win10下按照教程安装发现还缺少依赖pyautogui，说明文档请补充
python -m pip install pyautogui

修改文件权限时，一般情况下都是输入(777,666)等文件权限位，但这应该是用的8进制，后台用int进行转换变成了１０进制，输入777后权限变成了411，因此需要把route/file.py第１５８行改为：
os.chmod(fileName,int(power, 8))，这样就可以达到预期权限。

A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. It should be noted that access to files is limited by system operational access control (such as in the case of locked or in-use files on the Microsoft Windows operating system).

This attack is also known as “dot-dot-slash”, “directory traversal”, “directory climbing” and “backtracking”.

Root Cause Analysis

In this case, the path traversal vulnerability can be blamed on incorrect usage of the send_from_directory Flask call. The vulnerability occurs due to the code snippet shown below

Here, since the filename parameter is attacker controlled, the effective directory and filename passed to the send_from_directory call can be controlled by the attacker leading to a path traversal attack.

Proof of Concept

The bug can be verified using the proof of concept similar to the one shown below.

curl -i -s -k -X $'GET' \
    -H $'Host: 0.0.0.0:9001' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'session=eyJwYXNzd29yZCI6IndlbnJ1aSIsInNlY2VjdExpc3QiOiJbXSIsInVzZXJuYW1lIjoiYWRtaW4ifQ.FC1IVA.B3HWw42zgF_CltmVq0wm0N64vYQ' \
    $'http://0.0.0.0:9001/DownFile?filename=L2V0Yy9wYXNzd2Q='

Remediation

This can be easily fixed my restricting the value of file and path parameters by a fixed whitelist of possible values.

CVSS 3 Score

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This bug was found using CodeQL by Github

按照readme安装后，只有监控一个功能，剩余的都没有了,电脑为MacBook

使用uwsgi+nginx部署到linux服务器的时候报错：

[root@rcrai-devops-01 ServerManagement]# python3 index.py
Traceback (most recent call last):
File "index.py", line 9, in
from route.login import cklogin
File "/root/zbl/www/ServerManagement/route/init.py", line 7, in
from .webssh import *
File "/root/zbl/www/ServerManagement/route/webssh.py", line 1, in
from paramiko import *
File "/usr/local/lib/python3.6/site-packages/paramiko/init.py", line 22, in
from paramiko.transport import SecurityOptions, Transport
File "/usr/local/lib/python3.6/site-packages/paramiko/transport.py", line 38, in
from paramiko.auth_handler import AuthHandler
File "/usr/local/lib/python3.6/site-packages/paramiko/auth_handler.py", line 72, in
from paramiko.ssh_gss import GSSAuth, GSS_EXCEPTIONS
File "/usr/local/lib/python3.6/site-packages/paramiko/ssh_gss.py", line 55, in
GSS_EXCEPTIONS = (gssapi.GSSException,)

自己分别弄了文件系统和进程管理平台 https://github.com/yddeng/amp https://github.com/yddeng/filecloud

主要是为了进程管理，现在项目有多种服务类型每个类型多个副本。想着弄一个管理平台方便一点。

1. 新的程序怎么同步？多个版本怎么更新和回滚？ 我现在是本地用脚本上传到每个服务器的指定目录直接覆盖了原有文件，没有上传功能和版本控制。之前单台服务器打算用文件系统上传但发现上传后的程序丢失执行权限，又服务器增多就还是自己写脚本上传的。
2. 能不能控制程序使用的物理机资源？ 研究了一段时间k8s，有这个功能。但是搭建环境太麻烦了，而且网络环境也复杂
3. 查看进程的日志？ 程序都有自定义的日志输出，怎么在平台上查看日志。

你好，请问下分享文件下载报错nternal Server Error
The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

是什么yuany原因 还望解答

大神 有问题想咨询一下。

有没有 安装版本的清单 或者怎么联系你

你好 能来一个后台登录页面截图吗 还有首页截图
后台登录支持验证码验证吗？
我最近也在学习django 我能拿来二次开发吗

例如使用：https://github.com/novnc/noVNC这个来实现。
还有计划任务可以设置一次执行而不循环吗，进程监控能支持添加多个vps的三个状态进行监控吗，不需要主机那么漂亮，只要有数值即可。非常感谢！

节点自动安装agent自动上报状态数据之类

Traceback (most recent call last):
File "/home/leo/桌面/ServerManagement/index.py", line 2, in
import flask
File "/home/leo/桌面/ServerManagement/venv/lib/python3.8/site-packages/flask/init.py", line 19, in
from jinja2 import Markup, escape
ImportError: cannot import name 'Markup' from 'jinja2' (/home/leo/桌面/ServerManagement/venv/lib/python3.8/site-packages/jinja2/init.py)

对于0.0.0.0怎么处理呢，需要自己买一个服务器吗

能够提供一个demo网址吗

文件删除后，好像没有把分享的对应关系删除，会显示无法加载某个文件，而导致所有文件都无法显示

add a Dockerfile to support
containerization

在运行项目时报了这个错。
cannot import name 'app' from 'index'