From 7f331f5503af194724f7b7fee0308b9e346ed699 Mon Sep 17 00:00:00 2001
From: CityFun <31820853+zhengkunwang223@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:31:51 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E8=A7=A3=E5=86=B3=E8=AF=81=E4=B9=A6?=
 =?UTF-8?q?=E6=8E=A8=E9=80=81=E5=88=B0=E5=85=B6=E4=BB=96=E8=8A=82=E7=82=B9?=
 =?UTF-8?q?=E6=8A=A5=E9=94=99=E7=9A=84=E9=97=AE=E9=A2=98=20(#13065)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 core/app/api/v2/setting.go          |  3 ++-
 core/middleware/csrf_protect.go     |  3 +++
 core/middleware/ip_limit.go         | 19 ++++++++++++++++++-
 core/middleware/password_expired.go |  4 ++++
 core/middleware/session.go          |  2 +-
 5 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/core/app/api/v2/setting.go b/core/app/api/v2/setting.go
index f12255f07..f36f239ba 100644
--- a/core/app/api/v2/setting.go
+++ b/core/app/api/v2/setting.go
@@ -3,6 +3,7 @@ package v2
 import (
 	"encoding/base64"
 	"errors"
+	"net"
 	"net/http"
 	"os"
 	"path"
@@ -350,7 +351,7 @@ func (b *BaseApi) UpdatePort(c *gin.Context) {
 // @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"重载系统 SSL","formatEN":"reload system SSL"}
 func (b *BaseApi) ReloadSSL(c *gin.Context) {
 	clientIP := c.ClientIP()
-	if clientIP != "127.0.0.1" {
+	if ip := net.ParseIP(clientIP); ip == nil || !ip.IsLoopback() {
 		helper.InternalServer(c, errors.New("only localhost can reload ssl"))
 		return
 	}
diff --git a/core/middleware/csrf_protect.go b/core/middleware/csrf_protect.go
index c6f313526..71a52d620 100644
--- a/core/middleware/csrf_protect.go
+++ b/core/middleware/csrf_protect.go
@@ -33,6 +33,9 @@ func CSRFTokenGuard() gin.HandlerFunc {
 }
 
 func requiresCSRFTokenCheck(c *gin.Context) bool {
+	if c.GetBool("LOCAL_REQUEST") {
+		return false
+	}
 	unsafeMethod := c.Request.Method != http.MethodGet &&
 		c.Request.Method != http.MethodHead &&
 		c.Request.Method != http.MethodOptions &&
diff --git a/core/middleware/ip_limit.go b/core/middleware/ip_limit.go
index 3d050139a..8b4cd7998 100644
--- a/core/middleware/ip_limit.go
+++ b/core/middleware/ip_limit.go
@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"net"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/core/app/api/v2/helper"
@@ -14,7 +15,7 @@ func WhiteAllow() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		tokenString := c.GetHeader("X-Panel-Local-Token")
 		clientIP := common.GetRealClientIP(c)
-		if clientIP == "127.0.0.1" && tokenString != "" && c.Request.URL.Path == "/api/v2/core/xpack/sync/ssl" {
+		if isLocalSyncRequest(c.Request.URL.Path, clientIP, tokenString) {
 			c.Set("LOCAL_REQUEST", true)
 			c.Next()
 			return
@@ -48,3 +49,19 @@ func WhiteAllow() gin.HandlerFunc {
 		helper.ErrWithHtml(c, code, "err_ip_limit")
 	}
 }
+
+func isLocalSyncRequest(reqPath, clientIP, token string) bool {
+	ip := net.ParseIP(clientIP)
+	if ip == nil || !ip.IsLoopback() {
+		return false
+	}
+
+	switch reqPath {
+	case "/api/v2/core/xpack/sync/ssl":
+		return token != ""
+	case "/api/v2/core/settings/ssl/reload":
+		return true
+	default:
+		return false
+	}
+}
diff --git a/core/middleware/password_expired.go b/core/middleware/password_expired.go
index 911397bde..3bbb79565 100644
--- a/core/middleware/password_expired.go
+++ b/core/middleware/password_expired.go
@@ -23,6 +23,10 @@ func PasswordExpired() gin.HandlerFunc {
 			c.Next()
 			return
 		}
+		if c.GetBool("LOCAL_REQUEST") {
+			c.Next()
+			return
+		}
 		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") ||
 			c.Request.URL.Path == "/api/v2/core/settings/search" ||
 			c.Request.URL.Path == "/api/v2/core/settings/search/base" ||
diff --git a/core/middleware/session.go b/core/middleware/session.go
index 1c69fe63a..57f5f53f5 100644
--- a/core/middleware/session.go
+++ b/core/middleware/session.go
@@ -15,7 +15,7 @@ import (
 func SessionAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		apiReq := c.GetBool("API_AUTH")
-		if isAnonymousAuthPath(c.Request.URL.Path) || apiReq {
+		if isAnonymousAuthPath(c.Request.URL.Path) || apiReq || c.GetBool("LOCAL_REQUEST") {
 			c.Next()
 			return
 		}