mojiahui/webman-buildadmin-mall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.修复上传漏洞和SQL注入漏洞-增强登录验证功能

Browse Source
This commit is contained in:
zhenhui
2026-06-24 11:47:27 +08:00
parent 546d350f3a
commit 5187330c38
25 changed files with 303 additions and 1462 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/route.php
View File

@@ -99,9 +99,7 @@ Route::get('/admin/ajax/getDatabaseConnectionList', [\app\admin\controller\Ajax:
Route::get('/admin/ajax/getTablePk', [\app\admin\controller\Ajax::class, 'getTablePk']);
Route::get('/admin/ajax/getTableList', [\app\admin\controller\Ajax::class, 'getTableList']);
Route::get('/admin/ajax/getTableFieldList', [\app\admin\controller\Ajax::class, 'getTableFieldList']);
Route::post('/admin/ajax/changeTerminalConfig', [\app\admin\controller\Ajax::class, 'changeTerminalConfig']);
Route::post('/admin/ajax/clearCache', [\app\admin\controller\Ajax::class, 'clearCache']);
Route::add(['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD'], '/admin/ajax/terminal', [\app\admin\controller\Ajax::class, 'terminal']);
// admin/auth/admin
Route::get('/admin/auth/admin/index', [\app\admin\controller\auth\Admin::class, 'index']);

70
config/terminal.php
View File

@@ -1,70 +0,0 @@
<?php
// +----------------------------------------------------------------------
// | BuildAdmin - WEB终端配置
// | Webman 迁移：migrate 命令需根据实际迁移工具调整
// +----------------------------------------------------------------------
return [
'npm_package_manager' => 'pnpm',
'commands' => [
'migrate' => [
'run' => [
'cwd' => '',
'command' => 'php vendor/bin/phinx migrate',
'notes' => 'Start the database migration'
],
'rollback' => ['cwd' => '', 'command' => 'php vendor/bin/phinx rollback'],
'breakpoint' => ['cwd' => '', 'command' => 'php vendor/bin/phinx breakpoint'],
],
'version' => [
'npm' => 'npm -v',
'cnpm' => 'cnpm -v',
'yarn' => 'yarn -v',
'pnpm' => 'pnpm -v',
'node' => 'node -v',
],
'web-install' => [
'npm' => ['cwd' => 'web', 'command' => 'npm install'],
'cnpm' => ['cwd' => 'web', 'command' => 'cnpm install'],
'yarn' => ['cwd' => 'web', 'command' => 'yarn install'],
'pnpm' => ['cwd' => 'web', 'command' => 'pnpm install'],
'ni' => ['cwd' => 'web', 'command' => 'ni install'],
],
'nuxt-install' => [
'npm' => ['cwd' => 'web-nuxt', 'command' => 'npm install'],
'cnpm' => ['cwd' => 'web-nuxt', 'command' => 'cnpm install'],
'yarn' => ['cwd' => 'web-nuxt', 'command' => 'yarn install'],
'pnpm' => ['cwd' => 'web-nuxt', 'command' => 'pnpm install'],
'ni' => ['cwd' => 'web-nuxt', 'command' => 'ni install'],
],
'web-build' => [
'npm' => ['cwd' => 'web', 'command' => 'npm run build', 'notes' => 'Start executing the build command of the web project'],
'cnpm' => ['cwd' => 'web', 'command' => 'cnpm run build', 'notes' => 'Start executing the build command of the web project'],
'yarn' => ['cwd' => 'web', 'command' => 'yarn run build', 'notes' => 'Start executing the build command of the web project'],
'pnpm' => ['cwd' => 'web', 'command' => 'pnpm run build', 'notes' => 'Start executing the build command of the web project'],
'ni' => ['cwd' => 'web', 'command' => 'nr build', 'notes' => 'Start executing the build command of the web project'],
],
'set-npm-registry' => [
'npm' => 'npm config set registry https://registry.npmjs.org/ && npm config get registry',
'taobao' => 'npm config set registry https://registry.npmmirror.com/ && npm config get registry',
'tencent' => 'npm config set registry https://mirrors.cloud.tencent.com/npm/ && npm config get registry'
],
'set-composer-registry' => [
'composer' => 'composer config --unset repos.packagist',
'aliyun' => 'composer config -g repos.packagist composer https://mirrors.aliyun.com/composer/',
'tencent' => 'composer config -g repos.packagist composer https://mirrors.cloud.tencent.com/composer/',
'huawei' => 'composer config -g repos.packagist composer https://mirrors.huaweicloud.com/repository/php/',
'kkame' => 'composer config -g repos.packagist composer https://packagist.kr',
],
'npx' => [
'prettier' => ['cwd' => 'web', 'command' => 'npx prettier --write %s', 'notes' => 'Start formatting the web project code'],
],
'composer' => [
'update' => ['cwd' => '', 'command' => 'composer update --no-interaction', 'notes' => 'Start installing the composer dependencies']
],
'ping' => [
'baidu' => 'ping baidu.com',
'localhost' => 'ping 127.0.0.1 -n 6',
]
],
];

6
config/upload.php
View File

@@ -16,6 +16,10 @@ return [
* 2. 千万不要允许 php,php5,.htaccess,.user.ini 等可执行或配置文件
* 3. 允许 pdf,ppt,docx 等可能含有脚本的文件时，请先从服务器配置此类文件直接下载而不是预览
*/
'allowed_suffixes' => 'jpg,png,bmp,jpeg,gif,webp,zip,rar,wav,mp4,mp3',
'allowed_suffixes' => 'jpg,png,bmp,jpeg,gif,webp,wav,mp4,mp3',
'allowed_mime_types' => [],
// 禁止上传的后缀（含双后缀检测，如 shell.php.jpg）
'forbidden_suffixes' => 'php,php3,php4,php5,php7,php8,phtml,phar,htaccess,htpasswd,user.ini,asp,aspx,jsp,jspx,cgi,pl,sh,bat,cmd,exe,dll,vbs,ps1,com,shtml',
// 允许使用的上传驱动（禁止通过 driver 参数加载任意类）
'allowed_drivers' => 'local',
];