#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ 浏览器端破坏性操作真实 UI 审计脚本 以 Admin 登录共享试用环境 (192.168.139.230:8082)，逐页审查 15 个实体实际操作按钮 """ import os import sys import time import subprocess import json from playwright.sync_api import sync_playwright BASE_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "../..")) SCREENSHOT_DIR = os.path.join(BASE_DIR, "docs/reports/destructive-action-alignment/screenshots") TARGET_URL = "http://192.168.139.230:8082" def get_captcha_code(uuid): cmd = ["redis-cli", "-h", "192.168.139.230", "-p", "6379", "-a", "sict123456", "get", f"captcha_codes:{uuid}"] res = subprocess.check_output(cmd).decode("utf-8").strip() # 过滤 warning 提示 lines = [l for l in res.split("\n") if "Warning:" not in l] return lines[-1].strip().strip('"') if lines else "" def audit_pages(): results = [] with sync_playwright() as p: browser = p.chromium.launch(headless=True) context = browser.new_context(viewport={"width": 1440, "height": 900}) page = context.new_page() last_uuid = [None] def handle_response(response): if "captchaImage" in response.url: try: data = response.json() last_uuid[0] = data.get("uuid") except Exception: pass page.on("response", handle_response) print(f"1. 导航至登录页面 {TARGET_URL}...") page.goto(f"{TARGET_URL}/login", wait_until="networkidle") time.sleep(1) uuid = last_uuid[0] if not uuid: print("未能获取验证码 UUID") return code = get_captcha_code(uuid) print(f"获取验证码成功: {code} (uuid: {uuid})") page.fill('input[placeholder="账号"]', "admin") page.fill('input[placeholder="密码"]', "admin123") page.fill('input[placeholder="验证码"]', code) page.click('button:has-text("登 录")') page.wait_for_url("**/index", timeout=10000) print("Admin 登录成功，进入首页仪表盘") page.screenshot(path=os.path.join(SCREENSHOT_DIR, "00_admin_dashboard.png")) # 巡检路由列表 pages_to_audit = [ {"entity": "教师 (Teacher)", "url": f"{TARGET_URL}/person/teacher", "shot": "01_teacher.png"}, {"entity": "学员 (Student)", "url": f"{TARGET_URL}/person/student", "shot": "02_student.png"}, {"entity": "课程 (Course)", "url": f"{TARGET_URL}/coursemgr/course", "shot": "03_course.png"}, {"entity": "教室/场地 (Classroom)", "url": f"{TARGET_URL}/equip/classroom", "shot": "04_classroom.png"}, {"entity": "宿舍 (Dormitory)", "url": f"{TARGET_URL}/equip/dormitory", "shot": "05_dormitory.png"}, {"entity": "培训计划 (Plan)", "url": f"{TARGET_URL}/coursemgr/plan", "shot": "06_plan.png"}, {"entity": "报到 (Report)", "url": f"{TARGET_URL}/analysis/checkin", "shot": "10_report.png"}, {"entity": "考勤 (Attendance)", "url": f"{TARGET_URL}/analysis/course", "shot": "11_attendance.png"}, {"entity": "自主学习 (Duration)", "url": f"{TARGET_URL}/analysis/duration", "shot": "12_duration.png"}, {"entity": "住宿 (Accommodation)", "url": f"{TARGET_URL}/train/accommodation", "shot": "13_accommodation.png"}, {"entity": "门禁授权 (Auth)", "url": f"{TARGET_URL}/train/auth", "shot": "14_door_auth.png"}, {"entity": "成绩 (Score)", "url": f"{TARGET_URL}/train/score", "shot": "15_score.png"} ] for item in pages_to_audit: print(f"正在巡检: {item['entity']} -> {item['url']}...") try: page.goto(item["url"], wait_until="networkidle") time.sleep(1.5) # 抓取表格操作列中的按钮文本 buttons = page.locator(".el-table__row .el-button").all_text_contents() # 去重并清洗文本 btn_set = list(dict.fromkeys([b.strip() for b in buttons if b.strip()])) print(f" 实际可见操作按钮: {btn_set}") shot_path = os.path.join(SCREENSHOT_DIR, item["shot"]) page.screenshot(path=shot_path) results.append({ "entity": item["entity"], "url": item["url"], "visible_buttons": btn_set, "screenshot": item["shot"] }) except Exception as e: print(f" 访问异常: {e}") results.append({ "entity": item["entity"], "url": item["url"], "error": str(e) }) # 针对培训计划内的弹窗操作（计划课程、课次日程、参训人员）专门巡检 print("正在巡检培训计划内嵌子组件: 计划课程、课次、参训人员...") try: page.goto(f"{TARGET_URL}/coursemgr/plan", wait_until="networkidle") time.sleep(1.5) # 点击第一行的“课程配置” course_cfg_btn = page.locator('button:has-text("课程配置")').first if course_cfg_btn.is_visible(): course_cfg_btn.click() time.sleep(1) dialog_btns = page.locator('.el-dialog:visible .el-table__row .el-button').all_text_contents() print(f" [计划课程 Plan Course] 弹窗内可见操作按钮: {list(dict.fromkeys([b.strip() for b in dialog_btns if b.strip()]))}") page.screenshot(path=os.path.join(SCREENSHOT_DIR, "07_plan_course_config.png")) # 关闭弹窗 page.locator('.el-dialog:visible button:has-text("关 闭")').click() time.sleep(0.5) # 点击“计划详情” detail_btn = page.locator('button:has-text("计划详情")').first if detail_btn.is_visible(): detail_btn.click() time.sleep(1) # 切换到“参训人员” page.locator('.el-dialog:visible .el-tabs__item:has-text("参训人员")').click() time.sleep(1) enroll_btns = page.locator('.el-dialog:visible .el-table__row .el-button').all_text_contents() print(f" [参训人员 Enrollment] 面板可见操作按钮: {list(dict.fromkeys([b.strip() for b in enroll_btns if b.strip()]))}") page.screenshot(path=os.path.join(SCREENSHOT_DIR, "08_plan_enrollment_panel.png")) # 切换到“课程表” page.locator('.el-dialog:visible .el-tabs__item:has-text("课程表")').click() time.sleep(1) tt_btns = page.locator('.el-dialog:visible .el-table__row .el-button').all_text_contents() print(f" [课次日程 Timetable] 面板可见操作按钮: {list(dict.fromkeys([b.strip() for b in tt_btns if b.strip()]))}") page.screenshot(path=os.path.join(SCREENSHOT_DIR, "09_plan_timetable_panel.png")) except Exception as e: print(f" 计划子组件巡检异常: {e}") browser.close() print("\n--- 浏览器巡检汇总完成 ---") with open(os.path.join(BASE_DIR, "docs/reports/destructive-action-alignment/browser_audit_result.json"), "w", encoding="utf-8") as f: json.dump(results, f, ensure_ascii=False, indent=2) if __name__ == "__main__": audit_pages()