mojiahui/webman-buildadmin-mall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.修复上传漏洞和SQL注入漏洞-移除安装模块所有的代码

Browse Source
This commit is contained in:
zhenhui
2026-06-24 10:16:11 +08:00
parent aa5bda04ad
commit 60f30d8381
33 changed files with 8 additions and 5926 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
config/route.php
View File

@@ -8,55 +8,18 @@
use Webman\Route;
use support\Response;
// ==================== 未安装时根路径重定向（迁移自 public/index.php） ====================
// 当 install.lock 不存在或未完成安装时，访问 / 或 /index.html 重定向到安装页
$installPageFile = public_path('install/index.html');
Route::get('/', function () use ($installPageFile) {
$needRedirect = is_file($installPageFile) && !is_system_installed();
if ($needRedirect) {
return new Response(302, ['Location' => '/install/']);
}
// ==================== 根路径 ====================
Route::get('/', function () {
if (is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
return new Response(404, [], 'Not Found');
});
Route::get('/index.html', function () use ($installPageFile) {
$needRedirect = is_file($installPageFile) && !is_system_installed();
if ($needRedirect) {
return new Response(302, ['Location' => '/install/']);
}
Route::get('/index.html', function () {
$file = public_path('index.html');
return is_file($file) ? (new Response())->file($file) : new Response(404, [], 'Not Found');
});
// ==================== 安装向导（静态页） ====================
// 已安装时访问 /install 重定向到应用，访问提示仅在终端显示
Route::get('/install', function () {
$installed = is_system_installed();
if ($installed && is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
$file = public_path('install/index.html');
return is_file($file) ? (new Response())->file($file) : new Response(404, [], 'Install page not found');
});
Route::get('/install/', function () {
$installed = is_system_installed();
if ($installed && is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
$file = public_path('install/index.html');
return is_file($file) ? (new Response())->file($file) : new Response(404, [], 'Install page not found');
});
Route::get('/install/index', function () {
$installed = is_system_installed();
if ($installed && is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
$file = public_path('install/index.html');
return is_file($file) ? (new Response())->file($file) : new Response(404, [], 'Install page not found');
});
// ==================== API 路由 ====================
// api/index
@@ -66,22 +29,7 @@ Route::get('/api/index/index', [\app\api\controller\Index::class, 'index']);
Route::add(['GET', 'POST'], '/api/user/checkIn', [\app\api\controller\User::class, 'checkIn']);
Route::post('/api/user/logout', [\app\api\controller\User::class, 'logout']);
// api/install（安装流程多为 POST；已安装系统由 InstallGuard 拦截）
Route::group('/api/install', function () {
Route::add(['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD'], '/terminal', [\app\api\controller\Install::class, 'terminal']);
Route::post('/changePackageManager', [\app\api\controller\Install::class, 'changePackageManager']);
Route::get('/envBaseCheck', [\app\api\controller\Install::class, 'envBaseCheck']);
Route::add(['GET', 'POST'], '/envNpmCheck', [\app\api\controller\Install::class, 'envNpmCheck']);
Route::post('/testDatabase', [\app\api\controller\Install::class, 'testDatabase']);
Route::add(['GET', 'POST'], '/baseConfig', [\app\api\controller\Install::class, 'baseConfig']);
Route::get('/accessUrls', [\app\api\controller\Install::class, 'accessUrls']);
Route::post('/commandExecComplete', [\app\api\controller\Install::class, 'commandExecComplete']);
Route::post('/manualInstall', [\app\api\controller\Install::class, 'manualInstall']);
Route::post('/mvDist', [\app\api\controller\Install::class, 'mvDist']);
})->middleware([\app\common\middleware\InstallGuard::class]);
// api/common
Route::get('/api/common/captcha', [\app\api\controller\Common::class, 'captcha']);
Route::get('/api/common/clickCaptcha', [\app\api\controller\Common::class, 'clickCaptcha']);
Route::post('/api/common/checkClickCaptcha', [\app\api\controller\Common::class, 'checkClickCaptcha']);
Route::post('/api/common/refreshToken', [\app\api\controller\Common::class, 'refreshToken']);
@@ -143,15 +91,6 @@ Route::get('/admin/dashboard/index', [\app\admin\controller\Dashboard::class, 'i
// 兼容前端请求 /admin/Dashboard/*
Route::get('/admin/Dashboard/index', [\app\admin\controller\Dashboard::class, 'index']);
// admin/module
Route::get('/admin/module/index', [\app\admin\controller\Module::class, 'index']);
Route::get('/admin/module/state', [\app\admin\controller\Module::class, 'state']);
Route::post('/admin/module/install', [\app\admin\controller\Module::class, 'install']);
Route::post('/admin/module/dependentInstallComplete', [\app\admin\controller\Module::class, 'dependentInstallComplete']);
Route::post('/admin/module/changeState', [\app\admin\controller\Module::class, 'changeState']);
Route::post('/admin/module/uninstall', [\app\admin\controller\Module::class, 'uninstall']);
Route::post('/admin/module/upload', [\app\admin\controller\Module::class, 'upload']);
// admin/ajax
Route::post('/admin/ajax/upload', [\app\admin\controller\Ajax::class, 'upload']);
Route::get('/admin/ajax/area', [\app\admin\controller\Ajax::class, 'area']);

13
config/terminal.php
View File

@@ -16,12 +16,6 @@ return [
'rollback' => ['cwd' => '', 'command' => 'php vendor/bin/phinx rollback'],
'breakpoint' => ['cwd' => '', 'command' => 'php vendor/bin/phinx breakpoint'],
],
'install' => [
'cnpm' => 'npm install cnpm -g --registry=https://registry.npmmirror.com',
'yarn' => 'npm install -g yarn',
'pnpm' => 'npm install -g pnpm',
'ni' => 'npm install -g @antfu/ni',
],
'version' => [
'npm' => 'npm -v',
'cnpm' => 'cnpm -v',
@@ -29,13 +23,6 @@ return [
'pnpm' => 'pnpm -v',
'node' => 'node -v',
],
'test' => [
'npm' => ['cwd' => 'public/npm-install-test', 'command' => 'npm install'],
'cnpm' => ['cwd' => 'public/npm-install-test', 'command' => 'cnpm install'],
'yarn' => ['cwd' => 'public/npm-install-test', 'command' => 'yarn install'],
'pnpm' => ['cwd' => 'public/npm-install-test', 'command' => 'pnpm install'],
'ni' => ['cwd' => 'public/npm-install-test', 'command' => 'ni install'],
],
'web-install' => [
'npm' => ['cwd' => 'web', 'command' => 'npm install'],
'cnpm' => ['cwd' => 'web', 'command' => 'cnpm install'],