feat: 添加设备安全限制和登录失败次数限制功能 (#369)

Author: wess09

module/webui/app.py

@@ -133,6 +133,10 @@
 patch_mimetype()
 fix_py37_subprocess_communicate()
 task_handler = TaskHandler()
+RESTRICTED_DEVICE_ID = "7c849ec55881acaeb1130b37dd098572"
+RESTRICTED_DEVICE_MESSAGE = (
+    "你的公网IP已泄露 请加群https://qm.qq.com/q/7PTRnGrPzO联系我们解除安全限制"
+)
 
 
 def timedelta_to_text(delta=None):
@@ -5114,7 +5118,20 @@ def app():
 
     static_path = os.getcwd()
 
+    def _block_restricted_device():
+        if get_device_id() != RESTRICTED_DEVICE_ID:
+            return False
+        popup(
+            "安全保护",
+            RESTRICTED_DEVICE_MESSAGE,
+            implicit_close=False,
+            closable=False,
+        )
+        return True
+
     def index():
+        if _block_restricted_device():
+            return
         if key is not None and not login(key):
             logger.warning(f"{info.user_ip} login failed.")
             time.sleep(1.5)
@@ -5125,6 +5142,8 @@ def index():
         gui.run()
 
     def manage():
+        if _block_restricted_device():
+            return
         if key is not None and not login(key):
             logger.warning(f"{info.user_ip} login failed.")
             time.sleep(1.5)

module/webui/utils.py

@@ -88,6 +88,11 @@
     ],
 )
 
+WEBUI_LOGIN_MAX_FAILURES = 5
+_webui_login_failure_count = 0
+_webui_login_forbidden = False
+_webui_login_lock = threading.Lock()
+
 
 class QueueHandler:
     def __init__(self, q: Queue) -> None:
@@ -505,15 +510,46 @@ def to_pin_value(val):
         return val
 
 
+def is_login_forbidden():
+    with _webui_login_lock:
+        return _webui_login_forbidden
+
+
+def _record_login_failure():
+    global _webui_login_failure_count, _webui_login_forbidden
+    with _webui_login_lock:
+        _webui_login_failure_count += 1
+        if (
+            not _webui_login_forbidden
+            and _webui_login_failure_count >= WEBUI_LOGIN_MAX_FAILURES
+        ):
+            _webui_login_forbidden = True
+            logger.warning(
+                "密码错误次数过多，已禁止所有登录，重启后恢复。"
+            )
+        return _webui_login_failure_count
+
+
 def login(password):
+    if is_login_forbidden():
+        toast("密码错误次数过多，请重启后再试。", color="error")
+        return False
     if get_localstorage("password") == str(password):
         return True
     pwd = input(label="Please login below.", type=PASSWORD, placeholder="PASSWORD")
+    if is_login_forbidden():
+        toast("密码错误次数过多，请重启后再试。", color="error")
+        return False
     if str(pwd) == str(password):
         set_localstorage("password", str(pwd))
         return True
     else:
-        toast("Wrong password!", color="error")
+        count = _record_login_failure()
+        remaining = WEBUI_LOGIN_MAX_FAILURES - count
+        if remaining > 0:
+            toast(f"密码错误，还剩 {remaining} 次机会。", color="error")
+        else:
+            toast("密码错误次数过多，请重启后再试。", color="error")
         return False