From 0be7c08d72b40dc7965fb6992cc927a9d54fd37c Mon Sep 17 00:00:00 2001
From: lijiejie <my@lijiejie.com>
Date: Wed, 6 Apr 2022 21:00:34 +0800
Subject: [PATCH] username alphanumeric only

---
 README.md            | 6 +++++-
 logview/views.py     | 5 +++++
 templates/login.html | 5 ++++-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 296fdb8..2d5183e 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# eyes.sh
+# eyes.sh 1.0.1
 
 [eyes.sh](http://eyes.sh/)是用来辅助安全测试和漏扫工具的DNS Log / HTTP Log检测工具，基于 [BugScan DNSLog](https://github.com/bugscanteam/dnslog/) 优化（感谢四叶草安全、感谢坤哥  :) ）。
 
@@ -7,6 +7,10 @@
 * 演示账号 `demo` / `demo@pass`，请注意，该账号删除功能无效
 * 也可以在登录页面中选择 `创建随机ID并登录`
 
+## **Chang Log **
+
+* 2022-04-06： 注册用户名，限制只允许使用字母数字
+
 ## **背景** 
 
 * 公司内部扫描器每天产生数百万次DNS Log接口调用
diff --git a/logview/views.py b/logview/views.py
index 776622b..7f87b4d 100644
--- a/logview/views.py
+++ b/logview/views.py
@@ -7,6 +7,7 @@ import struct
 import socket
 import random
 import string
+import re
 from django.utils import timezone
 from django.shortcuts import render, redirect
 from django.http import HttpResponse, HttpResponseRedirect
@@ -161,6 +162,10 @@ def register(request):
             context['error_msg'] = '无法创建该账号,已被占用'
             return render(request, 'login.html', context)
         else:
+            m = re.match('[a-zA-Z0-9]+', username)
+            if not m or len(m.group()) != len(username):
+                context['error_msg'] = '用户名只能包含字母或数字'
+                return render(request, 'login.html', context)
             password = hashlib.md5((password + username[:3] + '@dnslog').encode('utf-8')).hexdigest()
             token = hashlib.md5((password + username[:3] + '@token').encode('utf-8')).hexdigest()[:8]
             user = User.objects.create(username=username, password=password,
diff --git a/templates/login.html b/templates/login.html
index c7b5cc8..05a310a 100644
--- a/templates/login.html
+++ b/templates/login.html
@@ -5,6 +5,9 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
     <title>{{ title }}</title>
+      <meta name="description" content="DNSLog / HTTPLog tool for pentesters" />
+      <meta name="robots" content="max-image-preview:large" />
+      <meta name="keywords" content="DNSLog,HTTPLog,eyes.sh,vulnerability,scanner,helper,pentest" />
       <link rel="shortcut icon" href="/static/favicon.png"/>
     <link href="{% static 'bootstrap-4.6.1/css/bootstrap.min.css' %}" rel="stylesheet">
     <link href="{% static 'signin.css' %}" rel="stylesheet">
@@ -38,7 +41,7 @@
             <div class="alert alert-info mt-5" role="alert">
                 基于<a href="https://github.com/bugscanteam/dnslog/" class="alert-link" target="_blank">bugscan dnslog</a>开发<br/>
         </div>
-        <p class="mt-5 mb-3 text-muted">&copy; 2022-2022 <a href="https://github.com/lijiejie/eyes.sh" target="_blank">LiJieJie</a></p>
+        <p class="mt-5 mb-3 text-muted">&copy; 2022-2022 <a href="https://github.com/lijiejie/eyes.sh" target="_blank">LiJieJie</a><br />DNSLog / HTTPLog tool for pentesters</p>
     </form>
 
     <div class="modal fade" id="confirmModal" tabindex="-1" aria-hidden="true">