From 84eef812f381df4204e70926dfda6e8520cc6f22 Mon Sep 17 00:00:00 2001 From: Karson Date: Mon, 11 Oct 2021 17:16:48 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E4=B8=8A=E4=BC=A0=E6=96=87?= =?UTF-8?q?=E4=BB=B6=E7=9A=84=E5=AE=89=E5=85=A8=E9=9A=90=E6=82=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- application/common/library/Upload.php | 8 ++++++-- application/config.php | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/application/common/library/Upload.php b/application/common/library/Upload.php index 66afc1dc..3cb93a44 100644 --- a/application/common/library/Upload.php +++ b/application/common/library/Upload.php @@ -82,7 +82,7 @@ class Upload protected function checkExecutable() { //禁止上传PHP和HTML文件 - if (in_array($this->fileInfo['type'], ['text/x-php', 'text/html']) || in_array($this->fileInfo['suffix'], ['php', 'html', 'htm'])) { + if (in_array($this->fileInfo['type'], ['text/x-php', 'text/html']) || in_array($this->fileInfo['suffix'], ['php', 'html', 'htm', 'phar', 'phtml']) || preg_match("/^php(.*)/i", $this->fileInfo['suffix'])) { throw new UploadException(__('Uploaded file format is limited')); } return true; @@ -92,10 +92,14 @@ class Upload { $mimetypeArr = explode(',', strtolower($this->config['mimetype'])); $typeArr = explode('/', $this->fileInfo['type']); + //Mimetype值不正确 + if (stripos($this->fileInfo['type'], '/') === false) { + throw new UploadException(__('Uploaded file format is limited')); + } //验证文件后缀 if ($this->config['mimetype'] === '*' || in_array($this->fileInfo['suffix'], $mimetypeArr) || in_array('.' . $this->fileInfo['suffix'], $mimetypeArr) - || in_array($this->fileInfo['type'], $mimetypeArr) || in_array($typeArr[0] . "/*", $mimetypeArr)) { + || in_array($typeArr[0] . "/*", $mimetypeArr) || (in_array($this->fileInfo['type'], $mimetypeArr) && stripos($this->fileInfo['type'], '/') !== false)) { return true; } throw new UploadException(__('Uploaded file format is limited')); diff --git a/application/config.php b/application/config.php index 1998b1f7..be86fd01 100755 --- a/application/config.php +++ b/application/config.php @@ -292,7 +292,7 @@ return [ //允许跨域的域名,多个以,分隔 'cors_request_domain' => 'localhost,127.0.0.1', //版本号 - 'version' => '1.2.1.20210730_beta', + 'version' => '1.2.1.20211011_beta', //API接口地址 'api_url' => 'https://api.fastadmin.net', ],