v3.4.39

astrbot/core/config/default.py

@@ -2,7 +2,7 @@
 如需修改配置，请在 `data/cmd_config.json` 中修改或者在管理面板中可视化修改。
 """
 
-VERSION = "3.4.38"
+VERSION = "3.4.39"
 DB_PATH = "data/data_v3.db"
 
 # 默认配置
@@ -85,7 +85,7 @@ DEFAULT_CONFIG = {
         "enable": True,
         "username": "astrbot",
         "password": "77b90590a8945a7d36c963981a307dc9",
-        "host": "127.0.0.1",
+        "host": "0.0.0.0",
         "port": 6185,
     },
     "platform": [],

astrbot/dashboard/routes/auth.py

@@ -3,6 +3,7 @@ import datetime
 from .route import Route, Response, RouteContext
 from quart import request
 from astrbot.core import WEBUI_SK
+from astrbot import logger
 
 
 class AuthRoute(Route):
@@ -19,9 +20,20 @@ class AuthRoute(Route):
         password = self.config["dashboard"]["password"]
         post_data = await request.json
         if post_data["username"] == username and post_data["password"] == password:
+            change_pwd_hint = False
+            if username == "astrbot" and password == "77b90590a8945a7d36c963981a307dc9":
+                change_pwd_hint = True
+                logger.warning("为了保证安全，请尽快修改默认密码。")
+
             return (
                 Response()
-                .ok({"token": self.generate_jwt(username), "username": username})
+                .ok(
+                    {
+                        "token": self.generate_jwt(username),
+                        "username": username,
+                        "change_pwd_hint": change_pwd_hint,
+                    }
+                )
                 .__dict__
             )
         else:

astrbot/dashboard/server.py

@@ -122,7 +122,15 @@ class AstrBotDashboard:
     def run(self):
         ip_addr = []
         port = self.core_lifecycle.astrbot_config["dashboard"].get("port", 6185)
-        host = self.core_lifecycle.astrbot_config["dashboard"].get("host", "127.0.0.1")
+        host = self.core_lifecycle.astrbot_config["dashboard"].get("host", "0.0.0.0")
+
+        logger.info(f"正在启动 WebUI, 监听地址: http://{host}:{port}")
+
+        if host == "0.0.0.0":
+            logger.info(
+                "提示: WebUI 将监听所有网络接口，请注意安全。（可在 data/cmd_config.json 中配置 dashboard.host 以修改 host）"
+            )
+
         if host not in ["localhost", "127.0.0.1"]:
             try:
                 ip_addr = get_local_ip_addresses()
@@ -144,7 +152,7 @@ class AstrBotDashboard:
 
             raise Exception(f"端口 {port} 已被占用")
 
-        display = f"\n ✨✨✨\n  AstrBot v{VERSION} 管理面板已启动，可访问\n\n"
+        display = f"\n ✨✨✨\n  AstrBot v{VERSION} WebUI 已启动，可访问\n\n"
         display += f"   ➜  本地: http://localhost:{port}\n"
         for ip in ip_addr:
             display += f"   ➜  网络: http://{ip}:{port}\n"

changelogs/v3.4.39.md

@@ -0,0 +1,4 @@
+# What's Changed
+
+1. 默认账户密码登录成功后弹出修改警告
+2. 将 WebUI 默认 host 改变回 v3.4.38 之前的版本以减少兼容性问题。

dashboard/src/layouts/full/vertical-header/VerticalHeader.vue

@@ -8,6 +8,7 @@ import { useCommonStore } from '@/stores/common';
 
 const customizer = useCustomizerStore();
 let dialog = ref(false);
+let accountWarning = ref(false)
 let updateStatusDialog = ref(false);
 let password = ref('');
 let newPassword = ref('');
@@ -177,6 +178,14 @@ checkUpdate();
 const commonStore = useCommonStore();
 commonStore.createWebSocket();
 commonStore.getStartTime();
+
+
+if (localStorage.getItem('change_pwd_hint') != null && localStorage.getItem('change_pwd_hint') == 'true') {
+  dialog.value = true;
+  accountWarning.value = true;
+  localStorage.removeItem('change_pwd_hint');
+}
+
 </script>
 
 <template>
@@ -339,6 +348,11 @@ commonStore.getStartTime();
           <v-container>
             <v-row>
               <v-col cols="12">
+
+                <v-alert v-if="accountWarning" color="warning" style="margin-bottom: 16px;">
+                  <div>为了安全，请尽快修改默认密码。</div>
+                </v-alert>
+
                 <v-text-field label="原密码*" type="password" v-model="password" required
                   variant="outlined"></v-text-field>
 

dashboard/src/stores/auth.ts

@@ -24,6 +24,7 @@ export const useAuthStore = defineStore({
         this.username = res.data.data.username
         localStorage.setItem('user', this.username);
         localStorage.setItem('token', res.data.data.token);
+        localStorage.setItem('change_pwd_hint', res.data.data?.change_pwd_hint);
         router.push(this.returnUrl || '/dashboard/default');
       } catch (error) {
         return Promise.reject(error);

packages/astrbot/main.py

@@ -323,7 +323,9 @@ UID: {user_id} 此 ID 可用于设置管理员。
     async def dwl(self, event: AstrMessageEvent, sid: str):
         """删除白名单。dwl <sid>"""
         try:
-            self.context.get_config()["platform_settings"]["id_whitelist"].remove(str(sid))
+            self.context.get_config()["platform_settings"]["id_whitelist"].remove(
+                str(sid)
+            )
             self.context.get_config().save_config()
             event.set_result(MessageEventResult().message("删除白名单成功。"))
         except ValueError: