Merge pull request #2700 from InfinityPacer/feature/api-token

app/api/endpoints/plugin.py

@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, Header
 
 from app import schemas
 from app.core.plugin import PluginManager
-from app.core.security import verify_token
+from app.core.security import verify_token, verify_apitoken
 from app.db.systemconfig_oper import SystemConfigOper
 from app.db.user_oper import get_current_active_superuser
 from app.helper.plugin import PluginHelper
@@ -23,6 +23,10 @@ def register_plugin_api(plugin_id: str = None):
             if r.path == api.get("path"):
                 router.routes.remove(r)
                 break
+        # 检查是否允许匿名访问，如果不允许匿名访问，则添加 API_TOKEN 验证
+        allow_anonymous = api.pop("allow_anonymous", False)
+        if not allow_anonymous:
+            api.setdefault("dependencies", []).append(Depends(verify_apitoken))
         router.add_api_route(**api)
 
 

app/api/endpoints/system.py

@@ -123,7 +123,7 @@ def set_env_setting(env: dict,
                 v = ''
             else:
                 v = str(v)
-            set_key(settings.CONFIG_PATH / "app.env", k, v)
+            set_key(SystemUtils.get_env_path(), k, v)
     return schemas.Response(success=True)
 
 
@@ -180,7 +180,7 @@ def set_setting(key: str, value: Union[list, dict, bool, int, str] = None,
             value = ''
         else:
             value = str(value)
-        set_key(settings.CONFIG_PATH / "app.env", key, value)
+        set_key(SystemUtils.get_env_path(), key, value)
     else:
         SystemConfigOper().set(key, value)
     return schemas.Response(success=True)