diff --git a/app/admin/view/api/upload.js b/app/admin/view/api/upload.js
index e2b4fa0d8..472038535 100644
--- a/app/admin/view/api/upload.js
+++ b/app/admin/view/api/upload.js
@@ -29,6 +29,7 @@ define(['md5'], function (SparkMD5, allowMime) {
                                 if (parseInt(ret.code) === 404) {
                                     file.xurl = ret.data.url;
                                     option.uploader.config.url = ret.data.server;
+                                    option.uploader.config.data.key = ret.data.xkey;
                                     option.uploader.config.data.xkey = ret.data.xkey;
                                     option.uploader.config.data.safe = ret.data.safe;
                                     option.uploader.config.data.uptype = ret.data.uptype;
diff --git a/app/data/controller/api/Wechat.php b/app/data/controller/api/Wechat.php
index 6bfec0991..35269cf2c 100644
--- a/app/data/controller/api/Wechat.php
+++ b/app/data/controller/api/Wechat.php
@@ -13,7 +13,7 @@ use think\Response;
  * @package app\data\controller\api
  * @example 域名请修改为自己的地址，放到网页代码合适位置
  * <meta name="referrer" content="always">
- * <script src="https://your.domain.com/data/api.wechat/oauth?mode=1"></script>
+ * <script referrerpolicy="unsafe-url" src="https://your.domain.com/data/api.wechat/oauth?mode=1"></script>
  *
  * 授权模式支持两种模块，参数 mode=0 时为静默授权，mode=1 时为完整授权
  * 注意：回跳地址默认从 Header 中的 http_referer 获取，也可以传 source 参数
@@ -116,7 +116,7 @@ class Wechat extends Controller
         <div style="margin-top:30px">用户数据</div>
         <pre id="userdata">待网页授权，加载用户数据...</pre>
         
-        <script src="//{$this->request->host()}/data/api.wechat/oauth?mode=1"></script>
+        <script referrerpolicy="unsafe-url" src="//{$this->request->host()}/data/api.wechat/oauth?mode=1"></script>
         <script>
             if(typeof window.WeChatFansInfo === 'object'){   
                 document.getElementById('fansdata').innerText = JSON.stringify(window.WeChatFansInfo, null, 2);