diff --git a/fir_ser/api/utils/baseutils.py b/fir_ser/api/utils/baseutils.py index 0741a8f..416eb3c 100644 --- a/fir_ser/api/utils/baseutils.py +++ b/fir_ser/api/utils/baseutils.py @@ -173,17 +173,18 @@ def get_cname_from_domain(domain): def get_user_domain_name(obj, domain_type=1): - domain_obj = UserDomainInfo.objects.filter(user_id=obj, is_enable=True, app_id=None, - domain_type=domain_type).first() - if domain_obj: - return domain_obj.domain_name + domain_name = UserDomainInfo.objects.filter(user_id=obj, is_enable=True, app_id=None, + domain_type=domain_type).values_list('domain_name').first() + if domain_name: + return domain_name[0] return '' def get_app_domain_name(obj): - domain_obj = UserDomainInfo.objects.filter(app_id=obj, is_enable=True, domain_type=2).first() - if domain_obj: - return domain_obj.domain_name + domain_name = UserDomainInfo.objects.filter(app_id=obj, is_enable=True, domain_type=2).values_list( + 'domain_name').first() + if domain_name: + return domain_name[0] return '' @@ -235,14 +236,14 @@ def get_filename_form_file(filename): return filename -def check_app_domain_name_access(app_obj, access_domain_name, extra_domain=None): +def check_app_domain_name_access(app_obj, access_domain_name, user_obj, extra_domain=None): if app_obj and access_domain_name: domain_list = [] if extra_domain: domain_list.append(extra_domain) app_domain_name = get_app_domain_name(app_obj) if app_domain_name: domain_list.append(app_domain_name) - user_domain_name = get_user_domain_name(app_obj.user_id) + user_domain_name = get_user_domain_name(user_obj) if user_domain_name: domain_list.append(user_domain_name) if access_domain_name in domain_list: return True @@ -253,3 +254,8 @@ def get_real_ip_address(request): return request.META.get('HTTP_X_FORWARDED_FOR') else: return request.META.get('REMOTE_ADDR') + + +def get_origin_domain_name(request): + meta = request.META + return meta.get('HTTP_ORIGIN', meta.get('HTTP_REFERER', 'http://xxx/xxx')).split('//')[-1].split('/')[0] diff --git a/fir_ser/api/utils/storage/caches.py b/fir_ser/api/utils/storage/caches.py index a118427..5edd109 100644 --- a/fir_ser/api/utils/storage/caches.py +++ b/fir_ser/api/utils/storage/caches.py @@ -388,8 +388,11 @@ def get_user_cert_auth_status(user_id): return auth_status -def check_user_has_all_download_times(app_obj): - user_id = app_obj.user_id_id +def check_user_has_all_download_times(app_obj, user_obj): + if user_obj: + user_id = user_obj.pk + else: + user_id = app_obj.user_id_id auth_status = get_user_cert_auth_status(user_id) d_count = get_app_d_count_by_app_id(app_obj.app_id) return get_user_free_download_times(user_id, auth_status=auth_status) - d_count >= 0 or check_user_can_download( @@ -462,14 +465,14 @@ def update_order_info(user_id, out_trade_no, payment_number, payment_type): return False -def check_app_permission(app_obj, res): +def check_app_permission(app_obj, res, user_obj=None): if not app_obj: res.code = 1003 res.msg = "该应用不存在" elif app_obj.status != 1: res.code = 1004 res.msg = "该应用被封禁,无法下载安装" - elif not check_user_has_all_download_times(app_obj): + elif not check_user_has_all_download_times(app_obj, user_obj): res.code = 1009 res.msg = "可用下载额度不足,请联系开发者" elif not app_obj.isshow: diff --git a/fir_ser/api/views/download.py b/fir_ser/api/views/download.py index 6d58e76..65da265 100644 --- a/fir_ser/api/views/download.py +++ b/fir_ser/api/views/download.py @@ -24,7 +24,7 @@ from api.models import Apps, AppReleaseInfo, APPToDeveloper, APPSuperSignUsedInf from django.http import FileResponse import logging from api.utils.baseutils import get_profile_full_path, get_app_domain_name, get_filename_form_file, \ - check_app_domain_name_access, get_real_ip_address + check_app_domain_name_access, get_real_ip_address, get_origin_domain_name from api.utils.throttle import VisitShortThrottle, InstallShortThrottle, InstallThrottle1, InstallThrottle2 logger = logging.getLogger(__name__) @@ -147,29 +147,32 @@ class ShortDownloadView(APIView): release_id = request.query_params.get("release_id", None) udid = request.query_params.get("udid", None) app_obj = Apps.objects.filter(short=short).first() - res = check_app_permission(app_obj, res) + user_obj = None + if app_obj: + user_obj = app_obj.user_id + res = check_app_permission(app_obj, res, user_obj) if res.code != 1000: return Response(res.dict) - origin_domain_name = request.META.get('HTTP_ORIGIN', - request.META.get('HTTP_REFERER', - 'http://xxx/xxx')).split('//')[-1].split('/')[0] - domain_name = get_redirect_server_domain(request, app_obj.user_id, get_app_domain_name(app_obj)) - if not check_app_domain_name_access(app_obj, origin_domain_name, domain_name.split('//')[-1]): - res.code = 1004 - res.msg = "访问域名不合法" + domain_name = get_redirect_server_domain(request, user_obj, get_app_domain_name(app_obj)) + if user_obj and user_obj.role and user_obj.role == 3: + ... else: - if udid: - if not app_obj.issupersign: - res.code = 1002 - res.msg = "参数有误" - return Response(res.dict) - del_cache_response_by_short(app_obj.app_id, udid=udid) + if not check_app_domain_name_access(app_obj, get_origin_domain_name(request), user_obj, domain_name.split('//')[-1]): + res.code = 1004 + res.msg = "访问域名不合法" + return Response(res.dict) + if udid: + if not app_obj.issupersign: + res.code = 1002 + res.msg = "参数有误" + return Response(res.dict) + del_cache_response_by_short(app_obj.app_id, udid=udid) - app_serializer = AppsShortSerializer(app_obj, context={"key": "ShortDownloadView", "release_id": release_id, - "storage": Storage(app_obj.user_id)}) - res.data = app_serializer.data - res.udid = udid - res.domain_name = domain_name + app_serializer = AppsShortSerializer(app_obj, context={"key": "ShortDownloadView", "release_id": release_id, + "storage": Storage(user_obj)}) + res.data = app_serializer.data + res.udid = udid + res.domain_name = domain_name return Response(res.dict) # key的设置 @@ -178,7 +181,7 @@ class ShortDownloadView(APIView): release_id = request.query_params.get("release_id", '') udid = request.query_params.get("udid", None) time = request.query_params.get("time", None) - origin_domain_name = request.META.get('HTTP_ORIGIN', 'xx').split('//')[-1] + origin_domain_name = get_origin_domain_name(request) if not origin_domain_name: origin_domain_name = 'default.site' if udid and time: