From eb89eeb78ef62000e612d7e708fc8f94ce392093 Mon Sep 17 00:00:00 2001
From: klarkxy <278370456@qq.com>
Date: Fri, 13 Mar 2026 15:45:54 +0800
Subject: [PATCH] feat(gitpull): replace sudo password auth with NOPASSWD
 sudoers config

- Remove hardcoded sudo username and password from gitpull.php
- Switch to using `sudo git pull` with NOPASSWD sudoers configuration
- Add helpful error message with setup instructions when git pull fails
- Improve security by eliminating password storage in source code
---
 web/gitpull.php | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/web/gitpull.php b/web/gitpull.php
index 211b4d7..488d431 100644
--- a/web/gitpull.php
+++ b/web/gitpull.php
@@ -12,20 +12,17 @@ if (!isset($_SESSION[$OJ_NAME.'_'.'administrator'])) {
 }
 
 // ====================================================
-// 请在下方填写 sudo 用户名和密码
-$SUDO_USER     = 'jieer';          // 填写拥有 sudo 权限的用户名
-$SUDO_PASSWORD = 'cmf[420;';       // 填写该用户的 sudo 密码
+// 前置配置（在服务器上执行一次）：
+//   echo "www-data ALL=(ALL) NOPASSWD: /usr/bin/git" | sudo tee /etc/sudoers.d/www-data-git
+//   sudo chmod 440 /etc/sudoers.d/www-data-git
 // ====================================================
 
 $src_path = '/home/judge/src';
 $output = [];
 $return_code = -1;
 
-// 打开页面或点击重试按钮时均执行更新
-$cmd = "echo " . escapeshellarg($SUDO_PASSWORD)
-     . " | su -c " . escapeshellarg("git -C " . $src_path . " pull")
-     . " " . escapeshellarg($SUDO_USER)
-     . " 2>&1";
+// 打开页面或点击重试按钮时均以 root 身份执行 git pull
+$cmd = "sudo git -C " . escapeshellarg($src_path) . " pull 2>&1";
 exec($cmd, $output, $return_code);
 
 $show_title = "Git Pull - " . $OJ_NAME;
@@ -41,6 +38,13 @@ require("template/".$OJ_TEMPLATE."/header.php");
     <div class="ui <?php echo $return_code === 0 ? 'success' : 'error'; ?> message">
         <div class="header"><?php echo $return_code === 0 ? '更新成功' : '更新失败（返回码：' . $return_code . '）'; ?></div>
         <pre style="margin-top:8px; white-space:pre-wrap; word-break:break-all;"><?php echo htmlspecialchars(implode("\n", $output)); ?></pre>
+        <?php if ($return_code !== 0): ?>
+        <div style="margin-top:10px; padding:10px; background:#f8f8f8; border-radius:4px; font-size:0.9em;">
+            <b>若提示 sudo 权限不足，请在服务器上执行以下命令（仅需一次）：</b><br>
+            <code>echo "www-data ALL=(ALL) NOPASSWD: /usr/bin/git" | sudo tee /etc/sudoers.d/www-data-git</code><br>
+            <code>sudo chmod 440 /etc/sudoers.d/www-data-git</code>
+        </div>
+        <?php endif; ?>
     </div>
 
     <div style="margin-top:16px;">