sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912)

Browse Source
This commit is contained in:
Hermes CI Fix
2026-09-12 23:34:35 +08:00
parent 4f7058f1ea
commit b8f4a3d543
39 changed files with 131 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/scripts/clean_kpi_data_governance.py
+13 -2
View File
@@ -29,10 +29,21 @@ CMA 数据治理 P0-2 数据清洗脚本（2026-08-15）
"""
import pymysql
# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
import os as _os_gov
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env', override=False)
except Exception:
pass
_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
def main():
conn = pymysql.connect(host="127.0.0.1", port=3306, user="cma_user",
password="cma_pass_2026", database="cma", charset="utf8mb4")
conn = pymysql.connect(host="127.0.0.1", port=3306, user=_CMA_DB_USER,
password=_CMA_DB_PASS, database="cma", charset="utf8mb4")
cur = conn.cursor(pymysql.cursors.DictCursor)
def q(sql, args=None):
backend/scripts/cleanup_kpi_encoding.py
+11 -1
View File
@@ -3,11 +3,21 @@ import pymysql
import os
import logging
# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
import os
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env')
except Exception:
pass
if not os.getenv('CMA_DB_PASS'):
raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("encoding-cleanup")
DB_USER = os.getenv("CMA_DB_USER", "cma_user")
DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
DB_PASS = os.environ["CMA_DB_PASS"]
DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
DB_NAME = os.getenv("CMA_DB_NAME", "cma")
backend/scripts/fix_kpi_governance.py
+13 -2
View File
@@ -8,6 +8,17 @@
import sys
import pymysql
# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
import os as _os_gov
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env', override=False)
except Exception:
pass
_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
PLACEHOLDERS = ("待补充", "待指定", "待完善", "待定", "暂无", "TBD", "tbd", "-", "--", "N/A", "n/a")
DIM_PREFIX = {"finance": "F", "customer": "C", "process": "P", "learning": "L"}
DIM_FORMULA = {
@@ -82,8 +93,8 @@ def audit(kpis):
def main():
apply = "--apply" in sys.argv
conn = pymysql.connect(host="127.0.0.1", port=3306, user="cma_user",
password="cma_pass_2026", database="cma", charset="utf8mb4")
conn = pymysql.connect(host="127.0.0.1", port=3306, user=_CMA_DB_USER,
password=_CMA_DB_PASS, database="cma", charset="utf8mb4")
cur = conn.cursor(pymysql.cursors.DictCursor)
cur.execute("SELECT * FROM kpi_definitions WHERE status='active'")
kpis = cur.fetchall()
backend/scripts/import_cma_knowledge.py
+12 -1
View File
@@ -2,7 +2,18 @@
"""将CMA战略地图完整文档导入知识库"""
import pymysql, re
DB = dict(host='127.0.0.1', port=3306, user='cma_user', password='cma_pass_2026', database='cma', charset='utf8mb4')
# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
import os as _os_gov
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env', override=False)
except Exception:
pass
_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
DB = dict(host='127.0.0.1', port=3306, user=_CMA_DB_USER, password=_CMA_DB_PASS, database='cma', charset='utf8mb4')
DOC = "/root/CMA_Strategy_Map_完整分析.md"
backend/scripts/import_product_sales.py
+13 -2
View File
@@ -6,11 +6,22 @@ import os
import re
import pymysql
# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
import os as _os_gov
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env', override=False)
except Exception:
pass
_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
# DB连接
DB_CONFIG = {
'host': '127.0.0.1',
'user': 'cma_user',
'password': 'cma_pass_2026',
'user': _CMA_DB_USER,
'password': _CMA_DB_PASS,
'database': 'cma',
'charset': 'utf8mb4',
}
backend/scripts/migrate_data_governance.py
+11 -1
View File
@@ -3,11 +3,21 @@ import pymysql
import os
import logging
# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
import os
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env')
except Exception:
pass
if not os.getenv('CMA_DB_PASS'):
raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("data-governance")
DB_USER = os.getenv("CMA_DB_USER", "cma_user")
DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
DB_PASS = os.environ["CMA_DB_PASS"]
DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
DB_NAME = os.getenv("CMA_DB_NAME", "cma")
backend/scripts/seed_finance_bot_kpis.py
+11 -1
View File
@@ -7,8 +7,18 @@ import os
import sys
from datetime import datetime
# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
import os
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env')
except Exception:
pass
if not os.getenv('CMA_DB_PASS'):
raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
DB_USER = os.getenv("CMA_DB_USER", "cma_user")
DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
DB_PASS = os.environ["CMA_DB_PASS"]
DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
DB_NAME = os.getenv("CMA_DB_NAME", "cma")
backend/scripts/verify_dashboard_isolation.py
+13 -1
View File
@@ -5,6 +5,16 @@ import json
import urllib.request
import pymysql
# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
import os
try:
from dotenv import load_dotenv as _ld_gov
_ld_gov('/root/cma-management/backend/.env')
except Exception:
pass
if not os.getenv('CMA_DB_PASS'):
raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
BASE = "http://127.0.0.1:8010"
@@ -39,7 +49,9 @@ def main():
reminders = d.get("reminders", [])
print(f"2. my-dashboard OK: action_plans={len(plans)} 条, reminders={len(reminders)} 条")
conn = pymysql.connect(host="127.0.0.1", user="cma_user", password="cma_pass_2026",
# 账号与口令同源（backend/.env）——硬编码 cma_user + 应用口令会账号/口令错配
conn = pymysql.connect(host="127.0.0.1", user=os.getenv("CMA_DB_USER", "cma_user"),
password=os.environ.get("CMA_DB_PASS", ""),
database="cma", charset="utf8mb4")
cur = conn.cursor()
backend/scripts/verify_knowledge_partition_e2e.py
+4 -1
View File
@@ -13,12 +13,15 @@ with open('/root/cma-management/backend/.env') as f:
k, v = line.split('=', 1)
env[k.strip()] = v.strip().strip('"').strip("'")
if not env.get('CMA_DB_PASS'):
raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
import pymysql
conn = pymysql.connect(
host=env.get('CMA_DB_HOST', '127.0.0.1'),
port=int(env.get('CMA_DB_PORT', '3306')),
user=env.get('CMA_DB_USER', 'cma_user'),
password=env.get('CMA_DB_PASS', 'cma_pass_2026'),
password=env.get('CMA_DB_PASS'),
database=env.get('CMA_DB_NAME', 'cma'),
charset='utf8mb4',
)