = {
         if (message.wxPusherBotUids !== undefined) {
             writer.uint32(546).string(message.wxPusherBotUids);
         }
+        if (message.wxPusherSptList !== undefined) {
+            writer.uint32(562).string(message.wxPusherSptList);
+        }
         return writer;
     },
     decode(input, length) {
@@ -3198,6 +3208,13 @@ exports.NotificationInfo = {
                     message.wxPusherBotUids = reader.string();
                     continue;
                 }
+                case 70: {
+                    if (tag !== 562) {
+                        break;
+                    }
+                    message.wxPusherSptList = reader.string();
+                    continue;
+                }
             }
             if ((tag & 7) === 4 || tag === 0) {
                 break;
@@ -3289,6 +3306,7 @@ exports.NotificationInfo = {
                 ? globalThis.String(object.wxPusherBotTopicIds)
                 : undefined,
             wxPusherBotUids: isSet(object.wxPusherBotUids) ? globalThis.String(object.wxPusherBotUids) : undefined,
+            wxPusherSptList: isSet(object.wxPusherSptList) ? globalThis.String(object.wxPusherSptList) : undefined,
         };
     },
     toJSON(message) {
@@ -3500,13 +3518,16 @@ exports.NotificationInfo = {
         if (message.wxPusherBotUids !== undefined) {
             obj.wxPusherBotUids = message.wxPusherBotUids;
         }
+        if (message.wxPusherSptList !== undefined) {
+            obj.wxPusherSptList = message.wxPusherSptList;
+        }
         return obj;
     },
     create(base) {
         return exports.NotificationInfo.fromPartial(base !== null && base !== void 0 ? base : {});
     },
     fromPartial(object) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, _25, _26, _27, _28, _29, _30, _31, _32, _33, _34, _35, _36, _37, _38, _39, _40, _41, _42, _43, _44;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, _25, _26, _27, _28, _29, _30, _31, _32, _33, _34, _35, _36, _37, _38, _39, _40, _41, _42, _43, _44, _45;
         const message = createBaseNotificationInfo();
         message.type = (_a = object.type) !== null && _a !== void 0 ? _a : 0;
         message.gotifyUrl = (_b = object.gotifyUrl) !== null && _b !== void 0 ? _b : undefined;
@@ -3577,6 +3598,7 @@ exports.NotificationInfo = {
         message.wxPusherBotAppToken = (_42 = object.wxPusherBotAppToken) !== null && _42 !== void 0 ? _42 : undefined;
         message.wxPusherBotTopicIds = (_43 = object.wxPusherBotTopicIds) !== null && _43 !== void 0 ? _43 : undefined;
         message.wxPusherBotUids = (_44 = object.wxPusherBotUids) !== null && _44 !== void 0 ? _44 : undefined;
+        message.wxPusherSptList = (_45 = object.wxPusherSptList) !== null && _45 !== void 0 ? _45 : undefined;
         return message;
     },
 };

package/static/build/schedule/addCron.js

@@ -4,14 +4,59 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addCron = void 0;
+const grpc_js_1 = require("@grpc/grpc-js");
 const node_schedule_1 = __importDefault(require("node-schedule"));
 const data_1 = require("./data");
 const runCron_1 = require("../shared/runCron");
 const logger_1 = __importDefault(require("../loaders/logger"));
+const i18n_1 = require("../shared/i18n");
+/**
+ * 预校验 cron 表达式，检测 node-schedule 会拒绝但 cron-parser 会接受的 pattern。
+ * node-schedule 对 bare /N（字段以 / 开头，如前无星号/数字前缀的 /6）返回 null，
+ * 提前拦截避免走 scheduleJob 后才发现无效。
+ */
+const isValidCronField = (cron) => {
+    // 检测 bare /N 模式：字段以 / 开头如 "/6"，或空格后紧跟 "/6"
+    // node-schedule 会对这种字段返回 null
+    if (/\s\/\d/.test(cron) || /^\/\d/.test(cron)) {
+        return false;
+    }
+    // 检测 ? 字符：Quartz cron 语法，node-schedule 在大多数位置返回 null
+    // cron-parser 接受但 node-schedule 拒绝，提前拦截
+    if (/\?/.test(cron)) {
+        return false;
+    }
+    return true;
+};
 const addCron = (call, callback) => {
     var _a;
+    // ===== 第一遍：预校验所有 cron 表达式 =====
+    const validationErrors = [];
+    for (const item of call.request.crons) {
+        const { id, schedule, extra_schedules } = item;
+        if (!isValidCronField(schedule)) {
+            validationErrors.push((0, i18n_1.tf)('任务ID %s: 无效的 cron 表达式 "%s"（不支持裸 /N 步长和 ? 字符）', String(id), schedule));
+        }
+        if (extra_schedules === null || extra_schedules === void 0 ? void 0 : extra_schedules.length) {
+            extra_schedules.forEach((x) => {
+                if (!isValidCronField(x.schedule)) {
+                    validationErrors.push((0, i18n_1.tf)('任务ID %s (extra_schedule): 无效的 cron 表达式 "%s"（不支持裸 /N 步长和 ? 字符）', String(id), x.schedule));
+                }
+            });
+        }
+    }
+    if (validationErrors.length > 0) {
+        const details = validationErrors.join('\n');
+        const err = new Error(details);
+        err.code = grpc_js_1.status.INVALID_ARGUMENT;
+        err.details = details;
+        callback(err, null);
+        return;
+    }
+    // ===== 第二遍：注册所有任务 =====
     for (const item of call.request.crons) {
         const { id, schedule, command, extra_schedules, name } = item;
+        // 取消该 id 已有的旧任务
         if (data_1.scheduleStacks.has(id)) {
             (_a = data_1.scheduleStacks.get(id)) === null || _a === void 0 ? void 0 : _a.forEach((x) => x.cancel());
         }
@@ -21,18 +66,30 @@ const addCron = (call, callback) => {
                 logger_1.default.info('[schedule][创建定时任务] 任务ID: %s, 名称: %s, cron: %s, 执行命令: %s', id, name, x.schedule, command);
             });
         }
-        data_1.scheduleStacks.set(id, [
-            node_schedule_1.default.scheduleJob(id, schedule, async () => {
-                logger_1.default.info(`[schedule][准备运行任务] 命令: ${command}`);
-                (0, runCron_1.runCron)(command, item);
-            }),
-            ...((extra_schedules === null || extra_schedules === void 0 ? void 0 : extra_schedules.length)
-                ? extra_schedules.map((x) => node_schedule_1.default.scheduleJob(id, x.schedule, async () => {
+        const mainJob = node_schedule_1.default.scheduleJob(id, schedule, async () => {
+            logger_1.default.info(`[schedule][准备运行任务] 命令: ${command}`);
+            (0, runCron_1.runCron)(command, item);
+        });
+        if (!mainJob) {
+            logger_1.default.warn('[schedule][创建定时任务] scheduleJob 返回 null（不符合预期，已通过预校验）: 任务ID: %s, cron: %s', id, schedule);
+        }
+        const extraJobs = (extra_schedules === null || extra_schedules === void 0 ? void 0 : extra_schedules.length)
+            ? extra_schedules.map((x) => {
+                const job = node_schedule_1.default.scheduleJob(id, x.schedule, async () => {
                     logger_1.default.info(`[schedule][准备运行任务] 命令: ${command}`);
                     (0, runCron_1.runCron)(command, item);
-                }))
-                : []),
-        ]);
+                });
+                if (!job) {
+                    logger_1.default.warn('[schedule][创建定时任务] scheduleJob 返回 null（不符合预期，已通过预校验）: 任务ID: %s, cron: %s', id, x.schedule);
+                }
+                return job;
+            })
+            : [];
+        // 过滤 null（兜底保护，正常情况下预校验已拦截）
+        const jobs = [mainJob, ...extraJobs].filter((x) => x != null);
+        if (jobs.length > 0) {
+            data_1.scheduleStacks.set(id, jobs);
+        }
     }
     callback(null, null);
 };

package/static/build/schedule/api.js

@@ -203,7 +203,7 @@ const normalizeCronData = (data) => {
     var _a, _b, _c, _d, _e;
     if (!data)
         return undefined;
-    return Object.assign(Object.assign({}, data), { sub_id: (_a = data.sub_id) !== null && _a !== void 0 ? _a : undefined, extra_schedules: (_b = data.extra_schedules) !== null && _b !== void 0 ? _b : undefined, pid: (_c = data.pid) !== null && _c !== void 0 ? _c : undefined, task_before: (_d = data.task_before) !== null && _d !== void 0 ? _d : undefined, task_after: (_e = data.task_after) !== null && _e !== void 0 ? _e : undefined });
+    return Object.assign(Object.assign({}, data), { sub_id: (_a = data.sub_id) !== null && _a !== void 0 ? _a : undefined, extra_schedules: (_b = data.extra_schedules) !== null && _b !== void 0 ? _b : [], pid: (_c = data.pid) !== null && _c !== void 0 ? _c : undefined, task_before: (_d = data.task_before) !== null && _d !== void 0 ? _d : undefined, task_after: (_e = data.task_after) !== null && _e !== void 0 ? _e : undefined });
 };
 const getCronDetail = async (call, callback) => {
     try {

package/static/build/schedule/client.js

@@ -6,9 +6,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const grpc_js_1 = require("@grpc/grpc-js");
 const cron_1 = require("../protos/cron");
 const config_1 = __importDefault(require("../config"));
+const grpcCerts_1 = require("../config/grpcCerts");
 class Client {
     constructor() {
-        this.client = new cron_1.CronClient(`0.0.0.0:${config_1.default.grpcPort}`, grpc_js_1.credentials.createInsecure(), { 'grpc.enable_http_proxy': 0 });
+        this._client = null;
+    }
+    get client() {
+        if (!this._client) {
+            const tlsConfig = (0, grpcCerts_1.getGrpcCerts)();
+            this._client = new cron_1.CronClient(`localhost:${config_1.default.grpcPort}`, grpc_js_1.credentials.createSsl(Buffer.from(tlsConfig.caCert), Buffer.from(tlsConfig.clientKey), Buffer.from(tlsConfig.clientCert)), { 'grpc.enable_http_proxy': 0 });
+        }
+        return this._client;
     }
     addCron(request) {
         return new Promise((resolve, reject) => {

package/static/build/schedule/delCron.js

@@ -11,7 +11,17 @@ const delCron = (call, callback) => {
     for (const id of call.request.ids) {
         if (data_1.scheduleStacks.has(id)) {
             logger_1.default.info('[schedule][取消定时任务] 任务ID: %s', id);
-            (_a = data_1.scheduleStacks.get(id)) === null || _a === void 0 ? void 0 : _a.forEach(x => x.cancel());
+            // 过滤掉 nodeSchedule.scheduleJob() 对无效表达式返回的 null，
+            // 否则对 null 调 cancel() 会让整个取消流程抛出 UNKNOWN 错误，
+            // 进而导致 HTTP 端的 remove() 跳过 setCrontab()，造成 crontab.list 残留。
+            (_a = data_1.scheduleStacks.get(id)) === null || _a === void 0 ? void 0 : _a.filter((x) => x != null).forEach((x) => {
+                try {
+                    x.cancel();
+                }
+                catch (error) {
+                    logger_1.default.warn('[schedule][取消任务失败] 任务ID: %s, 错误: %s', id, (error === null || error === void 0 ? void 0 : error.message) || error);
+                }
+            });
             data_1.scheduleStacks.delete(id);
         }
     }

package/static/build/schedule/health.js

@@ -9,7 +9,7 @@ const util_1 = require("../config/util");
 const check = async (call, callback) => {
     switch (call.request.service) {
         case 'cron':
-            const res = await (0, util_1.promiseExec)(`curl -s --noproxy '*' http://0.0.0.0:${config_1.default.port}/api/system`);
+            const res = await (0, util_1.promiseExec)(`curl -s --noproxy '*' http://localhost:${config_1.default.port}/api/system`);
             if (res.includes('200')) {
                 return callback(null, { status: 1 });
             }

package/static/build/services/config.js

@@ -39,16 +39,30 @@ const typedi_1 = require("typedi");
 const path_1 = __importStar(require("path"));
 const config_1 = __importDefault(require("../config"));
 const util_1 = require("../config/util");
+const i18n_1 = require("../shared/i18n");
 const undici_1 = require("undici");
 let ConfigService = class ConfigService {
     constructor() { }
     async getFile(filePath, res) {
         let content = '';
-        const avaliablePath = [config_1.default.rootPath, config_1.default.configPath].map((x) => path_1.default.resolve(x, filePath));
-        if (config_1.default.blackFileList.includes(filePath) ||
-            avaliablePath.every((x) => !x.startsWith(config_1.default.scriptPath) && !x.startsWith(config_1.default.configPath)) ||
-            !filePath) {
-            return res.send({ code: 403, message: '文件无法访问' });
+        if (!filePath) {
+            return res.send({ code: 403, message: (0, i18n_1.t)('文件无法访问') });
+        }
+        const normalized = path_1.default.normalize(filePath);
+        if (normalized.startsWith('..') || path_1.default.isAbsolute(normalized)) {
+            return res.send({ code: 403, message: (0, i18n_1.t)('文件无法访问') });
+        }
+        const resolvedRoot = path_1.default.resolve(config_1.default.rootPath, normalized);
+        const resolvedConfig = path_1.default.resolve(config_1.default.configPath, normalized);
+        const isValidPath = resolvedRoot.startsWith(config_1.default.scriptPath) ||
+            resolvedRoot.startsWith(config_1.default.configPath) ||
+            resolvedConfig.startsWith(config_1.default.scriptPath) ||
+            resolvedConfig.startsWith(config_1.default.configPath);
+        if (!isValidPath) {
+            return res.send({ code: 403, message: (0, i18n_1.t)('文件无法访问') });
+        }
+        if (config_1.default.blackFileList.includes(path_1.default.basename(normalized))) {
+            return res.send({ code: 403, message: (0, i18n_1.t)('文件无法访问') });
         }
         if (filePath.startsWith('sample/')) {
             const res = await (0, undici_1.request)(`https://gitlab.com/whyour/qinglong/-/raw/master/${filePath}`);