From b8c2c00b85f0e91ad8b59793334b842cc8748e9e Mon Sep 17 00:00:00 2001
From: Anyon <zoujingli@qq.com>
Date: Fri, 31 Dec 2021 12:26:20 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E6=8E=A5=E5=8F=A3=E5=9B=BE?=
 =?UTF-8?q?=E7=89=87=E5=AE=89=E5=85=A8=E5=A4=84=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/data/controller/api/auth/Center.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/app/data/controller/api/auth/Center.php b/app/data/controller/api/auth/Center.php
index dceeb4303..fdf499696 100644
--- a/app/data/controller/api/auth/Center.php
+++ b/app/data/controller/api/auth/Center.php
@@ -57,6 +57,9 @@ class Center extends Auth
             $data = $this->_vali(['base64.require' => '图片内容不为空！']);
             if (preg_match('|^data:image/(.*?);base64,|i', $data['base64'])) {
                 [$ext, $img] = explode('|||', preg_replace('|^data:image/(.*?);base64,|i', '$1|||', $data['base64']));
+                if (!in_array(strtolower($ext), ['png', 'jpg', 'jpeg'])) {
+                    $this->error('图片格式异常！');
+                }
                 $info = Storage::instance()->set(Storage::name($img, $ext ?: 'png', 'image/'), base64_decode($img));
                 $this->success('图片上传成功！', ['url' => $info['url']]);
             } else {