From 6ab37ef8b79023751a73227c86e02c00b2190433 Mon Sep 17 00:00:00 2001 From: Karson Date: Tue, 2 Jun 2026 15:59:15 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96=E9=80=80=E5=87=BA=E9=80=BB?= =?UTF-8?q?=E8=BE=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- application/admin/controller/Index.php | 7 +++++++ application/admin/view/index/logout.html | 11 ++++++----- application/index/controller/User.php | 11 ++++++----- application/index/view/user/logout.html | 2 +- 4 files changed, 20 insertions(+), 11 deletions(-) diff --git a/application/admin/controller/Index.php b/application/admin/controller/Index.php index 8188197b..2d7e13ec 100644 --- a/application/admin/controller/Index.php +++ b/application/admin/controller/Index.php @@ -127,7 +127,14 @@ class Index extends Backend */ public function logout() { + if ($this->request->isPost()) { + // 加强校验referer是否来自服务器 + $referer = $this->request->server('HTTP_REFERER'); + if (!$referer || strtolower(parse_url($referer, PHP_URL_HOST)) != strtolower($this->request->host())) { + $this->error(__('Invalid request')); + } + $this->token(); $this->auth->logout(); Hook::listen("admin_logout_after", $this->request); diff --git a/application/admin/view/index/logout.html b/application/admin/view/index/logout.html index febbe4de..f42c25fe 100644 --- a/application/admin/view/index/logout.html +++ b/application/admin/view/index/logout.html @@ -2,6 +2,7 @@ {include file="common/meta" /} + @@ -38,7 +39,7 @@ {:token()}
- +
diff --git a/application/index/controller/User.php b/application/index/controller/User.php index be2b02b0..73df23d6 100644 --- a/application/index/controller/User.php +++ b/application/index/controller/User.php @@ -195,13 +195,14 @@ class User extends Frontend */ public function logout() { - // 加强校验referer是否来自服务器 - $referer = $this->request->server('HTTP_REFERER'); - if (!$referer || strtolower(parse_url($referer, PHP_URL_HOST)) != strtolower($this->request->host())) { - $this->error(__('Invalid request')); - } if ($this->request->isPost()) { + // 加强校验referer是否来自服务器 + $referer = $this->request->server('HTTP_REFERER'); + if (!$referer || strtolower(parse_url($referer, PHP_URL_HOST)) != strtolower($this->request->host())) { + $this->error(__('Invalid request')); + } + $this->token(); //退出本站 $this->auth->logout(); diff --git a/application/index/view/user/logout.html b/application/index/view/user/logout.html index d4299a5f..0f16f42e 100644 --- a/application/index/view/user/logout.html +++ b/application/index/view/user/logout.html @@ -9,7 +9,7 @@ {:token()}
- +