diff --git a/app/admin/controller/File.php b/app/admin/controller/File.php index a34e3133b..9fb36ecf1 100644 --- a/app/admin/controller/File.php +++ b/app/admin/controller/File.php @@ -92,13 +92,17 @@ class File extends Controller */ public function remove() { - SystemFile::mDelete(); + if (!AdminService::isSuper()) { + $where = ['uuid' => AdminService::getUserId()]; + } + SystemFile::mDelete('', $where ?? []); } /** * 清理重复文件 * @auth true * @return void + * @throws \think\db\exception\DbException */ public function distinct() { diff --git a/app/admin/controller/api/Upload.php b/app/admin/controller/api/Upload.php index 3fc3e6c0d..1bd925093 100644 --- a/app/admin/controller/api/Upload.php +++ b/app/admin/controller/api/Upload.php @@ -193,7 +193,7 @@ class Upload extends Controller $extension = strtolower($file->getOriginalExtension()); $saveFileName = input('key') ?: Storage::name($file->getPathname(), $extension, '', 'md5_file'); // 检查文件名称是否合法 - if (strpos($saveFileName, '../') !== false) { + if (strpos($saveFileName, '..') !== false) { $this->error('文件路径不能出现跳级操作!'); } // 检查文件后缀是否被恶意修改 diff --git a/app/admin/view/api/upload/image.html b/app/admin/view/api/upload/image.html index 5e9d06979..0d8c2275d 100644 --- a/app/admin/view/api/upload/image.html +++ b/app/admin/view/api/upload/image.html @@ -12,8 +12,13 @@
i.pages||(i.curr=e,t.render())});e&&o.on(e,"change",function(){var e=this.value;i.curr*e>i.count&&(i.curr=Math.ceil(i.count/e)),i.limit=e,t.render()}),r&&o.on(r,"click",function(){l()})}},t.prototype.skip=function(t){var i,e;t&&(i=this,e=t[c]("input")[0])&&o.on(e,"keyup",function(e){var a=this.value,e=e.keyCode;/^(37|38|39|40)$/.test(e)||(/\D/.test(a)&&(this.value=a.replace(/\D/,"")),13===e&&i.jump(t,!0))})},t.prototype.render=function(e){var a=this,t=a.config,i=a.type(),n=a.view(),i=(2===i?t.elem&&(t.elem.innerHTML=n):3===i?t.elem.html(n):r[u](t.elem)&&(r[u](t.elem).innerHTML=n),t.jump&&t.jump(t,e),r[u]("layui-laypage-"+t.index));a.jump(i),t.hash&&!e&&(location.hash="!"+t.hash+"="+t.curr),a.skip(i)},{render:function(e){return new t(e).index},index:layui.laypage?layui.laypage.index+1e4:0,on:function(a,e,t){return a.attachEvent?a.attachEvent("on"+e,function(e){e.target=e.srcElement,t.call(a,e)}):a.addEventListener(e,t,!1),this}});e("laypage",o)});!function(i,v){"use strict";var n=i.layui&&layui.define,l={getPath:i.lay&&lay.getPath?lay.getPath:"",link:function(e,t,a){D.path&&i.lay&&lay.layui&&lay.layui.link(D.path+e,t,a)}},e=i.LAYUI_GLOBAL||{},d="layui-laydate-id",D={v:"5.5.0",config:{weekStart:0},index:i.laydate&&i.laydate.v?1e5:0,path:e.laydate_dir||l.getPath,set:function(e){var t=this;return t.config=lay.extend({},t.config,e),t},ready:function(e){var t="laydate",a=(n?"modules/":"")+"laydate.css?v="+D.v;return n?layui["layui.all"]?"function"==typeof e&&e():layui.addcss(a,e,t):l.link(a,e,t),this}},s=function(){var t=this,e=t.config.id;return(s.that[e]=t).inst={hint:function(e){t.hint.call(t,e)},reload:function(e){t.reload.call(t,e)},config:t.config}},a="laydate",x="layui-this",k="laydate-disabled",h=[100,2e5],T="layui-laydate-static",w="layui-laydate-list",o="laydate-selected",r="layui-laydate-hint",y="laydate-day-prev",m="laydate-day-next",C=".laydate-btns-confirm",M="laydate-time-text",L="laydate-btns-time",E="layui-laydate-preview",S="layui-laydate-shade",I=function(e){var t,a=this,n=(a.index=++D.index,a.config=lay.extend({},a.config,D.config,e),lay(e.elem||a.config.elem));return 1
\u5fc5\u987b\u9075\u5faa\u4e0b\u8ff0\u683c\u5f0f\uff1a
","
\u5df2\u4e3a\u4f60\u91cd\u7f6e"],preview:"\u5f53\u524d\u9009\u4e2d\u7684\u7ed3\u679c"},en:{weeks:["Su","Mo","Tu","We","Th","Fr","Sa"],time:["Hours","Minutes","Seconds"],timeTips:"Select Time",startTime:"Start Time",endTime:"End Time",dateTips:"Select Date",month:["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],tools:{confirm:"Confirm",clear:"Clear",now:"Now"},timeout:"End time cannot be less than start Time
Please re-select",invalidDate:"Invalid date",formatError:["The date format error
Must be followed\uff1a
","
It has been reset"],preview:"The selected result"}};return e[this.config.lang]||e.cn},I.prototype.reload=function(e){this.config=lay.extend({},this.config,e),this.init()},I.prototype.init=function(){var r=this,o=r.config,e="static"===o.position,t={year:"yyyy",month:"yyyy-MM",date:"yyyy-MM-dd",time:"HH:mm:ss",datetime:"yyyy-MM-dd HH:mm:ss"};o.elem=lay(o.elem),o.eventElem=lay(o.eventElem),o.elem[0]&&("array"!==layui.type(o.theme)&&(o.theme=[o.theme]),o.fullPanel&&("datetime"!==o.type||o.range)&&delete o.fullPanel,r.rangeStr=o.range?"string"==typeof o.range?o.range:"-":"",r.rangeLinked=!(!o.range||!o.rangeLinked||"date"!==o.type&&"datetime"!==o.type),r.autoCalendarModel=function(){var e=r.rangeLinked;return r.rangeLinked=o.range&&("date"===o.type||"datetime"===o.type)&&(!r.startDate||!r.endDate||r.startDate&&r.endDate&&r.startDate.year===r.endDate.year&&r.startDate.month===r.endDate.month),lay(r.elem)[r.rangeLinked?"addClass":"removeClass"]("layui-laydate-linkage"),r.rangeLinked!=e},r.autoCalendarModel.auto=r.rangeLinked&&"auto"===o.rangeLinked,"array"===layui.type(o.range)&&(r.rangeElem=[lay(o.range[0]),lay(o.range[1])]),t[o.type]||(i.console&&console.error&&console.error("laydate type error:'"+o.type+"' is not supported"),o.type="date"),o.format===t.date&&(o.format=t[o.type]||t.date),r.format=s.formatArr(o.format),o.weekStart&&!/^[0-6]$/.test(o.weekStart)&&(t=r.lang(),o.weekStart=t.weeks.indexOf(o.weekStart),-1===o.weekStart)&&(o.weekStart=0),r.EXP_IF="",r.EXP_SPLIT="",lay.each(r.format,function(e,t){e=new RegExp(c).test(t)?"\\d{"+(new RegExp(c).test(r.format[0===e?e+1:e-1]||"")?/^yyyy|y$/.test(t)?4:t.length:/^yyyy$/.test(t)?"1,4":/^y$/.test(t)?"1,308":"1,2")+"}":"\\"+t;r.EXP_IF=r.EXP_IF+e,r.EXP_SPLIT=r.EXP_SPLIT+"("+e+")"}),r.EXP_IF_ONE=new RegExp("^"+r.EXP_IF+"$"),r.EXP_IF=new RegExp("^"+(o.range?r.EXP_IF+"\\s\\"+r.rangeStr+"\\s"+r.EXP_IF:r.EXP_IF)+"$"),r.EXP_SPLIT=new RegExp("^"+r.EXP_SPLIT+"$",""),r.isInput(o.elem[0])||"focus"===o.trigger&&(o.trigger="click"),o.elem.attr("lay-key",r.index),o.eventElem.attr("lay-key",r.index),o.elem.attr(d,o.id),o.mark=lay.extend({},o.calendar&&"cn"===o.lang?{"0-1-1":"\u5143\u65e6","0-2-14":"\u60c5\u4eba","0-3-8":"\u5987\u5973","0-3-12":"\u690d\u6811","0-4-1":"\u611a\u4eba","0-5-1":"\u52b3\u52a8","0-5-4":"\u9752\u5e74","0-6-1":"\u513f\u7ae5","0-9-10":"\u6559\u5e08","0-10-1":"\u56fd\u5e86","0-12-25":"\u5723\u8bde"}:{},o.mark),lay.each(["min","max"],function(e,t){var a=[],n=[];if("number"==typeof o[t])var i=o[t],l=new Date,l=r.newDate({year:l.getFullYear(),month:l.getMonth(),date:l.getDate(),hours:e?23:0,minutes:e?59:0,seconds:e?59:0}).getTime(),e=new Date(i?i<864e5?l+864e5*i:i:l),a=[e.getFullYear(),e.getMonth()+1,e.getDate()],n=[e.getHours(),e.getMinutes(),e.getSeconds()];else if("string"==typeof o[t])a=(o[t].match(/\d+-\d+-\d+/)||[""])[0].split("-"),n=(o[t].match(/\d+:\d+:\d+/)||[""])[0].split(":");else if("object"==typeof o[t])return o[t];o[t]={year:0|a[0]||(new Date).getFullYear(),month:a[1]?(0|a[1])-1:(new Date).getMonth(),date:0|a[2]||(new Date).getDate(),hours:0|n[0],minutes:0|n[1],seconds:0|n[2]}}),r.elemID="layui-laydate"+o.elem.attr("lay-key"),(o.show||e)&&r.render(),e||r.events(),o.value)&&o.isInitValue&&("date"===layui.type(o.value)?r.setValue(r.parse(0,r.systemDate(o.value))):r.setValue(o.value))},I.prototype.render=function(){var a,n,i,l,r=this,o=r.config,d=r.lang(),s="static"===o.position,y=r.elem=lay.elem("div",{id:r.elemID,"class":["layui-laydate",o.range?" layui-laydate-range":"",r.rangeLinked?" layui-laydate-linkage":"",s?" "+T:"",o.fullPanel?" laydate-theme-fullpanel":"",(a="",lay.each(o.theme,function(e,t){"default"===t||/^#/.test(t)||(a+=" laydate-theme-"+t)}),a)].join("")}),m=r.elemMain=[],c=r.elemHeader=[],u=r.elemCont=[],h=r.table=[],e=r.footer=lay.elem("div",{"class":"layui-laydate-footer"}),t=r.shortcut=lay.elem("ul",{"class":"layui-laydate-shortcut"}),f=(o.zIndex&&(y.style.zIndex=o.zIndex),lay.each(new Array(2),function(e){if(!o.range&&0
"+m.time[t]+"