init: CasSsoService CAS 5.3 overlay (cas.war via LFS)

2026-08-05 09:53:49 +08:00
commit 3bd14554ec
93 changed files with 19827 additions and 0 deletions
@@ -0,0 +1,37 @@
+import urllib.request, urllib.error, ssl
+
+BASE = "http://sso.yunhaixingtong.com"
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+
+def req(method, path, data=None, headers=None):
+    url = BASE + path
+    h = headers or {}
+    r = urllib.request.Request(url, data=data, method=method, headers=h)
+    try:
+        resp = urllib.request.urlopen(r, timeout=20, context=ctx)
+        body = resp.read().decode('utf-8', 'ignore')
+        return resp.status, dict(resp.getheaders()), body
+    except urllib.error.HTTPError as e:
+        body = e.read().decode('utf-8', 'ignore')
+        return e.code, dict(e.headers), body
+
+print("=== 1) /front/index.html WITHOUT auth (is it behind CAS?) ===")
+st, hd, body = req("GET", "/front/index.html")
+print("status:", st, "| Location:", hd.get("Location"))
+print("body has /cas/login:", "/cas/login" in body, "| ?v=1.7:", "v=1.7" in body,
+      "| action=/api/login:", 'action="/api/login"' in body, "| name=username:", 'name="username"' in body)
+
+print("\n=== 2) POST /api/login BOGUS (native form, no XHR header) ===")
+form = "loginname=AAA&pwd=BBB&captcha=".encode()
+st, hd, body = req("POST", "/api/login", data=form, headers={"Content-Type":"application/x-www-form-urlencoded"})
+print("status:", st, "| Location:", hd.get("Location"))
+
+print("\n=== 3) POST /api/login BOGUS (AJAX X-Requested-With) ===")
+st, hd, body = req("POST", "/api/login", data=form, headers={"Content-Type":"application/x-www-form-urlencoded","X-Requested-With":"XMLHttpRequest"})
+print("status:", st, "| body[:180]:", body[:180])
+
+print("\n=== 4) /api/public-key ===")
+st, hd, body = req("GET", "/api/public-key")
+print("status:", st, "| body[:160]:", body[:160])