This is a POC for a feature i've been working on that I'd like to get reviewed before I complete the work (to make sure the direction is ok) The idea is to make Comments Controller even more "magical" by translating request parameters to method parameters.

[See updated information below]

Let me know if the direction looks ok and I will complete the missing parts. Also if you think this is good, please review the changes. Note that most changes are in new files and there should be no changes to current flows. Changes in existing files are minimal.

Hi,

I couldn't see any existing issues on this (I also can't read Chinese) so apologies if they have been pointed out. Stemmed from a Reddit discussion I was curious about beego's API and took a look at the source and discovered these potential flaws.

First up: your session IDs are not securely generated and may be predictable

• In session.go you use a combination of crypto/rand, time.Unix and a SHA-1 hash to generate a session ID. You should just use crypto/rand and base32 encode it as per gorilla/sessions, as otherwise you are introducing predictability into your session ID generation.
• Your XSRF tokens, by default, expire in 60s. From a usability perspective this isn't a sane default: if a user takes > 60s to fill out a form or submit something, they'll error. There's no need for such an aggressive default.
• Your XSRF tokens are only 15 bytes long, but your session IDs are 24 bytes long. Why the difference? I suggest following gorilla/sessions, Django & Rails' lead here and reading 32 bytes out (for all short-lived secure tokens). Share a GenerateRandomBytes(n int) function throughout your application rather than inventing the wheel, which leads me to...
• RandomCreateBytes here may end up truncating the generated string, making it less secure. Just base32 encode it. Look at securecookie's GenerateRandomKey() function. I'd suggest returning []byte, err instead of return nil on an error though, as otherwise you need to manually check for nil (for safety). Better to just return an explicit error.

I have not been through the source in full, but these issues were the most glaring and I recommend resolving them ASAP. I also recommend instructing users on how to generate secure, persistent XSRF session keys and session cookie keys using either crypto/rand to save to file (I'd suggest using a CLI flag to allow this to be done as a once off, and using log.Fatal if no keys are present) or the OpenSSL CLI to do the same.

Please answer these questions before submitting your issue. Thanks!

1. What version of Go and beego are you using (bee version)? go version go1.14.6 darwin/amd64

2. What operating system and processor architecture are you using (go env)? mac os catalina 10.15.4 ,6-Core Intel Core i7 go env:

3. What did you do? I installed the Go from pkg below and then i used the command below to set the proxy:

go env -w GO111MODULE=on
go env -w GOPROXY=https://goproxy.io,direct

and then I used the command below to install the beego and bee:

go get -u github.com/astaxie/beego
go get -u github.com/beego/bee

so far so good.

4. What did you expect to see? I want to use the bee new *** to create a project.

5. What did you see instead? when I ran the command "bee" or "bee new ***", i encountered the error below:

I reboot the mac, uninstall go and re-install go and bee for 3 times, it doesn't work. can someone help me? thanks.

发现在windows中用SaveToFile保存上传后的文件，一直占着虚拟内存没有释放，再上传多几次C盘就满了 有什么方法比较优化的呢？ 代码如下：

package main

import (
    "github.com/astaxie/beego"
)

type UploadController struct {
    beego.Controller
}
func (this *UploadController) Post() {
    _, h, _ := this.GetFile("uploadfile")
    this.SaveToFile("uploadfile", "./static/files/"+h.Filename)
    this.Ctx.Redirect(302, "/upload")

}

func main() {
    beego.Router("/upload", &UploadController{})
    beego.Run()
}

Please answer these questions before submitting your issue. Thanks!

1. What version of Go and beego are you using (bee version)? Go version : go1.15.4 Bee version: v1.12.0
2. What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/theo/Library/Caches/go-build"
GOENV="/Users/theo/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/theo/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/theo/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.15.4/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.15.4/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/zl/4vn0pm8x4lz1h2bm6y5kkdnm0000gn/T/go-build854159209=/tmp/go-build -gno-record-gcc-switches -fno-common"

3. What did you do?

I created a new installation of Beego using the bee api my-api command and then I add this code into controllers/object.go:

package controllers

import (
	"my-app/models"
	"encoding/json"

	beego "github.com/astaxie/beego/server/web"
)

// Operations about object
type ObjectController struct {
	beego.Controller
}

4. What did you expect to see? I am expecting to see the messages Built successfully and app is running

5. What did you see instead?

2020/11/11 15:33:47 INFO     ▶ 0002 Initializing watcher...
go: finding module for package github.com/astaxie/beego/server/web
controllers/object.go:7:2: module github.com/astaxie/beego@latest found (v1.12.3), but does not contain package github.com/astaxie/beego/server/web
2020/11/11 15:33:49 ERROR    ▶ 0003 Failed to build the application: go: finding module for package github.com/astaxie/beego/server/web
controllers/object.go:7:2: module github.com/astaxie/beego@latest found (v1.12.3), but does not contain package github.com/astaxie/beego/server/web

用的是最新的 linux： [root@li538-145]# date Fri Jan 3 12:00:56 CST 2014

mysql： mysql> select now(); +---------------------+ | now() | +---------------------+ | 2014-01-03 12:01:13 | +---------------------+ 1 row in set (0.00 sec)

如果程序中 不设置orm.DefaultTimeLoc = time.UTC 则慢8小时 但是获取的时间是对的 now := time.Now() fmt.Println(now) fmt.Println(now.Location()) fmt.Println(now.Zone())

2014-01-03 12:03:50.31161402 +0800 CST Local CST 28800

设置的话慢16小时

this is happen after I update beego to 1.6.1.

this is my code func (c *AuthController) Login() {

    var data models.User
    if err := json.Unmarshal(c.Ctx.Input.RequestBody, &data); err != nil {
        c.Ctx.Output.SetStatus(400)
        fmt.Println(c.Ctx.Input.RequestBody)
        c.Ctx.Output.Body([]byte("empty title"))
        return
    }
    res := struct{  
        Data []*models.User 
    }{}

    var cond *orm.Condition
    cond = orm.NewCondition()

    cond = cond.And("username", data.Username)
    cond = cond.And("password", data.Password)
    lim :=1

    var qs orm.QuerySeter
    qs = orm.NewOrm().QueryTable("user").SetCond(cond).Limit(lim)
    _,err := qs.All(&res.Data)
    if err != nil {
        c.Ctx.Output.SetStatus(400)
        c.Ctx.Output.Body([]byte(err.Error()))
        return
    }
    result := struct{   
        Success bool
        Message string
    }{} 
}

curl -X POST http://lo0/login -d '{"username" : "admin", "password":"admin"}' empty title

lmvm@lm17 ~/go/src/github.com/goldalworming/auth $ go run main.go [] <----fmt.Println return this empty array

例如，我有如下代码：

var hotCourse []models.VCourse sql = "SELECT * FROM v_course ORDER BY hits DESC LIMIT 4" o.Raw(sql).QueryRows(&hotCourse)

传入的hotCourse对应的models.VCourse里面的字段与数据库里面的字段顺序要一致才能将预期的字段值设置到VCourse的字段里面去。

如： type VCourse struct{ Id int64 Name string }

那么sql语句里面必须SELECT id,name FROM table才能将字段的值绑定上去。这很不方便。

我希望是这样的： 当我的结构体只有两个字段：Id与Name,那么，在结果绑定到结构体上的时候，先遍历结构体的字段，按照Model的定义（即与表字段之间的定义）进行查找SQL里面的字段，然后将该字段的值绑定到结构体的对应字段上。这样就很完善了。

在编写代码的时候，就不用再担心字段顺序的问题了。也不用担心，结构体的字段只有2个，而SQL字段有3个，导致匹配不上而报错了。

能否请设计ORM的大神改善一下原生SQL语句的智能能力呢。谢谢！

I have a problem with cors and beego. This is my code:

func main(){
beego.InsertFilter("*", beego.BeforeRouter,cors.Allow(&cors.Options{
        AllowAllOrigins: true,
        AllowMethods: []string{"GET", "DELETE", "PUT", "PATCH", "OPTIONS"},
        AllowHeaders: []string{"Origin", "Access-Control-Allow-Origin"},
        ExposeHeaders: []string{"Content-Length", "Access-Control-Allow-Origin"},
        AllowCredentials: true,
    }))
beego.Run()
}

I receive this answer: "XMLHttpRequest cannot load http://localhost:8080/. No 'Access-Control-Allow-Origin' header is present on the requested resource"

I can't figure it out. Do you have any ideas? Thanks for any help.

runmode已经设置成了dev，注解也写了，但是未生成commentsRouter.go文件 OS win 10，beego版本 master版本

runmode = "dev"

router.go

func init() {
	ns := beego.NewNamespace("/admin",

		beego.NSNamespace("/contents",
			beego.NSInclude(
				&controllers.ContentController{},
			),
		),
	)
	beego.AddNamespace(ns)
}

controllers/content.go

type ContentController struct {
	BaseController
}

// @router / [get]
func (this *ContentController) GetContents() {
	defer this.ServeJSON()
        // .....
}

get environment variable if config item has prefix $ENV_ $$env ${env}. if environment variable is empty or not exist then return default value (split with ||). e.g.

token = ${TOKEN||astaxie}
[demo]
password = ${MyPWD}
user = ${MyUser||beego}

the result of config.String("demo::password") is the $MyPWD environment variable. some people need it , such as #1283 .

beego v2.0.7 go 1.8

we have 100 thousand records want to insert data use insert on duplicate key update in batch but beego only support InsertOrUpdate/InsertOrUpdateWithCtx to insert one record to database

  ```
  InsertOrUpdate(md interface{}, colConflitAndArgs ...string) (int64, error)
  InsertOrUpdateWithCtx(ctx context.Context, md interface{}, colConflitAndArgs ...string) (int64, error)
  ```

how can I batch insert like insert on duplicate key update in batch

1. What version of Go and beego are you using (bee version)? Golang 1.18.1, beego v1.12.11

2. What operating system and processor architecture are you using (go env)? Manjaro Linux latest(rolling)

3. What did you do? Running the following code(figure 1) would cause errors as follows.

casdoor-casdoor-1 exited with code 2
casdoor-casdoor-1 | panic: prefix should has path
casdoor-casdoor-1 |
casdoor-casdoor-1 | goroutine 1 [running]:
casdoor-casdoor-1 | github.com/beego/beego.(*Tree).addtree(0x0, {0x2b42ae0, 0x174ef40, 0xc000a0e4e8}, 0x1, {0x0, 0x0, 0xc000a0e018}, {0x0, 0x0})
casdoor-casdoor-1 | /go/src/casdoor/vendor/github.com/beego/beego/tree.go:58 +0x1185
casdoor-casdoor-1 | github.com/beego/beego.(*Tree).AddTree(0x174ef40, {0x0, 0xc000040430}, 0x3)
casdoor-casdoor-1 | /go/src/casdoor/vendor/github.com/beego/beego/tree.go:53 +0x54
casdoor-casdoor-1 | github.com/beego/beego.(*Namespace).Namespace(0xc0000ae828, {0xc00035b278, 0x1, 0x1})
casdoor-casdoor-1 | /go/src/casdoor/vendor/github.com/beego/beego/namespace.go:212 +0x205
casdoor-casdoor-1 | github.com/beego/beego.NSNamespace.func1(0x30)
casdoor-casdoor-1 | /go/src/casdoor/vendor/github.com/beego/beego/namespace.go:387 +0x5a
casdoor-casdoor-1 | github.com/beego/beego.NewNamespace({0x19eb591, 0x1}, {0xc00035bce0, 0x2, 0x1})
casdoor-casdoor-1 | /go/src/casdoor/vendor/github.com/beego/beego/namespace.go:42 +0x104
casdoor-casdoor-1 | github.com/casdoor/casdoor/routers.initAPI()
casdoor-casdoor-1 | /go/src/casdoor/routers/router.go:33 +0x1a7
casdoor-casdoor-1 | github.com/casdoor/casdoor/routers.init.1()
casdoor-casdoor-1 | /go/src/casdoor/routers/router.go:29 +0x17

4. What did you expect to see?

No error.

5. What did you see instead?

Errors as shown above.

We suspect that it might be compatibility of Manjaro Linux latest(rolling) and beego

1. What version of Go and beego are you using (bee version)? 2.0.5

2. What operating system and processor architecture are you using (go env)? Windows, amd64

3. What did you expect to see? An exported method or function to view all the registered models in the ORM.

4. What did you see instead? The unexported modelcache struct.

Not mreally an issue, but a question. I want a simple way to create an admin site for my project. The best way to go about this in my opinion is to get all registered models from the ORM, and work off those models registered. Maybe there is a better way, in which case I'm more than glad to hear those options. There is no method documented which I could find to accomplish this.

To be more specific, I'm looking for a way to access one of the following methods defined on modelCache

// get all model info
func (mc *modelCache) all() map[string]*modelInfo {
	m := make(map[string]*modelInfo, len(mc.cache))
	for k, v := range mc.cache {
		m[k] = v
	}
	return m
}

// get ordered model info
func (mc *modelCache) allOrdered() []*modelInfo {
	m := make([]*modelInfo, 0, len(mc.orders))
	for _, table := range mc.orders {
		m = append(m, mc.cache[table])
	}
	return m
}

Going with that, the following fields would also be very nice if they were exported:

// single model info
type modelInfo struct {
	manual    bool
	isThrough bool
	pkg       string
	name      string // -> Name
	fullName  string // -> FullName
	table     string // -> Table
	model     interface{} // -> Model
	fields    *fields // -> Fields
	addrField reflect.Value // store the original struct value
	uniques   []string
}

Along with the entire fields struct, and fieldinfo struct. There is so much awesome logic hiding behind the ORM, which I think a lot of people could do great creative things with! Would it be much of a hassle to export some of these methods and fields?

1. What version of Go and beego are you using (bee version)? 2.0.5

2. What operating system and processor architecture are you using (go env)? Windows, amd64

3. What did you expect to see? A way to embed templates when building the application

4. What did you see instead? No clear documentation on this subject.

Basically, I have a question. Is there a way to embed the HTML files with the executable for distribution? Could a feature like this be implemented by users of beego? I did not see any clear documentation on this subject, but I might have missed it.

English Only. Please use English because others could join the discussion if they got similar issue!

Please answer these questions before submitting your issue. Thanks!

1. What version of Go and beego are you using (bee version)? | ___
   | |/ / ___ ___ | ___ \ / _ \ / _
   | |/ /| /| / __/ _| ___| v2.0.4

├── GoVersion : go1.18 ├── GOOS : windows ├── GOARCH : amd64 ├── NumCPU : 4 ├── GOPATH : C:\Users\dell\go ├── GOROOT : C:\Program Files\Go ├── Compiler : gc └── Date : Saturday, 22 Oct 2022

2. What operating system and processor architecture are you using (go env)? GOOS=windows GOARCH=amd64

3. What did you do? I upload some files which bigger than defaultMemSize(32MB)

4. What did you expect to see? temp file is deleted

5. What did you see instead? the temp file in /tmp directory will be not deleted. The name of temp file is "multipart-XXXXXXXX"

6. My Solution by According to this issue(https://github.com/golang/go/issues/20253), after I call c.SaveToFile in controller, I call c.Ctx.Request.MultipartForm.RemoveAll() It works.

I think beego is better at doing this than users.