Conversation
book_chapters 表带 user_namespace 列,但多个章节写入路径未填充, 落库为 'default';而 get_chapter_content 严格按用户命名空间过滤。 secure 模式下非 default 账号导入的本地书 TOC 可列出但正文读不到 (「本地书章节不存在」)——写入/读取 key 不一致的跨用户隔离缺陷。 修复: - save_local_book / migrate_loc_book / replace_chapters / save_chapters 章节 INSERT 补 user_namespace 列;migrate_loc_book 的 DELETE 补 user_namespace 过滤(防共享 book_url 误删他用户章节) - save_chapters 增加 ns 参数,更新 refreshLocalBook 生产调用 - JSON→SQLite 章节缓存迁移器写入补 ns - 新增 scripts/fix-local-book-chapter-namespace.py 手动修复既有库 (用户自行执行,不自动回迁):把归属非 default 书的 default 章节 修正为书所属命名空间,幂等 - 新增回归测试:非 default 用户导入本地书 TOC/正文可读,他用户隔离
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
book_chapters 表带 user_namespace TEXT NOT NULL DEFAULT 'default' 列,但多个章节写入路径未填充该列,落库为 'default';而读取路径 get_chapter_content 严格按实际用户命名空间过滤。
secure 模式下命名空间为用户名(非 default),于是:
即写入/读取 key 不一致,属跨用户隔离缺陷。仅 default 命名空间的书碰巧正常;任何非 default 账号导入的本地书都会复现。现有测试几乎全用 'default',故未暴露。
修复
章节写入路径补齐 user_namespace(新写入即正确,向后不再产生脏数据):
既有数据修复脚本
本BUGFIX不做自动数据修复。受影响的既有库由用户手动执行幂等修复脚本:
1. 停止 reader-dev,备份库
cp storage/reader.db storage/reader.db.bak
2. 预览将修正的行数(不修改)
python3 scripts/fix-local-book-chapter-namespace.py --dry-run
3. 执行修复
python3 scripts/fix-local-book-chapter-namespace.py
4. 重启 reader-dev,旧本地书正文即可直接读取,无需重新导入
脚本把 user_namespace='default' 但归属书属于非 default 命名空间的章节,修正为书所属命名空间;幂等,default 命名空间书不受影响。
测试
新增回归测试:非 default 用户(userA)经 save_local_book 导入本地书 → TOC 与正文(get_chapter_content)均可读;userB / default 命名空间读不到(隔离正确)。现有 default 测试保持全绿。