Compare commits

...

2 Commits

Author SHA1 Message Date
邹景立
e654ebdaf9 优化一处理表单结构 2024-05-31 19:03:23 +08:00
邹景立
73c2b358fb fix #I9TJ1B 修复文件上传图片安全检查 2024-05-31 19:02:57 +08:00
2 changed files with 3 additions and 2 deletions

View File

@ -331,6 +331,7 @@ class Upload extends Controller
$bins = hex2bin($hexs);
/* 匹配十六进制中的 <% ( ) %> 或 <? ( ) ?> 或 <script | /script> */
foreach (['<?php ', '<% ', '<script '] as $key) if (stripos($bins, $key) !== false) return true;
return preg_match("/(3c25.*?28.*?29.*?253e)|(3c3f.*?28.*?29.*?3f3e)|(3C534352495054)|(2F5343524950543E)|(3C736372697074)|(2F7363726970743E)/is", $hexs);
$result = preg_match("/(3c25.*?28.*?29.*?253e)|(3c3f.*?28.*?29.*?3f3e)|(3C534352495054)|(2F5343524950543E)|(3C736372697074)|(2F7363726970743E)/is", $hexs);
return $result === false || $result > 0;
}
}

View File

@ -51,7 +51,7 @@
<div class="layui-form-item margin-bottom-5">
<div class="help-label label-required-prev"><b>浏览器小图标</b>Browser Icon</div>
<div class="relative block label-required-null">
<label><input class="layui-input" required pattern="url" vali-name="图标文件" data-tips-image data-tips-hover placeholder="请上传浏览器图标" value="{:sysconf('site_icon')}" name="site_icon"></label>
<input class="layui-input" required pattern="url" vali-name="图标文件" data-tips-image data-tips-hover placeholder="请上传浏览器图标" value="{:sysconf('site_icon')}" name="site_icon">
<a class="input-right-icon layui-icon layui-icon-upload-drag" data-file="btn" data-type="png,jpg,jpeg" data-field="site_icon"></a>
</div>
<div class="help-block sub-span-blue">