修复SelectPage排序安全问题

application/admin/command/Api.php

@@ -18,6 +18,7 @@ class Api extends Command
         $this
             ->setName('api')
             ->addOption('url', 'u', Option::VALUE_OPTIONAL, 'default api url', '')
+            ->addOption('cdnurl', 'd', Option::VALUE_OPTIONAL, 'default cdn url', '')
             ->addOption('module', 'm', Option::VALUE_OPTIONAL, 'module name(admin/index/api)', 'api')
             ->addOption('output', 'o', Option::VALUE_OPTIONAL, 'output index file name', 'api.html')
             ->addOption('template', 'e', Option::VALUE_OPTIONAL, '', 'index.html')
@@ -36,6 +37,7 @@ class Api extends Command
 
         $force = $input->getOption('force');
         $url = $input->getOption('url');
+        $cdnurl = $input->getOption('cdnurl');
         $language = $input->getOption('language');
         $template = $input->getOption('template');
         if (!preg_match("/^([a-z0-9]+)\.html\$/i", $template)) {
@@ -116,15 +118,19 @@ class Api extends Command
 
         $classes = array_unique(array_filter($classes));
 
+        $cdnurl = $cdnurl ? : Config::get('site.cdnurl');
+
         $config = [
             'sitename'    => config('site.name'),
             'title'       => $title,
             'author'      => config('site.name'),
             'description' => '',
             'apiurl'      => $url,
+            'cdnurl'      => $cdnurl,
             'language'    => $language,
         ];
 
+        Config::set('view_replace_str.__CDN__', $cdnurl);
         $builder = new Builder($classes);
         $content = $builder->render($template_file, ['config' => $config, 'lang' => $lang]);
 

application/admin/command/Api/template/index.html

@@ -8,16 +8,10 @@
         <title>{$config.title}</title>
 
         <!-- Bootstrap Core CSS -->
-        <link href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/twitter-bootstrap/3.4.1/css/bootstrap.min.css" rel="stylesheet">
+        <link href="{$config.cdnurl|default=''}/assets/libs/bootstrap/dist/css/bootstrap.min.css" rel="stylesheet">
 
         <!-- Plugin CSS -->
-        <link href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
-
-        <!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
-        <!--[if lt IE 9]>
-        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/html5shiv/3.7.3/html5shiv.min.js"></script>
-        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/respond.js/1.4.2/respond.min.js"></script>
-        <![endif]-->
+        <link href="{$config.cdnurl|default=''}/assets/libs/font-awesome/css/font-awesome.min.css" rel="stylesheet">
 
         <style type="text/css">
             body {
@@ -401,10 +395,10 @@
         </div> <!-- /container -->
 
         <!-- jQuery -->
-        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/jquery/3.6.0/jquery.min.js"></script>
+        <script src="{$config.cdnurl|default=''}/assets/libs/jquery/dist/jquery.min.js"></script>
 
         <!-- Bootstrap Core JavaScript -->
-        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/twitter-bootstrap/3.4.1/js/bootstrap.min.js"></script>
+        <script src="{$config.cdnurl|default=''}/assets/libs/bootstrap/dist/js/bootstrap.min.js"></script>
 
         <script type="text/javascript">
             function syntaxHighlight(json) {

application/common/controller/Backend.php

@@ -552,7 +552,7 @@ class Backend extends Controller
                 $primaryvalue = array_unique(is_array($primaryvalue) ? $primaryvalue : explode(',', $primaryvalue));
                 //修复自定义data-primary-key为字符串内容时，给排序字段添加上引号
                 $primaryvalue = array_map(function ($value) {
-                    return '\'' . $value . '\'';
+                    return \think\Db::quote($value);
                 }, $primaryvalue);
 
                 $primaryvalue = implode(',', $primaryvalue);