From 37ad2cb16d128c9765d7ef6ecf1147260835cf4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=82=B9=E6=99=AF=E7=AB=8B?= <zoujingli@qq.com>
Date: Fri, 28 May 2021 10:26:55 +0800
Subject: [PATCH] Update Upload.php

---
 app/admin/controller/api/Upload.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/admin/controller/api/Upload.php b/app/admin/controller/api/Upload.php
index 7130972e6..6f002542c 100644
--- a/app/admin/controller/api/Upload.php
+++ b/app/admin/controller/api/Upload.php
@@ -223,7 +223,7 @@ class Upload extends Controller
         if (is_resource($source)) fclose($source);
         $bins = hex2bin($hexs);
         /* 匹配十六进制中的 <% ( ) %> 或 <? ( ) ?> 或 <script | /script> */
-        foreach (['<?', '<%', '<script'] as $key) if (stripos($bins, $key) !== false) return true;
+        foreach (['<?php ', '<% ', '<script '] as $key) if (stripos($bins, $key) !== false) return true;
         return preg_match("/(3c25.*?28.*?29.*?253e)|(3c3f.*?28.*?29.*?3f3e)|(3C534352495054)|(2F5343524950543E)|(3C736372697074)|(2F7363726970743E)/is", $hexs);
     }