1.修复上传漏洞和SQL注入漏洞

app/admin/controller/Ajax.php

@@ -17,7 +17,6 @@ use support\Response;
 class Ajax extends Backend
 {
     protected array $noNeedPermission = ['*'];
-    protected array $noNeedLogin = ['terminal'];
 
     public function upload(Request $request): Response
     {

app/admin/controller/Module.php

@@ -131,12 +131,23 @@ class Module extends Backend
         if ($response !== null) return $response;
 
         AdminLog::instance($request)->setTitle(__('Upload module'));
-        $file = $request->file('file');
-        if (!$file) {
-            return $this->error(__('Parameter error'));
+
+        $token = $request->post('token', $request->get('token', ''));
+        if (!$token) {
+            return $this->error(__('Please login to the official website account first'));
         }
+
         try {
-            $res = Manage::uploadFromRequest($request);
+            if ($request->file('file')) {
+                $res = Manage::uploadFromRequest($request);
+            } else {
+                $file = $request->post('file', $request->get('file', ''));
+                if (!$file) {
+                    return $this->error(__('Parameter error'));
+                }
+                $info = Manage::instance('')->doUpload($token, $file);
+                $res  = ['info' => $info];
+            }
         } catch (BaException $e) {
             return $this->error(__($e->getMessage()), $e->getData(), $e->getCode());
         } catch (\Throwable $e) {

app/admin/controller/crud/Crud.php

@@ -30,7 +30,6 @@ class Crud extends Backend
     protected string $webTranslate = '';
     protected array $langTsData = [];
     protected array $dtStringToArray = ['checkbox', 'selects', 'remoteSelects', 'city', 'images', 'files'];
-    protected array $noNeedLogin = ['getFileData'];
     protected array $noNeedPermission = ['logStart', 'getFileData', 'parseFieldData', 'generateCheck', 'uploadCompleted'];
 
     protected function initController(Request $request): ?Response