From 3eb9c37eb29c5a166b13e10aca9236cf65d31b04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=82=B9=E6=99=AF=E7=AB=8B?= <zoujingli@qq.com>
Date: Fri, 9 Apr 2021 09:56:16 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E4=BB=A3=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/admin/view/api/upload.js       | 1 +
 app/data/controller/api/Wechat.php | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/admin/view/api/upload.js b/app/admin/view/api/upload.js
index e2b4fa0d8..472038535 100644
--- a/app/admin/view/api/upload.js
+++ b/app/admin/view/api/upload.js
@@ -29,6 +29,7 @@ define(['md5'], function (SparkMD5, allowMime) {
                                 if (parseInt(ret.code) === 404) {
                                     file.xurl = ret.data.url;
                                     option.uploader.config.url = ret.data.server;
+                                    option.uploader.config.data.key = ret.data.xkey;
                                     option.uploader.config.data.xkey = ret.data.xkey;
                                     option.uploader.config.data.safe = ret.data.safe;
                                     option.uploader.config.data.uptype = ret.data.uptype;
diff --git a/app/data/controller/api/Wechat.php b/app/data/controller/api/Wechat.php
index 6bfec0991..35269cf2c 100644
--- a/app/data/controller/api/Wechat.php
+++ b/app/data/controller/api/Wechat.php
@@ -13,7 +13,7 @@ use think\Response;
  * @package app\data\controller\api
  * @example 域名请修改为自己的地址，放到网页代码合适位置
  * <meta name="referrer" content="always">
- * <script src="https://your.domain.com/data/api.wechat/oauth?mode=1"></script>
+ * <script referrerpolicy="unsafe-url" src="https://your.domain.com/data/api.wechat/oauth?mode=1"></script>
  *
  * 授权模式支持两种模块，参数 mode=0 时为静默授权，mode=1 时为完整授权
  * 注意：回跳地址默认从 Header 中的 http_referer 获取，也可以传 source 参数
@@ -116,7 +116,7 @@ class Wechat extends Controller
         <div style="margin-top:30px">用户数据</div>
         <pre id="userdata">待网页授权，加载用户数据...</pre>
         
-        <script src="//{$this->request->host()}/data/api.wechat/oauth?mode=1"></script>
+        <script referrerpolicy="unsafe-url" src="//{$this->request->host()}/data/api.wechat/oauth?mode=1"></script>
         <script>
             if(typeof window.WeChatFansInfo === 'object'){   
                 document.getElementById('fansdata').innerText = JSON.stringify(window.WeChatFansInfo, null, 2);