mojiahui/webman-buildadmin-mall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.修复上传漏洞和SQL注入漏洞

Browse Source
This commit is contained in:
zhenhui
2026-06-24 09:59:58 +08:00
parent 8c5b1d212a
commit aa5bda04ad
9 changed files with 147 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
config/route.php
View File

@@ -10,12 +10,9 @@ use support\Response;
// ==================== 未安装时根路径重定向（迁移自 public/index.php） ====================
// 当 install.lock 不存在或未完成安装时，访问 / 或 /index.html 重定向到安装页
$installLockFile = public_path('install.lock');
$installCompleteMark = 'install-end';
$installPageFile = public_path('install/index.html');
Route::get('/', function () use ($installLockFile, $installCompleteMark, $installPageFile) {
$needRedirect = is_file($installPageFile)
&& (!is_file($installLockFile) || @file_get_contents($installLockFile) !== $installCompleteMark);
Route::get('/', function () use ($installPageFile) {
$needRedirect = is_file($installPageFile) && !is_system_installed();
if ($needRedirect) {
return new Response(302, ['Location' => '/install/']);
}
@@ -24,9 +21,8 @@ Route::get('/', function () use ($installLockFile, $installCompleteMark, $instal
}
return new Response(404, [], 'Not Found');
});
Route::get('/index.html', function () use ($installLockFile, $installCompleteMark, $installPageFile) {
$needRedirect = is_file($installPageFile)
&& (!is_file($installLockFile) || @file_get_contents($installLockFile) !== $installCompleteMark);
Route::get('/index.html', function () use ($installPageFile) {
$needRedirect = is_file($installPageFile) && !is_system_installed();
if ($needRedirect) {
return new Response(302, ['Location' => '/install/']);
}
@@ -36,26 +32,24 @@ Route::get('/index.html', function () use ($installLockFile, $installCompleteMar
// ==================== 安装向导（静态页） ====================
// 已安装时访问 /install 重定向到应用，访问提示仅在终端显示
$installLockFileForInstall = public_path('install.lock');
$installCompleteMarkForInstall = 'install-end';
Route::get('/install', function () use ($installLockFileForInstall, $installCompleteMarkForInstall) {
$installed = is_file($installLockFileForInstall) && @file_get_contents($installLockFileForInstall) === $installCompleteMarkForInstall;
Route::get('/install', function () {
$installed = is_system_installed();
if ($installed && is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
$file = public_path('install/index.html');
return is_file($file) ? (new Response())->file($file) : new Response(404, [], 'Install page not found');
});
Route::get('/install/', function () use ($installLockFileForInstall, $installCompleteMarkForInstall) {
$installed = is_file($installLockFileForInstall) && @file_get_contents($installLockFileForInstall) === $installCompleteMarkForInstall;
Route::get('/install/', function () {
$installed = is_system_installed();
if ($installed && is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
$file = public_path('install/index.html');
return is_file($file) ? (new Response())->file($file) : new Response(404, [], 'Install page not found');
});
Route::get('/install/index', function () use ($installLockFileForInstall, $installCompleteMarkForInstall) {
$installed = is_file($installLockFileForInstall) && @file_get_contents($installLockFileForInstall) === $installCompleteMarkForInstall;
Route::get('/install/index', function () {
$installed = is_system_installed();
if ($installed && is_file(public_path('index.html'))) {
return new Response(302, ['Location' => '/index.html']);
}
@@ -72,17 +66,19 @@ Route::get('/api/index/index', [\app\api\controller\Index::class, 'index']);
Route::add(['GET', 'POST'], '/api/user/checkIn', [\app\api\controller\User::class, 'checkIn']);
Route::post('/api/user/logout', [\app\api\controller\User::class, 'logout']);
// api/install（安装流程多为 POST）
Route::add(['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD'], '/api/install/terminal', [\app\api\controller\Install::class, 'terminal']);
Route::post('/api/install/changePackageManager', [\app\api\controller\Install::class, 'changePackageManager']);
Route::get('/api/install/envBaseCheck', [\app\api\controller\Install::class, 'envBaseCheck']);
Route::add(['GET', 'POST'], '/api/install/envNpmCheck', [\app\api\controller\Install::class, 'envNpmCheck']);
Route::post('/api/install/testDatabase', [\app\api\controller\Install::class, 'testDatabase']);
Route::add(['GET', 'POST'], '/api/install/baseConfig', [\app\api\controller\Install::class, 'baseConfig']);
Route::get('/api/install/accessUrls', [\app\api\controller\Install::class, 'accessUrls']);
Route::post('/api/install/commandExecComplete', [\app\api\controller\Install::class, 'commandExecComplete']);
Route::post('/api/install/manualInstall', [\app\api\controller\Install::class, 'manualInstall']);
Route::post('/api/install/mvDist', [\app\api\controller\Install::class, 'mvDist']);
// api/install（安装流程多为 POST；已安装系统由 InstallGuard 拦截）
Route::group('/api/install', function () {
Route::add(['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD'], '/terminal', [\app\api\controller\Install::class, 'terminal']);
Route::post('/changePackageManager', [\app\api\controller\Install::class, 'changePackageManager']);
Route::get('/envBaseCheck', [\app\api\controller\Install::class, 'envBaseCheck']);
Route::add(['GET', 'POST'], '/envNpmCheck', [\app\api\controller\Install::class, 'envNpmCheck']);
Route::post('/testDatabase', [\app\api\controller\Install::class, 'testDatabase']);
Route::add(['GET', 'POST'], '/baseConfig', [\app\api\controller\Install::class, 'baseConfig']);
Route::get('/accessUrls', [\app\api\controller\Install::class, 'accessUrls']);
Route::post('/commandExecComplete', [\app\api\controller\Install::class, 'commandExecComplete']);
Route::post('/manualInstall', [\app\api\controller\Install::class, 'manualInstall']);
Route::post('/mvDist', [\app\api\controller\Install::class, 'mvDist']);
})->middleware([\app\common\middleware\InstallGuard::class]);
// api/common
Route::get('/api/common/captcha', [\app\api\controller\Common::class, 'captcha']);