兼容开放导入未签名请求

2026-06-11 07:32:11 +08:00
parent 88b1df64e7
commit 7130135e23
5 changed files with 37 additions and 17 deletions
@@ -47,24 +47,26 @@ func (h *Handler) ImportExternalUpload(c *gin.Context) {
 }

 var (
-	errExternalUploadSecretMissing = errors.New("external upload secret missing")
-	errExternalUploadForbiddenIP   = errors.New("external upload forbidden ip")
-	errExternalUploadTimestamp     = errors.New("external upload timestamp invalid")
-	errExternalUploadSignature     = errors.New("external upload signature invalid")
+	errExternalUploadForbiddenIP = errors.New("external upload forbidden ip")
+	errExternalUploadTimestamp   = errors.New("external upload timestamp invalid")
+	errExternalUploadSignature   = errors.New("external upload signature invalid")
 )

 const externalUploadMaxClockSkew = 5 * time.Minute

 func (h *Handler) verifyExternalUpload(c *gin.Context, raw []byte) error {
-	secret := strings.TrimSpace(h.externalUploadSecret)
-	if secret == "" {
-		return errExternalUploadSecretMissing
-	}
 	if !externalUploadIPAllowed(c.ClientIP(), h.externalUploadAllowedIPs) {
 		return errExternalUploadForbiddenIP
 	}
+	secret := strings.TrimSpace(h.externalUploadSecret)
+	if secret == "" {
+		return nil
+	}
 	timestamp := strings.TrimSpace(c.GetHeader("X-HFB-Timestamp"))
 	signature := strings.TrimSpace(c.GetHeader("X-HFB-Signature"))
+	if timestamp == "" && signature == "" {
+		return nil
+	}
 	if timestamp == "" || signature == "" {
 		return errExternalUploadSignature
 	}
@@ -111,8 +113,6 @@ func externalUploadIPAllowed(clientIP string, allowed []string) bool {

 func writeExternalUploadAuthError(c *gin.Context, err error) {
 	switch err {
-	case errExternalUploadSecretMissing:
-		response.ServiceUnavailable(c, "开放导入签名密钥未配置")
 	case errExternalUploadForbiddenIP:
 		response.Error(c, http.StatusForbidden, "forbidden", "来源 IP 不允许访问")
 	case errExternalUploadTimestamp: