From 73c2b358fbdf3f59417efaa26ed544b02e55aab6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=82=B9=E6=99=AF=E7=AB=8B?= <zoujingli@qq.com>
Date: Fri, 31 May 2024 19:02:57 +0800
Subject: [PATCH] =?UTF-8?q?fix=20#I9TJ1B=20=E4=BF=AE=E5=A4=8D=E6=96=87?=
 =?UTF-8?q?=E4=BB=B6=E4=B8=8A=E4=BC=A0=E5=9B=BE=E7=89=87=E5=AE=89=E5=85=A8?=
 =?UTF-8?q?=E6=A3=80=E6=9F=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/admin/controller/api/Upload.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/admin/controller/api/Upload.php b/app/admin/controller/api/Upload.php
index 26b6234d4..c6e38dc5f 100644
--- a/app/admin/controller/api/Upload.php
+++ b/app/admin/controller/api/Upload.php
@@ -331,6 +331,7 @@ class Upload extends Controller
         $bins = hex2bin($hexs);
         /* 匹配十六进制中的 <% ( ) %> 或 <? ( ) ?> 或 <script | /script> */
         foreach (['<?php ', '<% ', '<script '] as $key) if (stripos($bins, $key) !== false) return true;
-        return preg_match("/(3c25.*?28.*?29.*?253e)|(3c3f.*?28.*?29.*?3f3e)|(3C534352495054)|(2F5343524950543E)|(3C736372697074)|(2F7363726970743E)/is", $hexs);
+        $result = preg_match("/(3c25.*?28.*?29.*?253e)|(3c3f.*?28.*?29.*?3f3e)|(3C534352495054)|(2F5343524950543E)|(3C736372697074)|(2F7363726970743E)/is", $hexs);
+        return $result === false || $result > 0;
     }
 }