1.修复上传漏洞和SQL注入漏洞

app/admin/controller/Module.php

@@ -131,12 +131,23 @@ class Module extends Backend
         if ($response !== null) return $response;
 
         AdminLog::instance($request)->setTitle(__('Upload module'));
-        $file = $request->file('file');
-        if (!$file) {
-            return $this->error(__('Parameter error'));
+
+        $token = $request->post('token', $request->get('token', ''));
+        if (!$token) {
+            return $this->error(__('Please login to the official website account first'));
         }
+
         try {
-            $res = Manage::uploadFromRequest($request);
+            if ($request->file('file')) {
+                $res = Manage::uploadFromRequest($request);
+            } else {
+                $file = $request->post('file', $request->get('file', ''));
+                if (!$file) {
+                    return $this->error(__('Parameter error'));
+                }
+                $info = Manage::instance('')->doUpload($token, $file);
+                $res  = ['info' => $info];
+            }
         } catch (BaException $e) {
             return $this->error(__($e->getMessage()), $e->getData(), $e->getCode());
         } catch (\Throwable $e) {