更新版本号

打包JS

.bowerrc

@@ -7,5 +7,8 @@
     "jspdf",
     "jspdf-autotable",
     "pdfmake"
-  ]
+  ],
+  "scripts":{
+    "postinstall": "node bower-cleanup.js"
+  }
 }

.gitignore

@@ -6,6 +6,7 @@
 /public/assets/libs/
 /public/assets/addons/*
 /public/uploads/*
+.DS_Store
 .idea
 composer.lock
 *.log

.npmrc

@@ -0,0 +1,4 @@
+# 使用自定义镜像源
+registry=http://mirrors.tencent.com/npm/
+#关闭SSL验证
+strict-ssl=false

Gruntfile.js

@@ -0,0 +1,139 @@
+module.exports = function (grunt) {
+
+    grunt.initConfig({
+        pkg: grunt.file.readJSON('package.json'),
+        copy: {
+            main: {
+                files: []
+            }
+        }
+    });
+
+    var build = function (module, type, callback) {
+        var config = {
+            compile: {
+                options: type === 'js' ? {
+                    optimizeCss: "standard",
+                    optimize: "uglify",   //可使用uglify|closure|none
+                    preserveLicenseComments: true,
+                    removeCombined: false,
+                    baseUrl: "./public/assets/js/",    //JS文件所在的基础目录
+                    name: "require-" + module, //来源文件,不包含后缀
+                    out: "./public/assets/js/require-" + module + ".min.js"  //目标文件
+                } : {
+                    optimizeCss: "default",
+                    optimize: "uglify",   //可使用uglify|closure|none
+                    cssIn: "./public/assets/css/" + module + ".css",    //CSS文件所在的基础目录
+                    out: "./public/assets/css/" + module + ".min.css"  //目标文件
+                }
+            }
+        };
+
+
+        var content = grunt.file.read("./public/assets/js/require-" + module + ".js"),
+            pattern = /^require\.config\(\{[\r\n]?[\n]?(.*?)[\r\n]?[\n]?}\);/is;
+
+        var matches = content.match(pattern);
+        if (matches) {
+            if (type === 'js') {
+                var data = matches[1].replaceAll(/(urlArgs|baseUrl):(.*)\n/gi, '');
+                const parse = require('parse-config-file'), fs = require('fs');
+                require('jsonminify');
+
+                data = JSON.minify("{\n" + data + "\n}");
+                let options = parse(data);
+                options.paths.tableexport = "empty:";
+                Object.assign(config.compile.options, options);
+            }
+            let requirejs = require("./application/admin/command/Min/r");
+
+            try {
+                requirejs.optimize(config.compile.options, function (buildResponse) {
+                    // var contents = require('fs').readFileSync(config.compile.options.out, 'utf8');
+                    callback();
+                }, function (err) {
+                    console.error(err);
+                    callback();
+                });
+            } catch (err) {
+                console.error(err);
+                callback();
+            }
+        }
+    };
+
+    // 加载 "copy" 插件
+    grunt.loadNpmTasks('grunt-contrib-copy');
+
+    grunt.registerTask('frontend:js', 'build frontend js', function () {
+        var done = this.async();
+        build('frontend', 'js', done);
+    });
+
+    grunt.registerTask('backend:js', 'build backend js', function () {
+        var done = this.async();
+        build('backend', 'js', done);
+    });
+
+    grunt.registerTask('frontend:css', 'build frontend css', function () {
+        var done = this.async();
+        build('frontend', 'css', done);
+    });
+
+    grunt.registerTask('backend:css', 'build frontend css', function () {
+        var done = this.async();
+        build('backend', 'css', done);
+    });
+
+    // 注册部署JS和CSS任务
+    grunt.registerTask('deploy', 'deploy', function () {
+        const fs = require('fs');
+        const path = require("path")
+        const nodeModulesDir = path.resolve(__dirname, "./node_modules");
+
+        const getAllFiles = function (dirPath, arrayOfFiles) {
+            files = fs.readdirSync(dirPath)
+
+            arrayOfFiles = arrayOfFiles || []
+
+            files.forEach(function (file) {
+                if (fs.statSync(dirPath + "/" + file).isDirectory()) {
+                    arrayOfFiles = getAllFiles(dirPath + "/" + file, arrayOfFiles)
+                } else {
+                    arrayOfFiles.push(path.join(__dirname, dirPath, "/", file))
+                }
+            });
+
+            return arrayOfFiles
+        };
+        const mainPackage = grunt.config.get('pkg');
+        let dists = mainPackage.dists || [];
+        let files = [];
+
+        // 兼容旧版本bower使用的目录
+        let specialKey = {
+            'fastadmin-bootstraptable': 'bootstrap-table',
+            'sortablejs': 'Sortable',
+            'tableexport.jquery.plugin': 'tableExport.jquery.plugin',
+        };
+        Object.keys(dists).forEach(key => {
+            let src = ["**/*LICENSE*", "**/*license*"];
+            src = src.concat(Array.isArray(dists[key]) ? dists[key] : [dists[key]]);
+            files.push({expand: true, cwd: nodeModulesDir + "/" + key, src: src, dest: 'public/assets/libs/' + (specialKey[key] || key) + "/"});
+        });
+
+        // 兼容bower历史路径文件
+        files = [...files,
+            {src: nodeModulesDir + "/toastr/build/toastr.min.css", dest: "public/assets/libs/toastr/toastr.min.css"},
+            {src: nodeModulesDir + "/bootstrap-slider/dist/css/bootstrap-slider.css", dest: "public/assets/libs/bootstrap-slider/slider.css"},
+            {expand: true, cwd: nodeModulesDir + "/bootstrap-slider/dist", src: ["*.js"], dest: "public/assets/libs/bootstrap-slider/"}
+        ]
+
+        grunt.config.set('copy.main.files', files);
+        grunt.task.run("copy:main");
+    });
+
+    // 注册默认任务
+    grunt.registerTask('default', ['deploy', 'frontend:js', 'backend:js', 'frontend:css', 'backend:css']);
+
+};

README.md

@@ -55,9 +55,9 @@ https://demo.fastadmin.net
 
 问答社区: https://ask.fastadmin.net
 
-Github: https://github.com/karsonzhang/fastadmin
+Github: https://github.com/fastadminnet/fastadmin
 
-Gitee: https://gitee.com/karson/fastadmin
+Gitee: https://gitee.com/fastadminnet/fastadmin
 
 ## 特别鸣谢
 

application/admin/command/Addon.php

@@ -201,16 +201,20 @@ class Addon extends Command
                     new \RecursiveDirectoryIterator($addonDir), \RecursiveIteratorIterator::LEAVES_ONLY
                 );
 
+                $addonDir = str_replace(DS, '/', $addonDir);
+                $excludeDirRegex = "/\/(\.git|\.svn|\.vscode|\.idea|unpackage)\//i";
                 foreach ($files as $name => $file) {
-                    if (!$file->isDir()) {
+                    $filePath = str_replace(DS, '/', $file->getPathname());
-                        $filePath = $file->getRealPath();
+                    if ($file->isDir() || preg_match($excludeDirRegex, $filePath))
-                        $relativePath = str_replace(DS, '/', substr($filePath, strlen($addonDir)));
+                        continue;
-                        if (!in_array($file->getFilename(), ['.git', '.DS_Store', 'Thumbs.db'])) {
+                    $relativePath = substr($filePath, strlen($addonDir));
-                            $zip->addFile($filePath, $relativePath);
+                    if (!in_array($file->getFilename(), ['.DS_Store', 'Thumbs.db'])) {
-                        }
+                        $zip->addFile($filePath, $relativePath);
                     }
                 }
+
                 $zip->close();
+                $output->info("Package Resource Path:" . $addonFile);
                 $output->info("Package Successed!");
                 break;
             case 'move':

application/admin/command/Api.php

@@ -18,8 +18,9 @@ class Api extends Command
         $this
             ->setName('api')
             ->addOption('url', 'u', Option::VALUE_OPTIONAL, 'default api url', '')
-            ->addOption('module', 'm', Option::VALUE_OPTIONAL, 'module name(admin/index/api)', 'api')
+            ->addOption('cdnurl', 'd', Option::VALUE_OPTIONAL, 'default cdn url', '')
-            ->addOption('output', 'o', Option::VALUE_OPTIONAL, 'output index file name', 'api.html')
+            ->addOption('module', 'm', Option::VALUE_OPTIONAL, 'module name(index/api)', 'api')
+            ->addOption('output', 'o', Option::VALUE_OPTIONAL, 'output index file name', '')
             ->addOption('template', 'e', Option::VALUE_OPTIONAL, '', 'index.html')
             ->addOption('force', 'f', Option::VALUE_OPTIONAL, 'force override general file', false)
             ->addOption('title', 't', Option::VALUE_OPTIONAL, 'document title', $site['name'] ?? '')
@@ -36,27 +37,36 @@ class Api extends Command
 
         $force = $input->getOption('force');
         $url = $input->getOption('url');
+        $cdnurl = $input->getOption('cdnurl');
         $language = $input->getOption('language');
         $template = $input->getOption('template');
         if (!preg_match("/^([a-z0-9]+)\.html\$/i", $template)) {
             throw new Exception('template file not correct');
         }
-        $language = $language ? $language : 'zh-cn';
+        $language = $language ?: 'zh-cn';
         $langFile = $apiDir . 'lang' . DS . $language . '.php';
         if (!is_file($langFile)) {
             throw new Exception('language file not found');
         }
         $lang = include_once $langFile;
+
         // 目标目录
-        $output_dir = ROOT_PATH . 'public' . DS;
+        $outputDir = ROOT_PATH . 'runtime' . DS . 'docs' . DS;
-        $output_file = $output_dir . $input->getOption('output');
+        if (!is_dir($outputDir)) {
-        if (is_file($output_file) && !$force) {
+            mkdir($outputDir, 0755, true);
+        }
+        $outputFilename = $input->getOption('output') ?: 'doc_' . date('Ymd_') . strtolower(\fast\Random::alnum(6)) . '.html';
+        if ($outputFilename === 'api.html') {
+            throw new Exception('api.html cannot be used as the output file name');
+        }
+        $outputFile = $outputDir . $outputFilename;
+        if (is_file($outputFile) && !$force) {
             throw new Exception("api index file already exists!\nIf you need to rebuild again, use the parameter --force=true ");
         }
         // 模板文件
-        $template_dir = $apiDir . 'template' . DS;
+        $templateDir = $apiDir . 'template' . DS;
-        $template_file = $template_dir . $template;
+        $templateFile = $templateDir . $template;
-        if (!is_file($template_file)) {
+        if (!is_file($templateFile)) {
             throw new Exception('template file not found');
         }
         // 额外的类
@@ -68,7 +78,6 @@ class Api extends Command
         // 插件
         $addon = $input->getOption('addon');
 
-        $moduleDir = $addonDir = '';
         if ($addon) {
             $addonInfo = get_addon_info($addon);
             if (!$addonInfo) {
@@ -81,9 +90,12 @@ class Api extends Command
         if (!is_dir($moduleDir)) {
             throw new Exception('module not found');
         }
+        if (in_array($module, ['admin', 'common'])) {
+            throw new Exception('module not allowed');
+        }
 
-        if (version_compare(PHP_VERSION, '7.0.0', '<')) {
+        if (version_compare(PHP_VERSION, '7.4.0', '<')) {
-            throw new Exception("Requires PHP version 7.0 or newer");
+            throw new Exception("Requires PHP version 7.4 or newer");
         }
 
         //控制器名
@@ -98,34 +110,45 @@ class Api extends Command
             foreach ($files as $name => $file) {
                 if (!$file->isDir() && $file->getExtension() == 'php') {
                     $filePath = $file->getRealPath();
-                    $classes[] = $this->getClassFromFile($filePath);
+                    $className = $this->getClassFromFile($filePath);
+                    if ($className) {
+                        $classes[] = $className;
+                    }
                 }
             }
         } else {
             foreach ($controller as $index => $item) {
                 $filePath = $moduleDir . Config::get('url_controller_layer') . DS . $item . '.php';
-                $classes[] = $this->getClassFromFile($filePath);
+                $className = $this->getClassFromFile($filePath);
+                if ($className) {
+                    $classes[] = $className;
+                }
             }
         }
 
         $classes = array_unique(array_filter($classes));
 
+        $cdnurl = $cdnurl ?: Config::get('site.cdnurl');
+
         $config = [
             'sitename'    => config('site.name'),
             'title'       => $title,
             'author'      => config('site.name'),
             'description' => '',
             'apiurl'      => $url,
+            'cdnurl'      => $cdnurl,
             'language'    => $language,
         ];
 
+        Config::set('view_replace_str.__CDN__', $cdnurl);
         $builder = new Builder($classes);
-        $content = $builder->render($template_file, ['config' => $config, 'lang' => $lang]);
+        $content = $builder->render($templateFile, ['config' => $config, 'lang' => $lang]);
 
-        if (!file_put_contents($output_file, $content)) {
+        if (!file_put_contents($outputFile, $content)) {
-            throw new Exception('Cannot save the content to ' . $output_file);
+            throw new Exception('Cannot save the content to ' . $outputFile);
         }
         $output->info("Build Successed!");
+        $output->info("Docs Location:" . $outputFile);
     }
 
     /**
@@ -183,7 +206,7 @@ class Api extends Command
                 }
             }
         }
-
+        $className = $namespace . '\\' . $class;
-        return $namespace . '\\' . $class;
+        return preg_match('/([a-z0-9_\\]+)([a-z0-9_]+)$/i', $className) ? $className : '';
     }
 }

application/admin/command/Api/library/Builder.php

@@ -90,14 +90,15 @@ class Builder
 
         $typeArr = [
             'integer' => 'number',
-            'file' => 'file',
+            'file'    => 'file',
         ];
         $paramslist = array();
         foreach ($docs['ApiParams'] as $params) {
-            $inputtype = $params['type'] && isset($typeArr[$params['type']]) ? $typeArr[$params['type']] : ($params['name'] == 'password' ? 'password' : 'text');
+            $type = strtolower($params['type'] ?? 'string');
+            $inputtype = $typeArr[$type] ?? ($params['name'] == 'password' ? 'password' : 'text');
             $tr = array(
                 'name'        => $params['name'],
-                'type'        => $params['type'] ?? 'string',
+                'type'        => $type,
                 'inputtype'   => $inputtype,
                 'sample'      => $params['sample'] ?? '',
                 'required'    => $params['required'] ?? true,
@@ -162,7 +163,7 @@ class Builder
             'OPTIONS' => 'label-info'
         );
 
-        return isset($labes[$method]) ? $labes[$method] : $labes['GET'];
+        return $labes[$method] ?? $labes['GET'];
     }
 
     public function parse()
@@ -230,7 +231,7 @@ class Builder
         foreach ($docsList as $index => &$methods) {
             $methodSectorArr = [];
             foreach ($methods as $name => $method) {
-                $methodSectorArr[$name] = isset($method['weigh']) ? $method['weigh'] : 0;
+                $methodSectorArr[$name] = $method['weigh'] ?? 0;
             }
             arsort($methodSectorArr);
             $methods = array_merge(array_flip(array_keys($methodSectorArr)), $methods);
@@ -253,7 +254,6 @@ class Builder
     public function render($template, $vars = [])
     {
         $docsList = $this->parse();
-
         return $this->view->display(file_get_contents($template), array_merge($vars, ['docsList' => $docsList]));
     }
 }

application/admin/command/Crud.php

@@ -920,6 +920,7 @@ class Crud extends Command
                                 $replace = '\'{"custom[type]":"' . $table . '"}\'';
                             } elseif ($selectpageController == 'admin') {
                                 $attrArr['data-source'] = 'auth/admin/selectpage';
+                                $attrArr['data-field'] = 'nickname';
                             } elseif ($selectpageController == 'user') {
                                 $attrArr['data-source'] = 'user/user/index';
                                 $attrArr['data-field'] = 'nickname';

application/admin/command/Crud/stubs/mixins/checkbox.stub

@@ -1,7 +1,7 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         $valueArr = explode(',', $value);
         $list = $this->{%listMethodName%}();
         return implode(',', array_intersect_key($list, array_flip($valueArr)));

application/admin/command/Crud/stubs/mixins/datetime.stub

@@ -1,6 +1,6 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         return is_numeric($value) ? date("Y-m-d H:i:s", $value) : $value;
     }

application/admin/command/Crud/stubs/mixins/radio.stub

@@ -1,7 +1,7 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         $list = $this->{%listMethodName%}();
-        return isset($list[$value]) ? $list[$value] : '';
+        return $list[$value] ?? '';
     }

application/admin/command/Crud/stubs/mixins/select.stub

@@ -1,7 +1,7 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         $list = $this->{%listMethodName%}();
-        return isset($list[$value]) ? $list[$value] : '';
+        return $list[$value] ?? '';
     }

application/admin/command/Install.php

@@ -17,6 +17,13 @@ use think\View;
 
 class Install extends Command
 {
+
+    /**
+     * 最低PHP版本
+     * @var string
+     */
+    protected $minPhpVersion = '7.4.0';
+
     protected $model = null;
     /**
      * @var \think\View 视图类实例
@@ -70,7 +77,7 @@ class Install extends Command
 
         $adminName = $this->installation($hostname, $hostport, $database, $username, $password, $prefix, $adminUsername, $adminPassword, $adminEmail, $siteName);
         if ($adminName) {
-            $output->highlight("Admin url:http://www.example.com/{$adminName}");
+            $output->highlight("Admin url:https://www.example.com/{$adminName}");
         }
 
         $output->highlight("Admin username:{$adminUsername}");
@@ -207,22 +214,27 @@ class Install extends Command
         $adminFile = ROOT_PATH . 'public' . DS . 'admin.php';
 
         // 数据库配置文件
-        $dbConfigFile = APP_PATH . 'database.php';
+        $envSampleFile = ROOT_PATH . '.env.sample';
-        $dbConfigText = @file_get_contents($dbConfigFile);
+        $envFile = ROOT_PATH . '.env';
+        if (!file_exists($envFile)) {
+            if (!copy($envSampleFile, $envFile)) {
+                throw new Exception(__('Failed to copy %s to %s', '.env.sample', '.env'));
+            }
+        }
+
+        $envText = @file_get_contents($envFile);
+
         $callback = function ($matches) use ($mysqlHostname, $mysqlHostport, $mysqlUsername, $mysqlPassword, $mysqlDatabase, $mysqlPrefix) {
             $field = "mysql" . ucfirst($matches[1]);
             $replace = $$field;
-            if ($matches[1] == 'hostport' && $mysqlHostport == 3306) {
+            return "{$matches[1]} = {$replace}";
-                $replace = '';
-            }
-            return "'{$matches[1]}'{$matches[2]}=>{$matches[3]}Env::get('database.{$matches[1]}', '{$replace}'),";
         };
-        $dbConfigText = preg_replace_callback("/'(hostname|database|username|password|hostport|prefix)'(\s+)=>(\s+)Env::get\((.*)\)\,/", $callback, $dbConfigText);
+        $envText = preg_replace_callback("/(hostname|database|username|password|hostport|prefix)\s*=\s*(.*)/", $callback, $envText);
 
         // 检测能否成功写入数据库配置
-        $result = @file_put_contents($dbConfigFile, $dbConfigText);
+        $result = @file_put_contents($envFile, $envText);
         if (!$result) {
-            throw new Exception(__('The current permissions are insufficient to write the file %s', 'application/database.php'));
+            throw new Exception(__('The current permissions are insufficient to write the file %s', '.env'));
         }
 
         // 设置新的Token随机密钥key
@@ -237,7 +249,7 @@ class Install extends Command
             throw new Exception(__('The current permissions are insufficient to write the file %s', 'application/config.php'));
         }
 
-        $avatar = request()->domain() . '/assets/img/avatar.png';
+        $avatar = '/assets/img/avatar.png';
         // 变更默认管理员密码
         $adminPassword = $adminPassword ? $adminPassword : Random::alnum(8);
         $adminEmail = $adminEmail ? $adminEmail : "admin@admin.com";
@@ -309,8 +321,8 @@ class Install extends Command
         //数据库配置文件
         $dbConfigFile = APP_PATH . 'database.php';
 
-        if (version_compare(PHP_VERSION, '7.4.0', '<')) {
+        if (version_compare(PHP_VERSION, $this->minPhpVersion, '<')) {
-            throw new Exception(__("The current version %s is too low, please use PHP 7.4 or higher", PHP_VERSION));
+            throw new Exception(__("The current PHP %s is too low, please use PHP %s or higher", PHP_VERSION, $this->minPhpVersion));
         }
         if (!extension_loaded("PDO")) {
             throw new Exception(__("PDO is not currently installed and cannot be installed"));

application/admin/command/Install/zh-cn.php

@@ -27,7 +27,7 @@ return [
     'Password is too weak'                                                                                  => '密码太简单，请重新输入',
     'The two passwords you entered did not match'                                                           => '两次输入的密码不一致',
     'Please input correct website'                                                                          => '网站名称输入不正确',
-    'The current version %s is too low, please use PHP 7.4 or higher'                                       => '当前版本%s过低，请使用PHP7.4及以上版本',
+    'The current PHP %s is too low, please use PHP %s or higher'                                            => '当前版本PHP %s过低，请使用PHP %s及以上版本',
     'PDO is not currently installed and cannot be installed'                                                => '当前未开启PDO，无法进行安装',
     'The current permissions are insufficient to write the file %s'                                         => '当前权限不足，无法写入文件%s',
     'Please go to the official website to download the full package or resource package and try to install' => '当前代码仅包含核心代码，请前往官网下载完整包或资源包覆盖后再尝试安装',

application/admin/controller/Ajax.php

@@ -21,7 +21,6 @@ use think\Validate;
  */
 class Ajax extends Backend
 {
-
     protected $noNeedLogin = ['lang'];
     protected $noNeedRight = ['*'];
     protected $layout = '';
@@ -175,18 +174,18 @@ class Ajax extends Backend
             $weighdata[$v[$prikey]] = $v[$field];
         }
         $position = array_search($changeid, $ids);
-        $desc_id = isset($sour[$position]) ? $sour[$position] : end($sour);    //移动到目标的ID值,取出所处改变前位置的值
+        $desc_id = $sour[$position] ?? end($sour);    //移动到目标的ID值,取出所处改变前位置的值
         $sour_id = $changeid;
-        $weighids = array();
+        $weighids = [];
         $temp = array_values(array_diff_assoc($ids, $sour));
         foreach ($temp as $m => $n) {
             if ($n == $sour_id) {
                 $offset = $desc_id;
             } else {
                 if ($sour_id == $temp[0]) {
-                    $offset = isset($temp[$m + 1]) ? $temp[$m + 1] : $sour_id;
+                    $offset = $temp[$m + 1] ?? $sour_id;
                 } else {
-                    $offset = isset($temp[$m - 1]) ? $temp[$m - 1] : $sour_id;
+                    $offset = $temp[$m - 1] ?? $sour_id;
                 }
             }
             if (!isset($weighdata[$offset])) {
@@ -207,7 +206,6 @@ class Ajax extends Backend
             $type = $this->request->request("type");
             switch ($type) {
                 case 'all':
-                    // no break
                 case 'content':
                     //内容缓存
                     rmdirs(CACHE_PATH, false);
@@ -215,18 +213,21 @@ class Ajax extends Backend
                     if ($type == 'content') {
                         break;
                     }
+                    // no break
                 case 'template':
                     // 模板缓存
                     rmdirs(TEMP_PATH, false);
                     if ($type == 'template') {
                         break;
                     }
+                    // no break
                 case 'addons':
                     // 插件缓存
                     Service::refresh();
                     if ($type == 'addons') {
                         break;
                     }
+                    // no break
                 case 'browser':
                     // 浏览器缓存
                     // 只有生产环境下才修改
@@ -323,5 +324,4 @@ class Ajax extends Backend
         $response = Response::create($data, '', 200, $header);
         return $response;
     }
-
 }

application/admin/controller/Index.php

@@ -127,15 +127,20 @@ class Index extends Backend
      */
     public function logout()
     {
+
         if ($this->request->isPost()) {
+            // 加强校验referer是否来自服务器，允许referer为空
+            $referer = $this->request->server('HTTP_REFERER');
+            if ($referer && strtolower(parse_url($referer, PHP_URL_HOST)) != strtolower($this->request->host())) {
+                $this->error(__('Invalid request'));
+            }
+
+            $this->token();
             $this->auth->logout();
             Hook::listen("admin_logout_after", $this->request);
             $this->success(__('Logout successful'), 'index/login');
         }
-        $html = "<form id='logout_submit' name='logout_submit' action='' method='post'>" . token() . "<input type='submit' value='ok' style='display:none;'></form>";
+        return $this->view->fetch();
-        $html .= "<script>document.forms['logout_submit'].submit();</script>";
-
-        return $html;
     }
 
 }

application/admin/controller/auth/Adminlog.php

@@ -18,21 +18,13 @@ class Adminlog extends Backend
      * @var \app\admin\model\AdminLog
      */
     protected $model = null;
-    protected $childrenGroupIds = [];
     protected $childrenAdminIds = [];
 
     public function _initialize()
     {
         parent::_initialize();
         $this->model = model('AdminLog');
-
         $this->childrenAdminIds = $this->auth->getChildrenAdminIds(true);
-        $this->childrenGroupIds = $this->auth->getChildrenGroupIds(true);
-
-        $groupName = AuthGroup::where('id', 'in', $this->childrenGroupIds)
-            ->column('id,name');
-
-        $this->view->assign('groupdata', $groupName);
     }
 
     /**

application/admin/controller/auth/Rule.php

@@ -82,7 +82,6 @@ class Rule extends Backend
                 if ($result === false) {
                     $this->error($this->model->getError());
                 }
-                Cache::rm('__menu__');
                 $this->success();
             }
             $this->error();
@@ -124,7 +123,6 @@ class Rule extends Backend
                 if ($result === false) {
                     $this->error($row->getError());
                 }
-                Cache::rm('__menu__');
                 $this->success();
             }
             $this->error();

application/admin/lang/zh-cn.php

@@ -7,6 +7,7 @@ return [
     'Mobile'                                                => '手机',
     'Email'                                                 => '邮箱',
     'Password'                                              => '密码',
+    'Mobile'                                                => '手机号',
     'Sign up'                                               => '注 册',
     'Sign in'                                               => '登 录',
     'Sign out'                                              => '退 出',

application/admin/lang/zh-cn/index.php

@@ -30,12 +30,15 @@ return [
     'You\'ve logged in, do not login again'                      => '你已经登录，无需重复登录',
     'Username or password can not be empty'                      => '用户名密码不能为空',
     'Username or password is incorrect'                          => '用户名或密码不正确',
+    'Username must be 3 to 30 characters'                        => '用户名只能由3-30位数字、字母、下划线组合',
     'Username is incorrect'                                      => '用户名不正确',
     'Password is incorrect'                                      => '密码不正确',
     'Admin is forbidden'                                         => '管理员已经被禁止登录',
     'Please try again after 1 day'                               => '请于1天后再尝试登录',
     'Login successful'                                           => '登录成功!',
     'Logout successful'                                          => '退出成功!',
+    'Are you sure you want to sign out?'                         => '确定要退出后台管理吗？',
+    'Confirm sign out'                                           => '确定退出',
     'Verification code is incorrect'                             => '验证码不正确',
     'Wipe cache completed'                                       => '清除缓存成功',
     'Wipe cache failed'                                          => '清除缓存失败',

application/admin/library/Auth.php

@@ -327,10 +327,7 @@ class Auth extends \fast\Auth
     {
         //取出当前管理员所有的分组
         $groups = $this->getGroups();
-        $groupIds = [];
+        $groupIds = array_column($groups, 'id');
-        foreach ($groups as $k => $v) {
-            $groupIds[] = $v['id'];
-        }
         $originGroupIds = $groupIds;
         foreach ($groups as $k => $v) {
             if (in_array($v['pid'], $originGroupIds)) {
@@ -371,12 +368,8 @@ class Auth extends \fast\Auth
         $childrenAdminIds = [];
         if (!$this->isSuperAdmin()) {
             $groupIds = $this->getChildrenGroupIds(false);
-            $authGroupList = \app\admin\model\AuthGroupAccess::field('uid,group_id')
+            $childrenAdminIds = \app\admin\model\AuthGroupAccess::where('group_id', 'in', $groupIds)
-                ->where('group_id', 'in', $groupIds)
+                ->column('uid');
-                ->select();
-            foreach ($authGroupList as $k => $v) {
-                $childrenAdminIds[] = $v['uid'];
-            }
         } else {
             //超级管理员拥有所有人的权限
             $childrenAdminIds = Admin::column('id');

application/admin/view/addon/config.html

@@ -2,9 +2,9 @@
     {if $addon.tips && $addon.tips.value}
     <div class="alert {$addon.tips.extend|default='alert-info-light'}" style="margin-bottom:10px;">
         {if $addon.tips.title}
-        <b>{$addon.tips.title}</b><br>
+        <b>{$addon.tips.title|htmlentities}</b><br>
         {/if}
-        {$addon.tips.value}
+        {$addon.tips.value|htmlentities}
     </div>
     {/if}
 
@@ -14,7 +14,7 @@
             <ul class="nav nav-tabs nav-group">
                 <li class="active"><a href="#all" data-toggle="tab">全部</a></li>
                 {foreach name="groupList" id="tab"}
-                    <li><a href="#tab-{$key}" title="{$tab}" data-toggle="tab">{$tab}</a></li>
+                    <li><a href="#tab-{$key|htmlentities}" title="{$tab|htmlentities}" data-toggle="tab">{$tab|htmlentities}</a></li>
                 {/foreach}
             </ul>
         </div>
@@ -23,99 +23,99 @@
         <div class="panel-body no-padding">
             <div id="myTabContent" class="tab-content">
                 {foreach name="groupList" id="group" key="groupName"}
-                <div class="tab-pane fade active in" id="tab-{$groupName}">
+                <div class="tab-pane fade active in" id="tab-{$groupName|htmlentities}">
 
                     <table class="table table-striped table-config mb-0">
                         <tbody>
                         {foreach name="$addon.config" id="item"}
                         {if ((!isset($item['group']) || $item['group']=='') && $groupName=='other') || (isset($item['group']) && $item['group']==$group)}
-                        <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name}" class="{if $item.visible??''}hidden{/if}">
+                        <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name|htmlentities}" class="{if $item.visible??''}hidden{/if}">
-                            <td width="15%">{$item.title}</td>
+                            <td width="15%">{$item.title|htmlentities}</td>
                             <td>
                                 <div class="row">
                                     <div class="col-sm-8 col-xs-12">
                                         {switch $item.type}
                                         {case string}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                         {/case}
                                         {case password}
-                                        <input {$item.extend} type="password" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                        <input {$item.extend} type="password" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                         {/case}
                                         {case text}
-                                        <textarea {$item.extend} name="row[{$item.name}]" class="form-control" data-rule="{$item.rule}" rows="5" data-tip="{$item.tip}">{$item.value|htmlentities}</textarea>
+                                        <textarea {$item.extend} name="row[{$item.name|htmlentities}]" class="form-control" data-rule="{$item.rule|htmlentities}" rows="5" data-tip="{$item.tip|htmlentities}">{$item.value|htmlentities}</textarea>
                                         {/case}
                                         {case array}
-                                        <dl class="fieldlist" data-name="row[{$item.name}]">
+                                        <dl class="fieldlist" data-name="row[{$item.name|htmlentities}]">
                                             <dd>
                                                 <ins>{:__('Array key')}</ins>
                                                 <ins>{:__('Array value')}</ins>
                                             </dd>
                                             <dd><a href="javascript:;" class="btn btn-sm btn-success btn-append"><i class="fa fa-plus"></i> {:__('Append')}</a></dd>
-                                            <textarea name="row[{$item.name}]" cols="30" rows="5" class="hide">{$item.value|json_encode|htmlentities}</textarea>
+                                            <textarea name="row[{$item.name|htmlentities}]" cols="30" rows="5" class="hide">{$item.value|json_encode|htmlentities}</textarea>
                                         </dl>
                                         {/case}
                                         {case date}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case time}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case datetime}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case number}
-                                        <input {$item.extend} type="number" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="number" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case checkbox}
                                         {foreach name="item.content" item="vo"}
-                                        <label for="row[{$item.name}][]-{$key}"><input id="row[{$item.name}][]-{$key}" name="row[{$item.name}][]" type="checkbox" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                        <label for="row[{$item.name|htmlentities}][]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}][]-{$key|htmlentities}" name="row[{$item.name|htmlentities}][]" type="checkbox" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                         {/foreach}
-                                        <span class="msg-box n-right" for="row[{$item.name}]"></span>
+                                        <span class="msg-box n-right" for="row[{$item.name|htmlentities}]"></span>
                                         {/case}
                                         {case radio}
                                         {foreach name="item.content" item="vo"}
-                                        <label for="row[{$item.name}]-{$key}"><input id="row[{$item.name}]-{$key}" name="row[{$item.name}]" type="radio" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                        <label for="row[{$item.name|htmlentities}]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}]-{$key|htmlentities}" name="row[{$item.name|htmlentities}]" type="radio" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                         {/foreach}
-                                        <span class="msg-box n-right" for="row[{$item.name}]"></span>
+                                        <span class="msg-box n-right" for="row[{$item.name|htmlentities}]"></span>
                                         {/case}
                                         {case value="select" break="0"}{/case}
                                         {case value="selects"}
-                                        <select {$item.extend} name="row[{$item.name}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip}" {$item.type=='selects'?'multiple':''}>
+                                        <select {$item.extend} name="row[{$item.name|htmlentities}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip|htmlentities}" {$item.type=='selects'?'multiple':''}>
                                             {foreach name="item.content" item="vo"}
-                                            <option value="{$key}" {in name="key" value="$item.value" }selected{/in}>{$vo}</option>
+                                            <option value="{$key|htmlentities}" {in name="key" value="$item.value" }selected{/in}>{$vo|htmlentities}</option>
                                             {/foreach}
                                         </select>
                                         {/case}
                                         {case value="image" break="0"}{/case}
                                         {case value="images"}
                                         <div class="form-inline">
-                                            <input id="c-{$item.name}" class="form-control" size="28" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
+                                            <input id="c-{$item.name|htmlentities}" class="form-control" size="28" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
-                                            <span><button type="button" id="plupload-{$item.name}" class="btn btn-danger plupload" data-input-id="c-{$item.name}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                            <span><button type="button" id="plupload-{$item.name|htmlentities}" class="btn btn-danger plupload" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name|htmlentities}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                            <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                            <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                            <ul class="row list-inline plupload-preview" id="p-{$item.name}"></ul>
+                                            <ul class="row list-inline plupload-preview" id="p-{$item.name|htmlentities}"></ul>
-                                            <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                            <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
                                         </div>
                                         {/case}
                                         {case value="file" break="0"}{/case}
                                         {case value="files"}
                                         <div class="form-inline">
-                                            <input id="c-{$item.name}" class="form-control" size="28" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
+                                            <input id="c-{$item.name|htmlentities}" class="form-control" size="28" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
-                                            <span><button type="button" id="plupload-{$item.name}" class="btn btn-danger plupload" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                            <span><button type="button" id="plupload-{$item.name|htmlentities}" class="btn btn-danger plupload" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                            <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                            <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                            <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                            <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
                                         </div>
                                         {/case}
                                         {case switch}
-                                        <input id="c-{$item.name}" name="row[{$item.name}]" type="hidden" value="{:$item.value?1:0}">
+                                        <input id="c-{$item.name|htmlentities}" name="row[{$item.name|htmlentities}]" type="hidden" value="{:$item.value?1:0}">
-                                        <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name}" data-yes="1" data-no="0">
+                                        <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name|htmlentities}" data-yes="1" data-no="0">
                                             <i class="fa fa-toggle-on text-success {if !$item.value}fa-flip-horizontal text-gray{/if} fa-2x"></i>
                                         </a>
                                         {/case}
                                         {case bool}
-                                        <label for="row[{$item.name}]-yes"><input id="row[{$item.name}]-yes" name="row[{$item.name}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip}" /> {:__('Yes')}</label>
+                                        <label for="row[{$item.name|htmlentities}]-yes"><input id="row[{$item.name|htmlentities}]-yes" name="row[{$item.name|htmlentities}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip|htmlentities}" /> {:__('Yes')}</label>
-                                        <label for="row[{$item.name}]-no"><input id="row[{$item.name}]-no" name="row[{$item.name}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip}" /> {:__('No')}</label>
+                                        <label for="row[{$item.name|htmlentities}]-no"><input id="row[{$item.name|htmlentities}]-no" name="row[{$item.name|htmlentities}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip|htmlentities}" /> {:__('No')}</label>
                                         {/case}
-                                        {default /}{$item.value}
+                                        {default /}{$item.value|htmlentities}
                                         {/switch}
                                     </div>
                                     <div class="col-sm-4"></div>

application/admin/view/addon/index.html

@@ -136,7 +136,7 @@
                     <div class="form-group">
                         <label class="control-label">{:__('Version')}</label>
                         <input type="hidden" class="operate" data-name="faversion" value="="/>
-                        <input class="form-control" name="faversion" type="text" value="{$Think.config.fastadmin.version}">
+                        <input class="form-control" name="faversion" type="text" value="{$Think.config.fastadmin.version|htmlentities}">
                     </div>
                 </div>
                 <div class="col-xs-12 col-sm-6 col-md-3">

application/admin/view/category/add.html

@@ -10,7 +10,7 @@
 
             <select id="c-type" data-rule="required" class="form-control selectpicker" name="row[type]">
                 {foreach name="typeList" item="vo"}
-                <option value="{$key}" {in name="key" value=""}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value=""}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -22,7 +22,7 @@
 
             <select id="c-pid" data-rule="required" class="form-control selectpicker" name="row[pid]">
                 {foreach name="parentList" item="vo"}
-                <option data-type="{$vo.type}" value="{$key}" {in name="key" value=""}selected{/in}>{$vo.name}</option>
+                <option data-type="{$vo.type|htmlentities}" value="{$key|htmlentities}" {in name="key" value=""}selected{/in}>{$vo.name|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -46,7 +46,7 @@
 
             <select  id="c-flag" class="form-control selectpicker" multiple="" name="row[flag][]">
                 {foreach name="flagList" item="vo"}
-                <option value="{$key}" {in name="key" value=""}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value=""}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 

application/admin/view/category/edit.html

@@ -6,7 +6,7 @@
 
             <select id="c-type" data-rule="required" class="form-control selectpicker" name="row[type]">
                 {foreach name="typeList" item="vo"}
-                <option value="{$key}" {in name="key" value="$row.type"}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value="$row.type"}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -18,7 +18,7 @@
 
             <select id="c-pid" data-rule="required" class="form-control selectpicker" name="row[pid]">
                 {foreach name="parentList" item="vo"}
-                <option data-type="{$vo.type}" class="{:$vo.type==$row.type||$vo.type=='all'?'':'hide'}" value="{$key}" {in name="key" value="$row.pid"}selected{/in}>{$vo.name}</option>
+                <option data-type="{$vo.type|htmlentities}" class="{:$vo.type==$row.type||$vo.type=='all'?'':'hide'}" value="{$key|htmlentities}" {in name="key" value="$row.pid"}selected{/in}>{$vo.name|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -42,7 +42,7 @@
 
             <select  id="c-flag" class="form-control selectpicker" multiple="" name="row[flag][]">
                 {foreach name="flagList" item="vo"}
-                <option value="{$key}" {in name="key" value="$row.flag"}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value="$row.flag"}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 

application/admin/view/category/index.html

@@ -4,7 +4,7 @@
         <ul class="nav nav-tabs">
             <li class="active"><a href="#all" data-toggle="tab">{:__('All')}</a></li>
             {foreach name="typeList" item="vo"}
-                <li><a href="#{$key}" data-toggle="tab">{$vo}</a></li>
+                <li><a href="#{$key|htmlentities}" data-toggle="tab">{$vo|htmlentities}</a></li>
             {/foreach}
         </ul>
 

application/admin/view/common/header.html

@@ -117,10 +117,10 @@
     <div id="secondnav">
         <ul class="nav nav-tabs nav-addtabs disable-top-badge" role="tablist">
             {if $fixedmenu}
-            <li role="presentation" id="tab_{$fixedmenu.id}" class="{:$referermenu?'':'active'}"><a href="#con_{$fixedmenu.id}" node-id="{$fixedmenu.id}" aria-controls="{$fixedmenu.id}" role="tab" data-toggle="tab"><i class="fa fa-dashboard fa-fw"></i> <span>{$fixedmenu.title}</span> <span class="pull-right-container"> </span></a></li>
+            <li role="presentation" id="tab_{$fixedmenu.id|htmlentities}" class="{:$referermenu?'':'active'}"><a href="#con_{$fixedmenu.id|htmlentities}" node-id="{$fixedmenu.id|htmlentities}" aria-controls="{$fixedmenu.id|htmlentities}" role="tab" data-toggle="tab"><i class="fa fa-dashboard fa-fw"></i> <span>{$fixedmenu.title|htmlentities}</span> <span class="pull-right-container"> </span></a></li>
             {/if}
             {if $referermenu}
-            <li role="presentation" id="tab_{$referermenu.id}" class="active"><a href="#con_{$referermenu.id}" node-id="{$referermenu.id}" aria-controls="{$referermenu.id}" role="tab" data-toggle="tab"><i class="fa fa-list fa-fw"></i> <span>{$referermenu.title}</span> <span class="pull-right-container"> </span></a> <i class="close-tab fa fa-remove"></i></li>
+            <li role="presentation" id="tab_{$referermenu.id|htmlentities}" class="active"><a href="#con_{$referermenu.id|htmlentities}" node-id="{$referermenu.id|htmlentities}" aria-controls="{$referermenu.id|htmlentities}" role="tab" data-toggle="tab"><i class="fa fa-list fa-fw"></i> <span>{$referermenu.title|htmlentities}</span> <span class="pull-right-container"> </span></a> <i class="close-tab fa fa-remove"></i></li>
             {/if}
         </ul>
     </div>

application/admin/view/common/meta.html

@@ -7,10 +7,10 @@
 
 <link rel="shortcut icon" href="__CDN__/assets/img/favicon.ico" />
 <!-- Loading Bootstrap -->
-<link href="__CDN__/assets/css/backend{$Think.config.app_debug?'':'.min'}.css?v={$Think.config.site.version}" rel="stylesheet">
+<link href="__CDN__/assets/css/backend{$Think.config.app_debug?'':'.min'}.css?v={$Think.config.site.version|htmlentities}" rel="stylesheet">
 
 {if $Think.config.fastadmin.adminskin}
-<link href="__CDN__/assets/css/skins/{$Think.config.fastadmin.adminskin}.css?v={$Think.config.site.version}" rel="stylesheet">
+<link href="__CDN__/assets/css/skins/{$Think.config.fastadmin.adminskin|htmlentities}.css?v={$Think.config.site.version|htmlentities}" rel="stylesheet">
 {/if}
 
 <!-- HTML5 shim, for IE6-8 support of HTML5 elements. All other JS at the end of file. -->

application/admin/view/common/script.html

@@ -1 +1 @@
-<script src="__CDN__/assets/js/require{$Think.config.app_debug?'':'.min'}.js" data-main="__CDN__/assets/js/require-backend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>
+<script src="__CDN__/assets/js/require.min.js" data-main="__CDN__/assets/js/require-backend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>

application/admin/view/dashboard/index.html

@@ -176,7 +176,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-red"><i class="fa fa-users"></i></span>
                             <div class="sm-st-info">
-                                <span>{$totaluser}</span>
+                                <span>{$totaluser|htmlentities}</span>
                                 {:__('Total user')}
                             </div>
                         </div>
@@ -185,7 +185,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-violet"><i class="fa fa-magic"></i></span>
                             <div class="sm-st-info">
-                                <span>{$totaladdon}</span>
+                                <span>{$totaladdon|htmlentities}</span>
                                 {:__('Total addon')}
                             </div>
                         </div>
@@ -194,7 +194,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-blue"><i class="fa fa-leaf"></i></span>
                             <div class="sm-st-info">
-                                <span>{$attachmentnums}</span>
+                                <span>{$attachmentnums|htmlentities}</span>
                                 {:__('Total attachment')}
                             </div>
                         </div>
@@ -203,7 +203,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-green"><i class="fa fa-user"></i></span>
                             <div class="sm-st-info">
-                                <span>{$totaladmin}</span>
+                                <span>{$totaladmin|htmlentities}</span>
                                 {:__('Total admin')}
                             </div>
                         </div>
@@ -221,7 +221,7 @@
                                     <div class="col-xs-6 stat-col">
                                         <div class="stat-icon"><i class="fa fa-rocket"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$todayusersignup}</div>
+                                            <div class="value"> {$todayusersignup|htmlentities}</div>
                                             <div class="name"> {:__('Today user signup')}</div>
                                         </div>
                                         <div class="progress">
@@ -231,7 +231,7 @@
                                     <div class="col-xs-6 stat-col">
                                         <div class="stat-icon"><i class="fa fa-vcard"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$todayuserlogin}</div>
+                                            <div class="value"> {$todayuserlogin|htmlentities}</div>
                                             <div class="name"> {:__('Today user login')}</div>
                                         </div>
                                         <div class="progress">
@@ -241,7 +241,7 @@
                                     <div class="col-xs-6  stat-col">
                                         <div class="stat-icon"><i class="fa fa-calendar"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$threednu}</div>
+                                            <div class="value"> {$threednu|htmlentities}</div>
                                             <div class="name"> {:__('Three dnu')}</div>
                                         </div>
                                         <div class="progress">
@@ -251,7 +251,7 @@
                                     <div class="col-xs-6 stat-col">
                                         <div class="stat-icon"><i class="fa fa-calendar-plus-o"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$sevendnu}</div>
+                                            <div class="value"> {$sevendnu|htmlentities}</div>
                                             <div class="name"> {:__('Seven dnu')}</div>
                                         </div>
                                         <div class="progress">
@@ -261,7 +261,7 @@
                                     <div class="col-xs-6  stat-col">
                                         <div class="stat-icon"><i class="fa fa-user-circle"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$sevendau}</div>
+                                            <div class="value"> {$sevendau|htmlentities}</div>
                                             <div class="name"> {:__('Seven dau')}</div>
                                         </div>
                                         <div class="progress">
@@ -271,7 +271,7 @@
                                     <div class="col-xs-6  stat-col">
                                         <div class="stat-icon"><i class="fa fa-user-circle-o"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$thirtydau}</div>
+                                            <div class="value"> {$thirtydau|htmlentities}</div>
                                             <div class="name"> {:__('Thirty dau')}</div>
                                         </div>
                                         <div class="progress">
@@ -298,7 +298,7 @@
                                 <div class="panel-content">
                                     <div class="row">
                                         <div class="col-md-12">
-                                            <h1 class="no-margins">{$totalworkingaddon}</h1>
+                                            <h1 class="no-margins">{$totalworkingaddon|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-magic"></i>
                                                 <small>{:__('Working addon count tips')}</small>
                                             </div>
@@ -318,7 +318,7 @@
                                 <div class="ibox-content">
                                     <div class="row">
                                         <div class="col-md-6">
-                                            <h1 class="no-margins">{$dbtablenums}</h1>
+                                            <h1 class="no-margins">{$dbtablenums|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-database"></i>
                                                 <small>{:__('Database table nums')}</small>
                                             </div>
@@ -346,7 +346,7 @@
 
                                     <div class="row">
                                         <div class="col-md-6">
-                                            <h1 class="no-margins">{$attachmentnums}</h1>
+                                            <h1 class="no-margins">{$attachmentnums|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-files-o"></i>
                                                 <small>{:__('Attachment nums')}</small>
                                             </div>
@@ -373,7 +373,7 @@
 
                                     <div class="row">
                                         <div class="col-md-6">
-                                            <h1 class="no-margins">{$picturenums}</h1>
+                                            <h1 class="no-margins">{$picturenums|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-picture-o"></i>
                                                 <small>{:__('Picture nums')}</small>
                                             </div>

application/admin/view/general/attachment/add.html

@@ -15,7 +15,7 @@
                 <select name="category-third" id="category-third" class="form-control selectpicker">
                     <option value="">{:__('Please select category')}</option>
                     {foreach name="categoryList" id="item"}
-                    <option value="{$key}">{$item}</option>
+                    <option value="{$key|htmlentities}">{$item|htmlentities}</option>
                     {/foreach}
                 </select>
             </div>
@@ -42,13 +42,13 @@
                 <select name="category-local" id="category-local" class="form-control selectpicker">
                     <option value="">{:__('Please select category')}</option>
                     {foreach name="categoryList" id="item"}
-                    <option value="{$key}">{$item}</option>
+                    <option value="{$key|htmlentities}">{$item|htmlentities}</option>
                     {/foreach}
                 </select>
             </div>
-            <button type="button" id="faupload-local" class="btn btn-primary faupload" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}"><i class="fa fa-upload"></i> {:__("Upload to local")}</button>
+            <button type="button" id="faupload-local" class="btn btn-primary faupload" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}" data-cdnurl=""><i class="fa fa-upload"></i> {:__("Upload to local")}</button>
             {if $config.upload.chunking}
-            <button type="button" id="faupload-local-chunking" class="btn btn-primary faupload" data-chunking="true" data-maxsize="1gb" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}"><i class="fa fa-upload"></i> {:__("Upload to local by chunk")}</button>
+            <button type="button" id="faupload-local-chunking" class="btn btn-primary faupload" data-chunking="true" data-maxsize="1gb" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}" data-cdnurl=""><i class="fa fa-upload"></i> {:__("Upload to local by chunk")}</button>
             {/if}
         </div>
     </div>

application/admin/view/general/attachment/edit.html

@@ -8,7 +8,7 @@
             <select name="row[category]" class="form-control">
                 <option value="">{:__('Please select category')}</option>
                 {foreach name="categoryList" id="item"}
-                <option value="{$key}" {if $key==$row.category}selected{/if}>{$item}</option>
+                <option value="{$key|htmlentities}" {if $key==$row.category}selected{/if}>{$item|htmlentities}</option>
                 {/foreach}
             </select>
         </div>

application/admin/view/general/attachment/index.html

@@ -5,14 +5,14 @@
         <ul class="nav nav-tabs" data-field="category">
             <li class="active"><a href="#t-all" data-value="" data-toggle="tab">{:__('All')}</a></li>
             {foreach name="categoryList" item="vo"}
-            <li><a href="#t-{$key}" data-value="{$key}" data-toggle="tab">{$vo}</a></li>
+            <li><a href="#t-{$key|htmlentities}" data-value="{$key|htmlentities}" data-toggle="tab">{$vo|htmlentities}</a></li>
             {/foreach}
             <li class="pull-right dropdown filter-type">
                 <a href="javascript:" class="dropdown-toggle" data-toggle="dropdown"><i class="fa fa-filter"></i> {:__('Filter Type')}</a>
                 <ul class="dropdown-menu text-left" role="menu">
                     <li class="active"><a href="javascript:" data-value="">{:__('All')}</a></li>
                     {foreach name="mimetypeList" id="item"}
-                    <li><a href="javascript:" data-value="{$key}">{$item}</a></li>
+                    <li><a href="javascript:" data-value="{$key|htmlentities}">{$item|htmlentities}</a></li>
                     {/foreach}
                 </ul>
             </li>
@@ -45,7 +45,7 @@
             <select name="category" class="form-control">
                 <option value="">{:__('Please select category')}</option>
                 {foreach name="categoryList" id="item"}
-                <option value="{$key}">{$item}</option>
+                <option value="{$key|htmlentities}">{$item|htmlentities}</option>
                 {/foreach}
             </select>
         </div>

application/admin/view/general/attachment/select.html

@@ -9,7 +9,7 @@
         <ul class="nav nav-tabs" data-field="category">
             <li class="active"><a href="#t-all" data-value="" data-toggle="tab">{:__('All')}</a></li>
             {foreach name="categoryList" item="vo"}
-            <li><a href="#t-{$key}" data-value="{$key}" data-toggle="tab">{$vo}</a></li>
+            <li><a href="#t-{$key|htmlentities}" data-value="{$key|htmlentities}" data-toggle="tab">{$vo|htmlentities}</a></li>
             {/foreach}
             {if stripos(request()->get('mimetype'),'image/')===false}
             <li class="pull-right dropdown filter-type">
@@ -17,7 +17,7 @@
                 <ul class="dropdown-menu text-left" role="menu">
                     <li class="active"><a href="javascript:" data-value="">{:__('All')}</a></li>
                     {foreach name="mimetypeList" id="item"}
-                    <li><a href="javascript:" data-value="{$key}">{$item}</a></li>
+                    <li><a href="javascript:" data-value="{$key|htmlentities}">{$item|htmlentities}</a></li>
                     {/foreach}
                 </ul>
             </li>

application/admin/view/general/config/index.html

@@ -27,7 +27,7 @@
         {:build_heading(null, false)}
         <ul class="nav nav-tabs">
             {foreach $siteList as $index=>$vo}
-            <li class="{$vo.active?'active':''}"><a href="#tab-{$vo.name}" data-toggle="tab">{:__($vo.title)}</a></li>
+            <li class="{$vo.active?'active':''}"><a href="#tab-{$vo.name|htmlentities}" data-toggle="tab">{:__(htmlentities($vo.title))}</a></li>
             {/foreach}
             {if $Think.config.app_debug}
             <li data-toggle="tooltip" title="{:__('Add new config')}">
@@ -41,9 +41,9 @@
         <div id="myTabContent" class="tab-content">
             <!--@formatter:off-->
             {foreach $siteList as $index=>$vo}
-            <div class="tab-pane fade {$vo.active ? 'active in' : ''}" id="tab-{$vo.name}">
+            <div class="tab-pane fade {$vo.active ? 'active in' : ''}" id="tab-{$vo.name|htmlentities}">
                 <div class="widget-body no-padding">
-                    <form id="{$vo.name}-form" class="edit-form form-horizontal" role="form" data-toggle="validator" method="POST" action="{:url('general.config/edit')}">
+                    <form id="{$vo.name|htmlentities}-form" class="edit-form form-horizontal" role="form" data-toggle="validator" method="POST" action="{:url('general.config/edit')}">
                         {:token()}
                         <table class="table table-striped">
                             <thead>
@@ -58,111 +58,111 @@
                             </thead>
                             <tbody>
                             {foreach $vo.list as $item}
-                            <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name}" class="{if $item.visible??''}hidden{/if}">
+                            <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name|htmlentities}" class="{if $item.visible??''}hidden{/if}">
-                                <td>{$item.title}</td>
+                                <td>{$item.title|htmlentities}</td>
                                 <td>
                                     <div class="row">
                                         <div class="col-sm-8 col-xs-12">
                                             {switch $item.type}
                                             {case string}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                             {/case}
                                             {case password}
-                                            <input {$item.extend_html} type="password" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                            <input {$item.extend_html|htmlentities} type="password" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                             {/case}
                                             {case text}
-                                            <textarea {$item.extend_html} name="row[{$item.name}]" class="form-control" data-rule="{$item.rule}" rows="5" data-tip="{$item.tip}">{$item.value|htmlentities}</textarea>
+                                            <textarea {$item.extend_html|htmlentities} name="row[{$item.name|htmlentities}]" class="form-control" data-rule="{$item.rule|htmlentities}" rows="5" data-tip="{$item.tip|htmlentities}">{$item.value|htmlentities}</textarea>
                                             {/case}
                                             {case editor}
-                                            <textarea {$item.extend_html} name="row[{$item.name}]" id="editor-{$item.name}" class="form-control editor" data-rule="{$item.rule}" rows="5" data-tip="{$item.tip}">{$item.value|htmlentities}</textarea>
+                                            <textarea {$item.extend_html|htmlentities} name="row[{$item.name|htmlentities}]" id="editor-{$item.name|htmlentities}" class="form-control editor" data-rule="{$item.rule|htmlentities}" rows="5" data-tip="{$item.tip|htmlentities}">{$item.value|htmlentities}</textarea>
                                             {/case}
                                             {case array}
-                                            <dl {$item.extend_html} class="fieldlist" data-name="row[{$item.name}]">
+                                            <dl {$item.extend_html|htmlentities} class="fieldlist" data-name="row[{$item.name|htmlentities}]">
                                                 <dd>
                                                     <ins>{:isset($item["setting"]["key"])&&$item["setting"]["key"]?$item["setting"]["key"]:__('Array key')}</ins>
                                                     <ins>{:isset($item["setting"]["value"])&&$item["setting"]["value"]?$item["setting"]["value"]:__('Array value')}</ins>
                                                 </dd>
                                                 <dd><a href="javascript:;" class="btn btn-sm btn-success btn-append"><i class="fa fa-plus"></i> {:__('Append')}</a></dd>
-                                                <textarea name="row[{$item.name}]" class="form-control hide" cols="30" rows="5">{$item.value|htmlentities}</textarea>
+                                                <textarea name="row[{$item.name|htmlentities}]" class="form-control hide" cols="30" rows="5">{$item.value|htmlentities}</textarea>
                                             </dl>
                                             {/case}
                                             {case date}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case time}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case datetime}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case datetimerange}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimerange" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimerange" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case number}
-                                            <input {$item.extend_html} type="number" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="number" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case checkbox}
                                             <div class="checkbox">
                                             {foreach name="item.content" item="vo"}
-                                            <label for="row[{$item.name}][]-{$key}"><input id="row[{$item.name}][]-{$key}" name="row[{$item.name}][]" type="checkbox" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                            <label for="row[{$item.name|htmlentities}][]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}][]-{$key|htmlentities}" name="row[{$item.name|htmlentities}][]" type="checkbox" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                             {/foreach}
                                             </div>
                                             {/case}
                                             {case radio}
                                             <div class="radio">
                                             {foreach name="item.content" item="vo"}
-                                            <label for="row[{$item.name}]-{$key}"><input id="row[{$item.name}]-{$key}" name="row[{$item.name}]" type="radio" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                            <label for="row[{$item.name|htmlentities}]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}]-{$key|htmlentities}" name="row[{$item.name|htmlentities}]" type="radio" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                             {/foreach}
                                             </div>
                                             {/case}
                                             {case value="select" break="0"}{/case}
                                             {case value="selects"}
-                                            <select {$item.extend_html} name="row[{$item.name}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip}" {$item.type=='selects'?'multiple':''}>
+                                            <select {$item.extend_html|htmlentities} name="row[{$item.name|htmlentities}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip|htmlentities}" {$item.type=='selects'?'multiple':''}>
                                                 {foreach name="item.content" item="vo"}
-                                                <option value="{$key}" {in name="key" value="$item.value" }selected{/in}>{$vo}</option>
+                                                <option value="{$key|htmlentities}" {in name="key" value="$item.value" }selected{/in}>{$vo|htmlentities}</option>
                                                 {/foreach}
                                             </select>
                                             {/case}
                                             {case value="image" break="0"}{/case}
                                             {case value="images"}
                                             <div class="form-inline">
-                                                <input id="c-{$item.name}" class="form-control" size="50" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
+                                                <input id="c-{$item.name|htmlentities}" class="form-control" size="50" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
-                                                <span><button type="button" id="faupload-{$item.name}" class="btn btn-danger faupload" data-input-id="c-{$item.name}" data-mimetype="image/gif,image/jpeg,image/png,image/jpg,image/bmp,image/webp" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                                <span><button type="button" id="faupload-{$item.name|htmlentities}" class="btn btn-danger faupload" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/gif,image/jpeg,image/png,image/jpg,image/bmp,image/webp" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name|htmlentities}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                                <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                                <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                                <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                                <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
-                                                <ul class="row list-inline faupload-preview" id="p-{$item.name}"></ul>
+                                                <ul class="row list-inline faupload-preview" id="p-{$item.name|htmlentities}"></ul>
                                             </div>
                                             {/case}
                                             {case value="file" break="0"}{/case}
                                             {case value="files"}
                                             <div class="form-inline">
-                                                <input id="c-{$item.name}" class="form-control" size="50" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
+                                                <input id="c-{$item.name|htmlentities}" class="form-control" size="50" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
-                                                <span><button type="button" id="faupload-{$item.name}" class="btn btn-danger faupload" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                                <span><button type="button" id="faupload-{$item.name|htmlentities}" class="btn btn-danger faupload" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                                <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                                <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                                <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                                <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
                                             </div>
                                             {/case}
                                             {case switch}
-                                            <input id="c-{$item.name}" name="row[{$item.name}]" type="hidden" value="{:$item.value?1:0}">
+                                            <input id="c-{$item.name|htmlentities}" name="row[{$item.name|htmlentities}]" type="hidden" value="{:$item.value?1:0}">
-                                            <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name}" data-yes="1" data-no="0">
+                                            <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name|htmlentities}" data-yes="1" data-no="0">
                                                 <i class="fa fa-toggle-on text-success {if !$item.value}fa-flip-horizontal text-gray{/if} fa-2x"></i>
                                             </a>
                                             {/case}
                                             {case bool}
-                                            <label for="row[{$item.name}]-yes"><input id="row[{$item.name}]-yes" name="row[{$item.name}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip}" /> {:__('Yes')}</label>
+                                            <label for="row[{$item.name|htmlentities}]-yes"><input id="row[{$item.name|htmlentities}]-yes" name="row[{$item.name|htmlentities}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip|htmlentities}" /> {:__('Yes')}</label>
-                                            <label for="row[{$item.name}]-no"><input id="row[{$item.name}]-no" name="row[{$item.name}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip}" /> {:__('No')}</label>
+                                            <label for="row[{$item.name|htmlentities}]-no"><input id="row[{$item.name|htmlentities}]-no" name="row[{$item.name|htmlentities}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip|htmlentities}" /> {:__('No')}</label>
                                             {/case}
                                             {case city}
                                             <div style="position:relative">
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" id="c-{$item.name}" value="{$item.value|htmlentities}" class="form-control" data-toggle="city-picker" data-tip="{$item.tip}" data-rule="{$item.rule}" />
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" id="c-{$item.name|htmlentities}" value="{$item.value|htmlentities}" class="form-control" data-toggle="city-picker" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}" />
                                             </div>
                                             {/case}
                                             {case value="selectpage" break="0"}{/case}
                                             {case value="selectpages"}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" id="c-{$item.name}" value="{$item.value|htmlentities}" class="form-control selectpage" data-source="{:url('general.config/selectpage')}?id={$item.id}" data-primary-key="{$item.setting.primarykey}" data-field="{$item.setting.field}" data-multiple="{$item.type=='selectpage'?'false':'true'}" data-tip="{$item.tip}" data-rule="{$item.rule}" />
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" id="c-{$item.name|htmlentities}" value="{$item.value|htmlentities}" class="form-control selectpage" data-source="{:url('general.config/selectpage')}?id={$item.id|htmlentities}" data-primary-key="{$item.setting.primarykey|htmlentities}" data-field="{$item.setting.field|htmlentities}" data-multiple="{$item.type=='selectpage'?'false':'true'}" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}" />
                                             {/case}
                                             {case custom}
-                                            {$item.extend_html}
+                                            {$item.extend_html|htmlentities}
                                             {/case}
                                             {/switch}
                                         </div>
@@ -172,7 +172,7 @@
                                 </td>
                                 {if $Think.config.app_debug}
                                 <td>{php}echo "{\$site.". $item['name'] . "}";{/php}</td>
-                                <td>{if $item['id']>18}<a href="javascript:;" class="btn-delcfg text-muted" data-name="{$item.name}"><i class="fa fa-times"></i></a>{/if}</td>
+                                <td>{if $item['id']>18}<a href="javascript:;" class="btn-delcfg text-muted" data-name="{$item.name|htmlentities}"><i class="fa fa-times"></i></a>{/if}</td>
                                 {/if}
                             </tr>
                             {/foreach}
@@ -205,7 +205,7 @@
                         <div class="col-xs-12 col-sm-4">
                             <select name="row[group]" class="form-control selectpicker">
                                 {foreach name="groupList" item="vo"}
-                                <option value="{$key}" {in name="key" value="basic" }selected{/in}>{$vo}</option>
+                                <option value="{$key|htmlentities}" {in name="key" value="basic" }selected{/in}>{$vo|htmlentities}</option>
                                 {/foreach}
                             </select>
                         </div>
@@ -215,7 +215,7 @@
                         <div class="col-xs-12 col-sm-4">
                             <select name="row[type]" id="c-type" class="form-control selectpicker">
                                 {foreach name="typeList" item="vo"}
-                                <option value="{$key}" {in name="key" value="string" }selected{/in}>{$vo}</option>
+                                <option value="{$key|htmlentities}" {in name="key" value="string" }selected{/in}>{$vo|htmlentities}</option>
                                 {/foreach}
                             </select>
                         </div>
@@ -306,7 +306,7 @@ value2|title2</textarea>
                                     <button class="btn btn-primary dropdown-toggle" data-toggle="dropdown" type="button">{:__('Choose')}</button>
                                     <ul class="dropdown-menu pull-right rulelist">
                                         {volist name="ruleList" id="item"}
-                                        <li><a href="javascript:;" data-value="{$key}">{$item}<span class="text-muted">({$key})</span></a></li>
+                                        <li><a href="javascript:;" data-value="{$key|htmlentities}">{$item|htmlentities}<span class="text-muted">({$key|htmlentities})</span></a></li>
                                         {/volist}
                                     </ul>
                                 </span>

application/admin/view/index/index.html

@@ -27,13 +27,13 @@
             <!-- 主体内容区域 -->
             <div class="content-wrapper tab-content tab-addtabs">
                 {if $fixedmenu}
-                <div role="tabpanel" class="tab-pane {:$referermenu?'':'active'}" id="con_{$fixedmenu.id}">
+                <div role="tabpanel" class="tab-pane {:$referermenu?'':'active'}" id="con_{$fixedmenu.id|htmlentities}">
-                    <iframe src="{$fixedmenu.url}{:stripos($fixedmenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
+                    <iframe src="{$fixedmenu.url|htmlentities}{:stripos($fixedmenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
                 </div>
                 {/if}
                 {if $referermenu}
-                <div role="tabpanel" class="tab-pane active" id="con_{$referermenu.id}">
+                <div role="tabpanel" class="tab-pane active" id="con_{$referermenu.id|htmlentities}">
-                    <iframe src="{$referermenu.url}{:stripos($referermenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
+                    <iframe src="{$referermenu.url|htmlentities}{:stripos($referermenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
                 </div>
                 {/if}
             </div>
@@ -42,7 +42,7 @@
             <footer class="main-footer hide">
                 <div class="pull-right hidden-xs">
                 </div>
-                <strong>Copyright &copy; 2017-{:date("Y")} <a href="__PUBLIC__">{$site.name}</a>.</strong> All rights reserved.
+                <strong>Copyright &copy; 2017-{:date("Y")} <a href="__PUBLIC__">{$site.name|htmlentities}</a>.</strong> All rights reserved.
             </footer>
 
             <!-- 右侧控制栏 -->

application/admin/view/index/login.html

@@ -81,7 +81,7 @@
     {if $background}
         <style type="text/css">
             body{
-                background-image: url('{$background}');
+                background-image: url('{$background|htmlentities}');
             }
         </style>
     {/if}
@@ -116,7 +116,7 @@
                         {if $Think.config.fastadmin.login_captcha}
                         <div class="input-group">
                             <div class="input-group-addon"><span class="glyphicon glyphicon-option-horizontal" aria-hidden="true"></span></div>
-                            <input type="text" name="captcha" class="form-control" placeholder="{:__('Captcha')}" data-rule="{:__('Captcha')}:required;length({$Think.config.captcha.length})" autocomplete="off"/>
+                            <input type="text" name="captcha" class="form-control" placeholder="{:__('Captcha')}" data-rule="{:__('Captcha')}:required;length({$Think.config.captcha.length|htmlentities})" autocomplete="off"/>
                             <span class="input-group-addon" style="padding:0;border:none;cursor:pointer;">
                                     <img src="{:rtrim('__PUBLIC__', '/')}/index.php?s=/captcha" width="100" height="30" onclick="this.src = '{:rtrim('__PUBLIC__', '/')}/index.php?s=/captcha&r=' + Math.random();"/>
                             </span>

application/admin/view/index/logout.html

@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html>
+<head>
+    {include file="common/meta" /}
+
+    <style type="text/css">
+        body {
+            color: #999;
+            background-color: #f1f4fd;
+            background-size: cover;
+        }
+
+        a {
+            color: #444;
+        }
+
+        .logout-main {
+            text-align: center;
+            max-width: 430px;
+            margin: 0 auto;
+            margin-top: 150px;
+            background-color: #fff;
+            padding: 40px 30px;
+            border-radius: 3px;
+            box-shadow: 0 0 30px rgba(0, 0, 0, 0.1);
+        }
+
+    </style>
+</head>
+<body>
+<div class="container">
+    <div class="logout-main text-center">
+        <div class="image">
+            <img src="__CDN__/assets/img/info.svg" alt="" width="100" />
+        </div>
+        <h3 class="my-4" style="font-size:16px;">{:__('Are you sure you want to sign out?')}</h3>
+        <form name="form" id="logout-form" class="form-vertical" method="POST" action="#">
+            {:token()}
+            <div class="form-group">
+                <button type="submit" class="btn btn-primary btn-lg btn-block">{:__('Confirm sign out')}</button>
+                <button type="button" class="btn btn-default btn-lg btn-block mt-3" onclick="history.back()">{:__('Cancel')}</button>
+            </div>
+        </form>
+    </div>
+</div>
+{include file="common/script" /}
+</body>
+</html>

application/admin/view/layout/default.html

@@ -26,7 +26,7 @@
                                 </ol>
                                 <ol class="breadcrumb pull-right">
                                     {foreach $breadcrumb as $vo}
-                                    <li><a href="javascript:;" data-url="{$vo.url}">{$vo.title}</a></li>
+                                    <li><a href="javascript:;" data-url="{$vo.url|htmlentities}">{$vo.title|htmlentities}</a></li>
                                     {/foreach}
                                 </ol>
                             </div>

application/admin/view/user/group/add.html

@@ -22,7 +22,7 @@
 
             <div class="radio">
                 {foreach name="statusList" item="vo"}
-                <label for="row[status]-{$key}"><input id="row[status]-{$key}" name="row[status]" type="radio" value="{$key}" {in name="key" value="normal"}checked{/in} /> {$vo}</label>
+                <label for="row[status]-{$key|htmlentities}"><input id="row[status]-{$key|htmlentities}" name="row[status]" type="radio" value="{$key|htmlentities}" {in name="key" value="normal"}checked{/in} /> {$vo|htmlentities}</label>
                 {/foreach}
             </div>
 

application/admin/view/user/group/edit.html

@@ -22,7 +22,7 @@
 
             <div class="radio">
             {foreach name="statusList" item="vo"}
-            <label for="row[status]-{$key}"><input id="row[status]-{$key}" name="row[status]" type="radio" value="{$key}" {in name="key" value="$row.status"}checked{/in} /> {$vo}</label>
+            <label for="row[status]-{$key|htmlentities}"><input id="row[status]-{$key|htmlentities}" name="row[status]" type="radio" value="{$key|htmlentities}" {in name="key" value="$row.status"}checked{/in} /> {$vo|htmlentities}</label>
             {/foreach}
             </div>
 

application/api/controller/Common.php

@@ -39,37 +39,20 @@ class Common extends Api
      * 加载初始化
      *
      * @ApiParams (name="version", type="string", required=true, description="版本号")
-     * @ApiParams (name="lng", type="string", required=true, description="经度")
-     * @ApiParams (name="lat", type="string", required=true, description="纬度")
      */
     public function init()
     {
         if ($version = $this->request->request('version')) {
-            $lng = $this->request->request('lng');
-            $lat = $this->request->request('lat');
-
             //配置信息
             $upload = Config::get('upload');
-            //如果非服务端中转模式需要修改为中转
-            if ($upload['storage'] != 'local' && isset($upload['uploadmode']) && $upload['uploadmode'] != 'server') {
-                //临时修改上传模式为服务端中转
-                set_addon_config($upload['storage'], ["uploadmode" => "server"], false);
 
-                $upload = \app\common\model\Config::upload();
+            $uploaddata = [];
-                // 上传信息配置后
+            $uploaddata['cdnurl'] = $upload['cdnurl'] ?: cdnurl('', true);
-                Hook::listen("upload_config_init", $upload);
+            $uploaddata['uploadurl'] = url('/api/common/upload', '', false, true);
-
-                $upload = Config::set('upload', array_merge(Config::get('upload'), $upload));
-            }
-
-            $upload['cdnurl'] = $upload['cdnurl'] ? $upload['cdnurl'] : cdnurl('', true);
-            $upload['uploadurl'] = preg_match("/^((?:[a-z]+:)?\/\/)(.*)/i", $upload['uploadurl']) ? $upload['uploadurl'] : url($upload['storage'] == 'local' ? '/api/common/upload' : $upload['uploadurl'], '', false, true);
 
             $content = [
-                'citydata'    => Area::getCityFromLngLat($lng, $lat),
                 'versiondata' => Version::check($version),
-                'uploaddata'  => $upload,
+                'uploaddata'  => $uploaddata,
-                'coverdata'   => Config::get("cover"),
             ];
             $this->success('', $content);
         } else {
@@ -80,7 +63,7 @@ class Common extends Api
     /**
      * 上传文件
      * @ApiMethod (POST)
-     * @ApiParams (name="file", type="File", required=true, description="文件流")
+     * @ApiParams (name="file", type="file", required=true, description="文件流")
      */
     public function upload()
     {

application/api/controller/User.php

@@ -179,8 +179,15 @@ class User extends Api
             }
             $user->nickname = $nickname;
         }
+        if ($avatar) {
+            //判断是否匹配config('upload.cdnurl')开头以及当前$SERVER['HTTP_HOST']开头。
+            if (preg_match('/^' . preg_quote(config('upload.cdnurl') . '/', '/') . '/i', $avatar)
+                || preg_match('/^' . preg_quote(substr(config('upload.savekey'), 0, strpos(config('upload.savekey'), '{')), '/') . '/i', $avatar)
+                || preg_match('/^' . preg_quote($_SERVER['HTTP_HOST'] . '/', '/') . '/i', $avatar)) {
+                $user->avatar = $avatar;
+            }
+        }
         $user->bio = $bio;
-        $user->avatar = $avatar;
         $user->save();
         $this->success();
     }

application/common/controller/Backend.php

@@ -3,6 +3,7 @@
 namespace app\common\controller;
 
 use app\admin\library\Auth;
+use app\common\library\SelectPage;
 use think\Config;
 use think\Controller;
 use think\Hook;
@@ -10,7 +11,6 @@ use think\Lang;
 use think\Loader;
 use think\Model;
 use think\Session;
-use fast\Tree;
 use think\Validate;
 
 /**
@@ -459,140 +459,27 @@ class Backend extends Controller
 
     /**
      * Selectpage的实现方法
-     *
-     * 当前方法只是一个比较通用的搜索匹配,请按需重载此方法来编写自己的搜索逻辑,$where按自己的需求写即可
-     * 这里示例了所有的参数，所以比较复杂，实现上自己实现只需简单的几行即可
-     *
      */
     protected function selectpage()
     {
         //设置过滤方法
         $this->request->filter(['trim', 'strip_tags', 'htmlspecialchars']);
 
-        //搜索关键词,客户端输入以空格分开,这里接收为数组
+        $selectPage = new SelectPage($this->model, $this->selectpageFields);
-        $word = (array)$this->request->request("q_word/a");
+
-        //当前页
+        // 数据限制
-        $page = $this->request->request("pageNumber");
+        $dataLimitIds = $this->getDataLimitAdminIds();
-        //分页大小
+        if (is_array($dataLimitIds)) {
-        $pagesize = $this->request->request("pageSize");
+            $selectPage->setDataLimit($this->dataLimit, $this->dataLimitField, $dataLimitIds);
-        //搜索条件
-        $andor = $this->request->request("andOr", "and", "strtoupper");
-        //排序方式
-        $orderby = (array)$this->request->request("orderBy/a");
-        //显示的字段
-        $field = $this->request->request("showField");
-        //主键
-        $primarykey = $this->request->request("keyField");
-        //主键值
-        $primaryvalue = $this->request->request("keyValue");
-        //搜索字段
-        $searchfield = (array)$this->request->request("searchField/a");
-        //自定义搜索条件
-        $custom = (array)$this->request->request("custom/a");
-        //是否返回树形结构
-        $istree = $this->request->request("isTree", 0);
-        $ishtml = $this->request->request("isHtml", 0);
-        if ($istree) {
-            $word = [];
-            $pagesize = 999999;
         }
-        $order = [];
+
-        foreach ($orderby as $k => $v) {
+        try {
-            $order[$v[0]] = $v[1];
+            $result = $selectPage->execute($this->request->request());
+        } catch (\think\Exception $e) {
+            $this->error(__($e->getMessage()));
         }
-        $field = $field ? $field : 'name';
 
-        //如果有primaryvalue,说明当前是初始化传值
+        return json($result);
-        if ($primaryvalue !== null) {
-            $where = [$primarykey => ['in', $primaryvalue]];
-            $pagesize = 999999;
-        } else {
-            $where = function ($query) use ($word, $andor, $field, $searchfield, $custom) {
-                $logic = $andor == 'AND' ? '&' : '|';
-                $searchfield = is_array($searchfield) ? implode($logic, $searchfield) : $searchfield;
-                $searchfield = str_replace(',', $logic, $searchfield);
-                $word = array_filter(array_unique($word));
-                if (count($word) == 1) {
-                    $query->where($searchfield, "like", "%" . reset($word) . "%");
-                } else {
-                    $query->where(function ($query) use ($word, $searchfield) {
-                        foreach ($word as $index => $item) {
-                            $query->whereOr(function ($query) use ($item, $searchfield) {
-                                $query->where($searchfield, "like", "%{$item}%");
-                            });
-                        }
-                    });
-                }
-                if ($custom && is_array($custom)) {
-                    foreach ($custom as $k => $v) {
-                        if (is_array($v) && 2 == count($v)) {
-                            $query->where($k, trim($v[0]), $v[1]);
-                        } else {
-                            $query->where($k, '=', $v);
-                        }
-                    }
-                }
-            };
-        }
-        $adminIds = $this->getDataLimitAdminIds();
-        if (is_array($adminIds)) {
-            $this->model->where($this->dataLimitField, 'in', $adminIds);
-        }
-        $list = [];
-        $total = $this->model->where($where)->count();
-        if ($total > 0) {
-            if (is_array($adminIds)) {
-                $this->model->where($this->dataLimitField, 'in', $adminIds);
-            }
-
-            $fields = is_array($this->selectpageFields) ? $this->selectpageFields : ($this->selectpageFields && $this->selectpageFields != '*' ? explode(',', $this->selectpageFields) : []);
-
-            //如果有primaryvalue,说明当前是初始化传值,按照选择顺序排序
-            if ($primaryvalue !== null && preg_match("/^[a-z0-9_\-]+$/i", $primarykey)) {
-                $primaryvalue = array_unique(is_array($primaryvalue) ? $primaryvalue : explode(',', $primaryvalue));
-                //修复自定义data-primary-key为字符串内容时，给排序字段添加上引号
-                $primaryvalue = array_map(function ($value) {
-                    return '\'' . $value . '\'';
-                }, $primaryvalue);
-
-                $primaryvalue = implode(',', $primaryvalue);
-
-                $this->model->orderRaw("FIELD(`{$primarykey}`, {$primaryvalue})");
-            } else {
-                $this->model->order($order);
-            }
-
-            $datalist = $this->model->where($where)
-                ->page($page, $pagesize)
-                ->select();
-
-            foreach ($datalist as $index => $item) {
-                unset($item['password'], $item['salt']);
-                if ($this->selectpageFields == '*') {
-                    $result = [
-                        $primarykey => $item[$primarykey] ?? '',
-                        $field      => $item[$field] ?? '',
-                    ];
-                } else {
-                    $result = array_intersect_key(($item instanceof Model ? $item->toArray() : (array)$item), array_flip($fields));
-                }
-                $result['pid'] = isset($item['pid']) ? $item['pid'] : (isset($item['parent_id']) ? $item['parent_id'] : 0);
-                $list[] = $result;
-            }
-            if ($istree && !$primaryvalue) {
-                $tree = Tree::instance();
-                $tree->init(collection($list)->toArray(), 'pid');
-                $list = $tree->getTreeList($tree->getTreeArray(0), $field);
-                if (!$ishtml) {
-                    foreach ($list as &$item) {
-                        $item = str_replace(' ', ' ', $item);
-                    }
-                    unset($item);
-                }
-            }
-        }
-        //这里一定要返回有list这个字段,total是可选的,如果total<=list的数量,则会隐藏分页按钮
-        return json(['list' => $list, 'total' => $total]);
     }
 
     /**

application/common/library/Auth.php

@@ -224,6 +224,7 @@ class Auth
 
         if ($user->loginfailure >= 10 && time() - $user->loginfailuretime < 86400) {
             $this->setError('Please try again after 1 day');
+            return false;
         }
 
         if ($user->password != $this->getEncryptPassword($password, $user->salt)) {

application/common/library/Log.php

@@ -19,10 +19,8 @@ class Log extends AbstractLogger
      * @param array  $context
      *
      * @return void
-     *
-     * @throws \Psr\Log\InvalidArgumentException
      */
-    public function log($level, $message, array $context = array())
+    public function log($level, $message, array $context = [])
     {
         \think\Log::write($message);
     }

application/common/library/SelectPage.php

@@ -0,0 +1,447 @@
+<?php
+
+namespace app\common\library;
+
+use fast\Tree;
+use think\Db;
+use think\Exception;
+use think\Model;
+
+/**
+ * SelectPage 查询构建器
+ */
+class SelectPage
+{
+    /**
+     * 模型实例
+     * @var Model
+     */
+    protected $model;
+
+    /**
+     * 允许显示的字段
+     * @var array|string
+     */
+    protected $selectpageFields = '*';
+
+    /**
+     * 数据限制模式
+     * @var bool|string
+     */
+    protected $dataLimit = false;
+
+    /**
+     * 数据限制字段
+     * @var string
+     */
+    protected $dataLimitField = 'admin_id';
+
+    /**
+     * 允许的表字段列表
+     * @var array
+     */
+    protected $allowedFields = [];
+
+    /**
+     * 允许的操作符（ThinkPHP Builder::$exp 的键和值(不包含exp)，去重后保留小写）
+     * @var array
+     */
+    protected static $allowedOperators = [
+        'eq', 'neq', 'gt', 'egt', 'lt', 'elt',
+        '=', '<>', '>', '>=', '<', '<=',
+        'like', 'not like', 'notlike',
+        'in', 'not in', 'notin',
+        'between', 'not between', 'notbetween',
+        'null', 'not null', 'notnull',
+        'exists', 'not exists', 'notexists',
+        '> time', '< time', '>= time', '<= time',
+        'between time', 'not between time', 'notbetween time',
+    ];
+
+    /**
+     * 允许排序的字段
+     * @var array
+     */
+    protected $orderFields = [];
+
+    /**
+     * @param Model  $model  模型实例
+     * @param string $fields SelectPage可显示的字段
+     */
+    public function __construct(Model $model, $fields = '*')
+    {
+        $this->model = $model;
+        $this->selectpageFields = $fields;
+        $this->allowedFields = array_map('strtolower', $model->getTableFields());
+        $this->orderFields = $this->allowedFields;
+    }
+
+    /**
+     * 数据限制的ID集合
+     * @var array
+     */
+    protected $dataLimitIds = [];
+
+    /**
+     * 设置数据限制
+     * @param bool|string $dataLimit      auth/personal/false
+     * @param string      $dataLimitField 限制字段
+     * @param array       $dataLimitIds   允许的ID列表
+     * @return $this
+     */
+    public function setDataLimit($dataLimit, $dataLimitField = 'admin_id', array $dataLimitIds = [])
+    {
+        $this->dataLimit = $dataLimit;
+        $this->dataLimitField = $dataLimitField;
+        $this->dataLimitIds = $dataLimitIds;
+
+        return $this;
+    }
+
+    /**
+     * 应用数据限制条件（每次构建新查询链前调用）
+     * ThinkPHP 的 count()/select() 执行后会清空 model options，
+     * 所以需要在每次查询前重新注入 dataLimit 条件。
+     * @return $this
+     */
+    protected function applyDataLimit()
+    {
+        if ($this->dataLimit) {
+            $this->model->where($this->dataLimitField, 'in', $this->dataLimitIds);
+        }
+        return $this;
+    }
+
+    /**
+     * 执行查询
+     * @param array $params 请求参数
+     * @return array ['list' => [...], 'total' => int]
+     */
+    public function execute(array $params)
+    {
+        $keywordWords = $this->getArrayParam($params, 'q_word');
+        $page = $params['pageNumber'] ?? 1;
+        $pageSize = $params['pageSize'] ?? 10;
+        $andor = strtoupper($params['andOr'] ?? 'AND');
+        $orderBy = $this->getArrayParam($params, 'orderBy');
+        $showField = $params['showField'] ?? 'name';
+        $keyField = $params['keyField'] ?? '';
+        $keyValue = $params['keyValue'] ?? null;
+        $searchField = $this->getArrayParam($params, 'searchField');
+        $custom = $this->getArrayParam($params, 'custom');
+        $isTree = (bool)($params['isTree'] ?? 0);
+        $isHtml = (bool)($params['isHtml'] ?? 0);
+
+        // 树形模式强制参数
+        if ($isTree) {
+            $keywordWords = [];
+            $pageSize = 999999;
+        }
+
+        // 验证字段
+        $this->validateField($showField);
+        $this->validateField($keyField);
+
+        // 验证搜索字段
+        foreach ($searchField as $f) {
+            $this->validateField($f);
+        }
+
+        // 验证自定义条件的字段和操作符
+        $this->validateCustomConditions($custom);
+
+        // 构建排序
+        $order = $this->buildOrder($orderBy);
+
+        // 构建查询条件
+        $where = $this->buildWhere(
+            $keywordWords,
+            $andor,
+            $showField,
+            $searchField,
+            $custom,
+            $keyField,
+            $keyValue
+        );
+
+        // 执行总数统计
+        $total = $this->applyDataLimit()
+            ->model->where($where)
+            ->count();
+
+        if ($total <= 0) {
+            return ['list' => [], 'total' => 0];
+        }
+
+        // 排序处理
+        if ($keyValue !== null && $keyField) {
+            $this->applyPrimaryKeyOrder($keyField, $keyValue);
+        } else {
+            $this->model->order($order);
+        }
+
+        // 执行查询（count()会清空options，需重新应用dataLimit）
+        $dataList = $this->applyDataLimit()
+            ->model->where($where)
+            ->page($page, $pageSize)
+            ->select();
+
+        // 构建结果集
+        $list = $this->buildResultList($dataList, $showField, $keyField);
+
+        // 树形结构处理
+        if ($isTree && !$keyValue) {
+            $list = $this->buildTreeList($list, $showField, $isHtml);
+        }
+
+        return ['list' => $list, 'total' => $total];
+    }
+
+    /**
+     * 标准化字段为数组（支持逗号分隔字符串）
+     */
+    protected function normalizeField($field): array
+    {
+        if (is_array($field)) {
+            return $field;
+        }
+        if (is_string($field) && strpos($field, ',') !== false) {
+            return array_map('trim', explode(',', $field));
+        }
+        return $field !== '' ? [$field] : [];
+    }
+
+    /**
+     * 获取数组参数
+     */
+    protected function getArrayParam(array $params, string $key): array
+    {
+        $value = $params[$key] ?? [];
+        if (is_array($value)) {
+            return $value;
+        }
+        if (is_string($value) && strpos($value, ',') !== false) {
+            return array_map('trim', explode(',', $value));
+        }
+        if ($value === '' || $value === null) {
+            return [];
+        }
+        return [$value];
+    }
+
+    /**
+     * 验证字段名是否在允许列表中
+     */
+    protected function validateField(string $field)
+    {
+        $field = strtolower($field);
+        if (!in_array($field, $this->allowedFields, true)) {
+            throw new Exception('Invalid parameters');
+        }
+    }
+
+    /**
+     * 验证自定义搜索条件
+     */
+    protected function validateCustomConditions(array $custom)
+    {
+        foreach ($custom as $k => $v) {
+            $field = strtolower($k);
+            if (!in_array($field, $this->allowedFields, true)) {
+                throw new Exception('Invalid parameters');
+            }
+            // 如果操作符是数组形式传入，校验操作符合法性
+            if (is_array($v) && count($v) >= 2) {
+                $operator = strtolower(trim($v[0]));
+                if (!in_array($operator, self::$allowedOperators, true)) {
+                    throw new Exception('Invalid parameters');
+                }
+            }
+        }
+    }
+
+    /**
+     * 构建排序
+     */
+    protected function buildOrder(array $orderBy): array
+    {
+        $order = [];
+        foreach ($orderBy as $v) {
+            if (!isset($v[0], $v[1])) {
+                continue;
+            }
+            $field = strtolower($v[0]);
+            $direction = strtoupper($v[1]) === 'ASC' ? 'ASC' : 'DESC';
+            if (in_array($field, $this->orderFields, true)) {
+                $order[$field] = $direction;
+            }
+        }
+        return $order;
+    }
+
+    /**
+     * 构建查询条件
+     */
+    protected function buildWhere(
+        array  $keywordWords,
+        string $andor,
+        string $showField,
+        array  $searchField,
+        array  $custom,
+        string $keyField,
+               $keyValue
+    )
+    {
+        // 如果有 keyValue，按主键值精确查询
+        if ($keyValue !== null && $keyField) {
+            return [$keyField => ['in', is_array($keyValue) ? $keyValue : explode(',', (string)$keyValue)]];
+        }
+
+        return function ($query) use ($keywordWords, $andor, $showField, $searchField, $custom) {
+            // 关键词搜索
+            $searchFields = $this->resolveSearchFields($searchField, $showField, $andor);
+            $words = array_filter(array_unique($keywordWords));
+            if (!empty($words)) {
+                if (count($words) === 1) {
+                    $query->where($searchFields, 'like', '%' . reset($words) . '%');
+                } else {
+                    $query->where(function ($query) use ($words, $searchFields) {
+                        foreach ($words as $word) {
+                            $query->whereOr($searchFields, 'like', '%' . $word . '%');
+                        }
+                    });
+                }
+            }
+
+            // 自定义条件
+            foreach ($custom as $k => $v) {
+                if (is_array($v) && count($v) >= 2) {
+                    $operator = strtolower(trim($v[0]));
+                    $value = $v[1];
+                    $query->where(strtolower($k), $operator, $value);
+                } else {
+                    $query->where(strtolower($k), '=', $v);
+                }
+            }
+        };
+    }
+
+    /**
+     * 解析搜索字段
+     */
+    protected function resolveSearchFields(array $searchField, string $showField, string $andor): string
+    {
+        // 过滤掉不在允许列表中的字段
+        $validFields = [];
+        $inputFields = array_filter(array_map('trim', $searchField));
+
+        foreach ($inputFields as $field) {
+            $lowerField = strtolower($field);
+            if (in_array($lowerField, $this->allowedFields, true)) {
+                $validFields[] = $lowerField;
+            }
+        }
+
+        if (empty($validFields)) {
+            $lowerShow = strtolower($showField);
+            if (in_array($lowerShow, $this->allowedFields, true)) {
+                return $lowerShow;
+            }
+            return 'id';
+        }
+
+        $logic = $andor === 'AND' ? '&' : '|';
+        return implode($logic, $validFields);
+    }
+
+    /**
+     * 应用主键排序
+     */
+    protected function applyPrimaryKeyOrder(string $keyField, $keyValue)
+    {
+        $values = is_array($keyValue) ? $keyValue : explode(',', (string)$keyValue);
+        $values = array_unique(array_filter(array_map(function ($v) {
+            return trim((string)$v);
+        }, $values)));
+
+        if (empty($values)) {
+            return;
+        }
+
+        $quotedValues = implode(',', array_map(function ($v) {
+            return Db::quote($v);
+        }, $values));
+
+        $this->model->orderRaw("FIELD(`{$keyField}`, {$quotedValues})");
+    }
+
+    /**
+     * 构建结果列表
+     */
+    protected function buildResultList($dataList, string $showField, string $keyField): array
+    {
+        $list = [];
+        $fields = $this->resolveSelectpageFields();
+
+        foreach ($dataList as $item) {
+            $row = $item instanceof Model ? $item->toArray() : (array)$item;
+
+            // 移除敏感字段
+            unset($row['password'], $row['salt']);
+
+            if ($this->selectpageFields === '*') {
+                $result = [
+                    $keyField  => $row[$keyField] ?? '',
+                    $showField => $row[$showField] ?? '',
+                ];
+            } else {
+                $result = array_intersect_key($row, array_flip($fields));
+            }
+
+            // 添加父级ID
+            $result['pid'] = $row['pid'] ?? ($row['parent_id'] ?? 0);
+
+            // HTML 转义
+            $result = array_map(function ($value) {
+                return $value === null ? '' : htmlentities((string)$value, ENT_QUOTES, 'UTF-8');
+            }, $result);
+
+            $list[] = $result;
+        }
+
+        return $list;
+    }
+
+    /**
+     * 构建树形列表
+     */
+    protected function buildTreeList(array $list, string $showField, bool $isHtml): array
+    {
+        $tree = Tree::instance();
+        $tree->init($list, 'pid');
+        $result = $tree->getTreeList($tree->getTreeArray(0), $showField);
+
+        if (!$isHtml) {
+            foreach ($result as &$item) {
+                $item = str_replace('&nbsp;', ' ', $item);
+            }
+            unset($item);
+        }
+
+        return $result;
+    }
+
+    /**
+     * 解析 SelectPage 显示字段
+     */
+    protected function resolveSelectpageFields(): array
+    {
+        if (is_array($this->selectpageFields)) {
+            return $this->selectpageFields;
+        }
+        if ($this->selectpageFields && $this->selectpageFields !== '*') {
+            return explode(',', $this->selectpageFields);
+        }
+        return [];
+    }
+}

application/common/library/Upload.php

@@ -86,6 +86,11 @@ class Upload
      */
     protected function checkExecutable()
     {
+        //禁止上传以.开头的文件
+        if (substr($this->fileInfo['name'], 0, 1) === '.') {
+            throw new UploadException(__('Uploaded file format is limited'));
+        }
+
         //禁止上传PHP和HTML文件
         if (in_array($this->fileInfo['type'], ['text/x-php', 'text/html']) || in_array($this->fileInfo['suffix'], ['php', 'html', 'htm', 'phar', 'phtml']) || preg_match("/^php(.*)/i", $this->fileInfo['suffix'])) {
             throw new UploadException(__('Uploaded file format is limited'));
@@ -107,8 +112,7 @@ class Upload
             throw new UploadException(__('Uploaded file format is limited'));
         }
         //验证文件后缀
-        if ($this->config['mimetype'] === '*'
+        if (in_array($this->fileInfo['suffix'], $mimetypeArr) || in_array('.' . $this->fileInfo['suffix'], $mimetypeArr)
-            || in_array($this->fileInfo['suffix'], $mimetypeArr) || in_array('.' . $this->fileInfo['suffix'], $mimetypeArr)
             || in_array($typeArr[0] . "/*", $mimetypeArr) || (in_array($this->fileInfo['type'], $mimetypeArr) && stripos($this->fileInfo['type'], '/') !== false)) {
             return true;
         }

application/common/model/Config.php

@@ -219,7 +219,7 @@ class Config extends Model
         }
         file_put_contents(
             CONF_PATH . 'extra' . DS . 'site.php',
-            '<?php' . "\n\nreturn " . var_export_short($config) . ";\n"
+            '<?php' . "\n\nreturn " . var_export($config, true) . ";\n"
         );
         return true;
     }

application/common/model/User.php

@@ -7,6 +7,10 @@ use think\Model;
 
 /**
  * 会员模型
+ * @method static mixed getByUsername($str) 通过用户名查询用户
+ * @method static mixed getByNickname($str) 通过昵称查询用户
+ * @method static mixed getByMobile($str) 通过手机查询用户
+ * @method static mixed getByEmail($str) 通过邮箱查询用户
  */
 class User extends Model
 {

application/common/view/tpl/dispatch_jump.tpl

@@ -9,7 +9,7 @@
         *{box-sizing:border-box;margin:0;padding:0;font-family:Lantinghei SC,Open Sans,Arial,Hiragino Sans GB,Microsoft YaHei,"微软雅黑",STHeiti,WenQuanYi Micro Hei,SimSun,sans-serif;-webkit-font-smoothing:antialiased}
         body{padding:70px 50px;background:#f4f6f8;font-weight:400;font-size:1pc;-webkit-text-size-adjust:none;color:#333}
         a{outline:0;color:#3498db;text-decoration:none;cursor:pointer}
-        .system-message{margin:20px auto;padding:50px 0px;background:#fff;box-shadow:0 0 30px hsla(0,0%,39%,.06);text-align:center;width:100%;border-radius:2px;}
+        .system-message{margin:20px auto;padding:80px 0px;background:#fff;box-shadow:0 0 30px hsla(0,0%,39%,.06);text-align:center;width:100%;border-radius:10px;}
         .system-message h1{margin:0;margin-bottom:9pt;color:#444;font-weight:400;font-size:30px}
         .system-message .jump,.system-message .image{margin:20px 0;padding:0;padding:10px 0;font-weight:400}
         .system-message .jump{font-size:14px}
@@ -32,7 +32,7 @@
     <div class="image">
         <img src="__CDN__/assets/img/{$codeText}.svg" alt="" width="120" />
     </div>
-    <h1>{$msg}</h1>
+    <h1>{$msg|htmlentities}</h1>
     {if $url}
         <p class="jump">
             {:__('This page will be re-directed in %s seconds', '<span id="wait">' . $wait . '</span>')}
@@ -41,18 +41,19 @@
     <p class="clearfix">
         <a href="__PUBLIC__" class="btn btn-grey">{:__('Go back')}</a>
         {if $url}
-            <a href="{$url|htmlentities}" class="btn btn-primary">{:__('Jump now')}</a>
+            <a id="href" href="{$url|htmlentities}" class="btn btn-primary">{:__('Jump now')}</a>
         {/if}
     </p>
 </div>
 {if $url}
     <script type="text/javascript">
         (function () {
-            var wait = document.getElementById('wait');
+            var wait = document.getElementById('wait'),
+                href = document.getElementById('href').href;
             var interval = setInterval(function () {
                 var time = --wait.innerHTML;
                 if (time <= 0) {
-					location.href = "{$url|htmlentities}";
+                    location.href = href;
                     clearInterval(interval);
                 }
             }, 1000);
@@ -60,4 +61,4 @@
     </script>
 {/if}
 </body>
-</html>
+</html>

application/config.php

@@ -302,7 +302,7 @@ return [
         //允许跨域的域名,多个以,分隔
         'cors_request_domain'   => 'localhost,127.0.0.1',
         //版本号
-        'version'               => '1.5.2.20240906',
+        'version'               => '1.6.5.20260602',
         //API接口地址
         'api_url'               => 'https://api.fastadmin.net',
     ],

application/extra/upload.php

@@ -20,12 +20,17 @@ return [
     'maxsize'   => '10mb',
     /**
      * 可上传的文件类型
+     * 如配置允许 pdf,ppt,docx,svg 等可能含有脚本的文件时，请先从服务器配置此类文件直接下载而不是预览
      */
     'mimetype'  => 'jpg,png,bmp,jpeg,gif,webp,zip,rar,wav,mp4,mp3,webm',
     /**
      * 是否支持批量上传
      */
     'multiple'  => false,
+    /**
+     * 上传超时时长，这里仅用于JS上传超时控制
+     */
+    'timeout'  => 60000,
     /**
      * 是否支持分片上传
      */

application/index/controller/User.php

@@ -195,16 +195,22 @@ class User extends Frontend
      */
     public function logout()
     {
+
         if ($this->request->isPost()) {
+            // 加强校验referer是否来自服务器
+            $referer = $this->request->server('HTTP_REFERER');
+            if (!$referer || strtolower(parse_url($referer, PHP_URL_HOST)) != strtolower($this->request->host())) {
+                $this->error(__('Invalid request'));
+            }
+
             $this->token();
             //退出本站
             $this->auth->logout();
             $this->success(__('Logout successful'), url('user/index'));
         }
-        $html = "<form id='logout_submit' name='logout_submit' action='' method='post'>" . token() . "<input type='submit' value='ok' style='display:none;'></form>";
-        $html .= "<script>document.forms['logout_submit'].submit();</script>";
 
-        return $html;
+        $this->view->assign('title', __('Logout'));
+        return $this->view->fetch();
     }
 
     /**

application/index/lang/zh-cn/user.php

@@ -57,14 +57,17 @@ return [
     'Change password successful'                 => '修改密码成功',
     'Password and confirm password don\'t match' => '两次输入的密码不一致',
     'Captcha is incorrect'                       => '验证码不正确',
+    'Please try again after 1 day'               => '请于1天后再尝试登录',
     'Logged in successful'                       => '登录成功',
     'Logout successful'                          => '退出成功',
     'User center already closed'                 => '会员中心已经关闭',
     'Don\'t have an account? Sign up'            => '还没有账号？点击注册',
-    'Already have an account? Sign in'            => '已经有账号？点击登录',
+    'Already have an account? Sign in'           => '已经有账号？点击登录',
     'Operation failed'                           => '操作失败',
     'Invalid parameters'                         => '参数不正确',
     'Change password failure'                    => '修改密码失败',
+    'Are you sure you want to sign out?'         => '确定要退出登录吗？',
+    'Confirm sign out'                           => '确定退出',
     'All'                                        => '全部',
     'Url'                                        => '物理路径',
     'Imagewidth'                                 => '宽度',

application/index/view/common/script.html

@@ -1 +1 @@
-<script src="__CDN__/assets/js/require{$Think.config.app_debug?'':'.min'}.js" data-main="__CDN__/assets/js/require-frontend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>
+<script src="__CDN__/assets/js/require{$Think.config.app_debug?'':'.min'}.js" data-main="__CDN__/assets/js/require-frontend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>

application/index/view/user/logout.html

@@ -0,0 +1,17 @@
+<div id="content-container" class="container">
+    <div class="user-section login-section">
+        <div class="login-main text-center">
+            <div class="image">
+                <img src="__CDN__/assets/img/info.svg" alt="" width="100" />
+            </div>
+            <h3 class="my-4" style="font-size:16px;">{:__('Are you sure you want to sign out?')}</h3>
+            <form name="form" id="logout-form" class="form-vertical" method="POST" action="#">
+                {:token()}
+                <div class="form-group">
+                    <button type="submit" class="btn btn-primary btn-lg btn-block">{:__('Confirm sign out')}</button>
+                    <button type="button" class="btn btn-default btn-lg btn-block mt-3" onclick="history.back()">{:__('Cancel')}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>

bower.json

@@ -1,34 +0,0 @@
-{
-  "name": "fastadmin",
-  "description": "the fastest admin framework",
-  "main": "",
-  "license": "Apache2.0",
-  "homepage": "https://www.fastadmin.net",
-  "private": true,
-  "dependencies": {
-    "jquery": "^3.7.0",
-    "bootstrap": "^3.3.7",
-    "font-awesome": "^4.6.1",
-    "bootstrap-table": "fastadmin-bootstraptable#~1.11.5",
-    "jstree": "~3.3.2",
-    "moment": "~2.29.0",
-    "toastr": "~2.1.3",
-    "eonasdan-bootstrap-datetimepicker": "~4.17.43",
-    "bootstrap-select": "~1.13.18",
-    "require-css": "~0.1.8",
-    "tableExport.jquery.plugin": "~1.10.3",
-    "jquery-slimscroll": "~1.3.8",
-    "jquery.cookie": "~1.4.1",
-    "Sortable": "~1.10.0",
-    "nice-validator": "karsonzhang/fastadmin-nicevalidator#~1.1.6",
-    "art-template": "~3.1.3",
-    "bootstrap-daterangepicker": "~2.1.25",
-    "fastadmin-citypicker": "~1.3.1",
-    "fastadmin-cxselect": "~1.4.0",
-    "fastadmin-dragsort": "~1.0.0",
-    "fastadmin-addtabs": "~1.0.8",
-    "fastadmin-selectpage": "~1.0.12",
-    "fastadmin-layer": "~3.5.1",
-    "bootstrap-slider": "*"
-  }
-}

composer.json

@@ -1,5 +1,5 @@
 {
-    "name": "karsonzhang/fastadmin",
+    "name": "fastadminnet/fastadmin",
     "description": "the fastest admin framework",
     "type": "project",
     "keywords": [
@@ -21,15 +21,15 @@
         "topthink/think-installer": "^1.0.14",
         "topthink/think-queue": "1.1.6",
         "topthink/think-helper": "^1.0.7",
-        "karsonzhang/fastadmin-addons": "~1.4.0",
+        "fastadminnet/fastadmin-addons": "~1.4.0",
+        "fastadminnet/fastadmin-mailer": "^2.0.0",
         "overtrue/pinyin": "^3.0",
         "phpoffice/phpspreadsheet": "^1.29.1",
         "overtrue/wechat": "^4.6",
         "ext-json": "*",
         "ext-curl": "*",
         "ext-pdo": "*",
-        "ext-bcmath": "*",
+        "ext-bcmath": "*"
-        "txthinking/mailer": "^2.0"
     },
     "config": {
         "preferred-install": "dist",

extend/fast/Date.php

@@ -124,7 +124,7 @@ class Date
      */
     public static function human($remote, $local = null)
     {
-        $time_diff = (is_null($local) || $local ? time() : $local) - $remote;
+        $time_diff = (is_null($local) ? time() : $local) - $remote;
         $tense = $time_diff < 0 ? 'after' : 'ago';
         $time_diff = abs($time_diff);
         $chunks = [
@@ -146,7 +146,7 @@ class Date
                 break;
             }
         }
-        return __("%d $name%s $tense", $count, ($count > 1 ? 's' : ''));
+        return __("%d $name%s $tense", [$count, ($count > 1 ? 's' : '')]);
     }
 
     /**

extend/fast/Random.php

@@ -14,7 +14,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function alnum($len = 6)
+    public static function alnum(int $len = 6): string
     {
         return self::build('alnum', $len);
     }
@@ -25,7 +25,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function alpha($len = 6)
+    public static function alpha(int $len = 6): string
     {
         return self::build('alpha', $len);
     }
@@ -36,7 +36,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function numeric($len = 4)
+    public static function numeric(int $len = 4): string
     {
         return self::build('numeric', $len);
     }
@@ -47,7 +47,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function nozero($len = 4)
+    public static function nozero(int $len = 4): string
     {
         return self::build('nozero', $len);
     }
@@ -58,7 +58,7 @@ class Random
      * @param int    $len  长度
      * @return string
      */
-    public static function build($type = 'alnum', $len = 8)
+    public static function build(string $type = 'alnum', int $len = 8): string
     {
         switch ($type) {
             case 'alpha':
@@ -93,7 +93,7 @@ class Random
      * 获取全球唯一标识
      * @return string
      */
-    public static function uuid()
+    public static function uuid(): string
     {
         return sprintf(
             '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',

extend/fast/Tree.php

@@ -325,7 +325,7 @@ class Tree
                     '@url'       => $childdata || !isset($value['@url']) ? "javascript:;" : $value['@url'],
                     '@addtabs'   => $childdata || !isset($value['@url']) ? "" : (stripos($value['@url'], "?") !== false ? "&" : "?") . "ref=addtabs",
                     '@caret'     => ($childdata && (!isset($value['@badge']) || !$value['@badge']) ? '<i class="fa fa-angle-left"></i>' : ''),
-                    '@badge'     => isset($value['@badge']) ? $value['@badge'] : '',
+                    '@badge'     => $value['@badge'] ?? '',
                     '@class'     => ($selected ? ' active' : '') . ($disabled ? ' disabled' : '') . ($childdata ? ' treeview' . (config('fastadmin.show_submenu') ? ' treeview-open' : '') : ''),
                 );
                 $str .= strtr($nstr, $value);
@@ -422,7 +422,7 @@ class Tree
     {
         $arr = [];
         foreach ($data as $k => $v) {
-            $childlist = isset($v['childlist']) ? $v['childlist'] : [];
+            $childlist = $v['childlist'] ?? [];
             unset($v['childlist']);
             $v[$field] = $v['spacer'] . ' ' . $v[$field];
             $v['haschild'] = $childlist ? 1 : 0;

package.json

@@ -0,0 +1,109 @@
+{
+  "name": "fastadmin",
+  "version": "1.6.1",
+  "description": "FastAdmin是一款基于ThinkPHP+Bootstrap的极速后台开发框架。",
+  "scripts": {
+    "build": "grunt"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git@gitee.com:karson/fastadmin.git"
+  },
+  "dependencies": {
+    "bootstrap": "npm:fastadmin-bootstrap@^3.4.1",
+    "bootstrap-daterangepicker": "~2.1.25",
+    "bootstrap-select": "^1.13.18",
+    "bootstrap-slider": "^11.0.2",
+    "eonasdan-bootstrap-datetimepicker": "^4.17.49",
+    "fastadmin-addtabs": "^1.0.8",
+    "fastadmin-arttemplate": "^3.1.4",
+    "fastadmin-bootstraptable": "^1.11.12",
+    "fastadmin-citypicker": "^1.3.6",
+    "fastadmin-cxselect": "^1.4.0",
+    "fastadmin-dragsort": "^1.0.5",
+    "fastadmin-layer": "^3.5.6",
+    "fastadmin-selectpage": "^1.1.1",
+    "fastadmin-nicevalidator": "^1.1.6",
+    "art-template": "npm:fastadmin-arttemplate@^3.1.4",
+    "bootstrap-table": "npm:fastadmin-bootstraptable@^1.11.12",
+    "nice-validator": "npm:fastadmin-nicevalidator@^1.1.6",
+    "font-awesome": "^4.6.1",
+    "jquery": "^3.7.1",
+    "jquery-slimscroll": "~1.3.8",
+    "jquery.cookie": "~1.4.1",
+    "jstree": "~3.3.2",
+    "moment": "^2.10",
+    "require-css": "~0.1.8",
+    "sortablejs": "^1.12.0",
+    "tableexport.jquery.plugin": "^1.20.0",
+    "toastr": "~2.1.3"
+  },
+  "author": "FastAdmin",
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "grunt": "^1.5.3",
+    "grunt-contrib-clean": "^2.0.1",
+    "grunt-contrib-copy": "^1.0.0",
+    "jsonminify": "^0.4.2",
+    "parse-config-file": "^1.0.4"
+  },
+  "overrides": {
+    "canvg": {
+      "xmldom": "^0.7.0"
+    },
+    "tableexport.jquery.plugin": {
+      "xlsx": "npm:@e965/xlsx@^0.20.3"
+    },
+    "eonasdan-bootstrap-datetimepicker": {
+      "moment-timezone": "^0.5.35"
+    }
+  },
+  "dists": {
+    "art-template": "dist/**",
+    "bootstrap": "dist/**",
+    "bootstrap-daterangepicker": [
+      "daterangepicker.js",
+      "daterangepicker.css"
+    ],
+    "bootstrap-select": "dist/**",
+    "bootstrap-slider": [
+      "dist/**",
+      "*.css",
+      "*.js"
+    ],
+    "coloris": [
+      "dist/umd/**",
+      "dist/*.css"
+    ],
+    "eonasdan-bootstrap-datetimepicker": "build/**",
+    "fastadmin-addtabs": "*.js",
+    "fastadmin-bootstraptable": "dist/**",
+    "fastadmin-citypicker": "dist/**",
+    "fastadmin-cxselect": "js/**",
+    "fastadmin-dragsort": "*.js",
+    "fastadmin-layer": "dist/**",
+    "fastadmin-selectpage": "*",
+    "font-awesome": [
+      "css/**",
+      "fonts/**"
+    ],
+    "jquery": "dist/**",
+    "jquery-slimscroll": "*.js",
+    "jquery.cookie": "*.js",
+    "jstree": "dist/**",
+    "moment": [
+      "moment.js",
+      "locale/**"
+    ],
+    "nice-validator": "dist/**",
+    "require-css": "*.js",
+    "sortablejs": "*.js",
+    "tableexport.jquery.plugin": "tableExport.min.js",
+    "toastr": [
+      "*.less",
+      "*.css",
+      "*.js",
+      "build/**"
+    ]
+  }
+}

public/assets/css/backend.css

@@ -3,7 +3,7 @@
 @import url("../css/skins/skin-black-blue.css");
 @import url("../css/iconfont.css");
 @import url("../libs/font-awesome/css/font-awesome.min.css");
-@import url("../libs/toastr/toastr.min.css");
+@import url("../libs/toastr/build/toastr.min.css");
 @import url("../libs/fastadmin-layer/dist/theme/default/layer.css");
 @import url("../libs/bootstrap-table/dist/bootstrap-table.min.css");
 @import url("../libs/eonasdan-bootstrap-datetimepicker/build/css/bootstrap-datetimepicker.min.css");
@@ -11,7 +11,7 @@
 @import url("../libs/nice-validator/dist/jquery.validator.css");
 @import url("../libs/bootstrap-select/dist/css/bootstrap-select.min.css");
 @import url("../libs/fastadmin-selectpage/selectpage.css");
-@import url("../libs/bootstrap-slider/slider.css");
+@import url("../libs/bootstrap-slider/dist/css/bootstrap-slider.css");
 .m-0 {
   margin-top: 0px !important;
   margin-right: 0px !important;

public/assets/js/backend/addon.js

@@ -165,7 +165,10 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                             title: __('Operate'),
                             table: table,
                             formatter: Controller.api.formatter.operate,
-                            align: 'right'
+                            align: 'right',
+                            cellStyle: function (value, row, index) {
+                                return {css: {'min-width': '158px'}};
+                            }
                         },
                     ]
                 ],
@@ -238,6 +241,27 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                             Layer.close(index);
                         });
                         return false;
+                    } else if (ret && ret.code === -3) {
+                        //插件目录发现影响全局的文件
+                        Layer.open({
+                            content: Template("conflicttpl", ret.data),
+                            shade: 0.8,
+                            area: area,
+                            title: __('Warning'),
+                            btn: [__('Continue install'), __('Cancel')],
+                            end: function () {
+
+                            },
+                            yes: function (index) {
+                                up.removeFile(file);
+                                file.force = true;
+                                up.uploadFile(file);
+                                Layer.close(index);
+                            }
+                        });
+
+                    } else {
+                        Layer.alert(ret.msg, {title: __('Warning'), icon: 0});
                     }
                 });
 
@@ -480,7 +504,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                         //如果登录已经超时,重新提醒登录
                         if (uid && uid != ret.data.uid) {
                             Controller.api.userinfo.set(null);
-                            $(".operate[data-name='" + name + "'] .btn-install").trigger("click");
+                            $(".operate[data-name='" + name + "'] .btn-install:first").trigger("click");
                             return;
                         }
                         top.Fast.api.open(ret.data.payurl, __('Pay now'), {

public/assets/js/backend/auth/rule.js

@@ -20,7 +20,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
             table.bootstrapTable({
                 url: $.fn.bootstrapTable.defaults.extend.index_url,
                 sortName: '',
-                escape: false,
+                escape: true,
                 columns: [
                     [
                         {field: 'state', checkbox: true,},
@@ -180,7 +180,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
                 var iconfunc = function () {
                     Layer.open({
                         type: 1,
-                        area: ['99%', '98%'], //宽高
+                        area: ['80%', '80%'], //宽高
                         content: Template('chooseicontpl', {iconlist: iconlist})
                     });
                 };
@@ -192,8 +192,8 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
                 });
                 $(document).on('click', ".btn-search-icon", function () {
                     if (iconlist.length == 0) {
-                        $.get(Config.site.cdnurl + "/assets/libs/font-awesome/less/variables.less", function (ret) {
+                        $.get(Config.site.cdnurl + "/assets/libs/font-awesome/css/font-awesome.css", function (ret) {
-                            var exp = /fa-var-(.*):/ig;
+                            var exp = /fa-(.*):before/ig;
                             var result;
                             while ((result = exp.exec(ret)) != null) {
                                 iconlist.push(result[1]);

public/assets/js/backend/general/attachment.js

@@ -167,7 +167,7 @@ define(['jquery', 'bootstrap', 'backend', 'form', 'table'], function ($, undefin
                         {
                             field: 'operate', title: __('Operate'), width: 85, events: {
                                 'click .btn-chooseone': function (e, value, row, index) {
-                                    Fast.api.close({url: row.url, multiple: multiple});
+                                    Fast.api.close($.extend({multiple: multiple}, row));
                                 },
                             }, formatter: function () {
                                 return '<a href="javascript:;" class="btn btn-danger btn-chooseone btn-xs"><i class="fa fa-check"></i> ' + __('Choose') + '</a>';

public/assets/js/backend/index.js

@@ -333,7 +333,7 @@ define(['jquery', 'bootstrap', 'backend', 'addtabs', 'adminlte', 'form'], functi
 
             // 切换菜单栏
             $(document).on("click", ".sidebar-toggle", function () {
-                setTimeout(function(){
+                setTimeout(function () {
                     var value = $("body").hasClass("sidebar-collapse") ? 1 : 0;
                     setTimeout(function () {
                         $(window).trigger("resize");
@@ -381,6 +381,24 @@ define(['jquery', 'bootstrap', 'backend', 'addtabs', 'adminlte', 'form'], functi
                 }
             });
 
+            $(document).on("click", "a[href*='index/logout']", function () {
+                var that = this;
+                $.ajax({
+                    type: 'GET', dataType: 'html', url: $(that).attr("href"),
+                    success: function (data, status, xhr) {
+                        Fast.api.ajax({url: $(that).attr("href"), loading: false, data: {__token__: xhr.getResponseHeader('__token__')}}, function (data, ret) {
+                            Layer.msg(ret.msg, {icon: 1, time: 1500}, function () {
+                                location.reload();
+                            });
+                            return false;
+                        });
+                    }, error: function (xhr, type) {
+                        Layer.msg(__('Network error'), {icon: 2});
+                    }
+                });
+                return false;
+            });
+
             $(window).resize();
 
         },

public/assets/js/backend/user/rule.js

@@ -21,7 +21,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefin
                 url: $.fn.bootstrapTable.defaults.extend.index_url,
                 pk: 'id',
                 sortName: 'weigh',
-                escape: false,
+                escape: true,
                 columns: [
                     [
                         {checkbox: true},

public/assets/js/backend/user/user.js

@@ -21,6 +21,8 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefin
                 url: $.fn.bootstrapTable.defaults.extend.index_url,
                 pk: 'id',
                 sortName: 'user.id',
+                fixedColumns: true,
+                fixedRightNumber: 1,
                 columns: [
                     [
                         {checkbox: true},

public/assets/js/bootstrap-table-commonsearch.js

@@ -157,7 +157,7 @@
             } else {
                 key = isArray ? value : key;
             }
-            optionList.push(sprintf("<option value='" + key + "' %s>" + value + "</option>", key == vObjCol.defaultValue ? 'selected' : ''));
+            optionList.push(sprintf("<option value='" + Fast.api.escape(key) + "' %s>" + Fast.api.escape(value) + "</option>", key == vObjCol.defaultValue ? 'selected' : ''));
         });
         return optionList;
     };
@@ -208,7 +208,7 @@
             } else {
                 value = process ? process(obj.val()) : obj.val();
             }
-            if (removeempty && (value == '' || value == null || ($.isArray(value) && value.length == 0)) && !sym.match(/null/i)) {
+            if (removeempty && (value === '' || value == null || ($.isArray(value) && value.length === 0)) && !sym.match(/null/i)) {
                 return true;
             }
 
@@ -268,7 +268,7 @@
             return "Common search";
         },
         formatCommonSubmitButton: function () {
-            return "Submit";
+            return "Search";
         },
         formatCommonResetButton: function () {
             return "Reset";

public/assets/js/bootstrap-table-template.js

@@ -4,7 +4,7 @@
  * @author: karson
  * @version: v0.0.1
  *
- * @update 2017-06-24 <http://github.com/karsonzhang/fastadmin>
+ * @update 2017-06-24 <http://github.com/fastadminnet/fastadmin>
  */
 
 !function ($) {

public/assets/js/frontend.js

@@ -100,6 +100,24 @@ define(['fast', 'template', 'moment'], function (Fast, Template, Moment) {
             $(document).on("click", ".sidebar-toggle", function () {
                 $("body").toggleClass("sidebar-open");
             });
+
+            $(document).on("click", "a[href*='user/logout']", function () {
+                var that = this;
+                $.ajax({
+                    type: 'GET', dataType: 'html', url: $(that).attr("href"),
+                    success: function (data, status, xhr) {
+                        Fast.api.ajax({url: $(that).attr("href"), loading:false, data: {__token__: xhr.getResponseHeader('__token__')}}, function (data, ret) {
+                            Layer.msg(ret.msg, {icon: 1, time: 1500}, function () {
+                                location.reload();
+                            });
+                            return false;
+                        });
+                    }, error: function (xhr, type) {
+                        Layer.msg(__('Network error'), {icon: 2});
+                    }
+                });
+                return false;
+            });
         }
     };
     Frontend.api = $.extend(Fast.api, Frontend.api);

public/assets/js/require-form.js

@@ -102,6 +102,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                 //绑定select元素事件
                 if ($(".selectpicker", form).length > 0) {
                     require(['bootstrap-select', 'bootstrap-select-lang'], function () {
+                        $.fn.selectpicker.Constructor.BootstrapVersion = '3';
                         $('.selectpicker', form).selectpicker();
                         $(form).on("reset", function () {
                             setTimeout(function () {
@@ -218,7 +219,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         };
                         var origincallback = function (start, end) {
                             $(this.element).val(start.format(this.locale.format) + " - " + end.format(this.locale.format));
-                            $(this.element).trigger('change');
+                            $(this.element).trigger('change').trigger('validate');
                         };
                         $(".datetimerange", form).each(function () {
                             var callback = typeof $(this).data('callback') == 'function' ? $(this).data('callback') : origincallback;
@@ -226,7 +227,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                 callback.call(picker, picker.startDate, picker.endDate);
                             });
                             $(this).on('cancel.daterangepicker', function (ev, picker) {
-                                $(this).val('').trigger('change');
+                                $(this).val('').trigger('change').trigger('validate');
                             });
                             $(this).daterangepicker($.extend(true, {}, options, $(this).data() || {}, $(this).data("daterangepicker-options") || {}));
                         });
@@ -294,6 +295,9 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                     var url = Config.upload.fullmode ? Fast.api.cdnurl(data.url) : data.url;
                                     $("#" + input_id).val(url).trigger("change").trigger("validate");
                                 }
+
+                                // 触发选择文件自定义事件
+                                button.trigger("fa.event.selectedfile", data);
                             }
                         });
                         return false;
@@ -567,7 +571,9 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         }
                     };
                     // @formatter:on
+                    var $disabledElements = form.find(':disabled').removeAttr('disabled');
                     var dataArr = form.serializeArray(), dataObj = {}, fieldName, fieldValue;
+                    $disabledElements.attr('disabled', 'disabled');
                     $(dataArr).each(function (i, field) {
                         fieldName = field.name;
                         fieldValue = field.value;

public/assets/js/require-table.js

@@ -131,7 +131,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         return __('Common search');
                     },
                     formatCommonSubmitButton: function () {
-                        return __('Submit');
+                        return __('Search');
                     },
                     formatCommonResetButton: function () {
                         return __('Reset');
@@ -764,7 +764,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         suffix = /[\.]?([a-zA-Z0-9]+)$/.exec(value);
                         suffix = suffix ? suffix[1] : 'file';
                         url = Fast.api.fixurl("ajax/icon?suffix=" + suffix);
-                        html.push('<a href="' + value + '" target="_blank"><img src="' + url + '" class="' + classname + '"></a>');
+                        html.push('<a href="' + value + '" target="_blank"><img src="' + url + '" class="' + classname + '" width="30" height="30"></a>');
                     });
                     return html.join(' ');
                 },
@@ -788,6 +788,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     if (typeof this.custom !== 'undefined') {
                         custom = $.extend(custom, this.custom);
                     }
+                    value = row[this.field] || value;
                     value = value == null || value.length === 0 ? '' : value.toString();
                     var keys = typeof this.searchList === 'object' ? Object.keys(this.searchList) : [];
                     var index = keys.indexOf(value);
@@ -800,6 +801,8 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     if (!display) {
                         display = __(value.charAt(0).toUpperCase() + value.slice(1));
                     }
+                    value = Fast.api.escape(value);
+                    display = Fast.api.escape(display);
                     var html = '<span class="text-' + color + '">' + (icon ? '<i class="' + icon + '"></i> ' : '') + display + '</span>';
                     if (this.operate != false) {
                         html = '<a href="javascript:;" class="searchit" data-toggle="tooltip" title="' + __('Click to search %s', display) + '" data-field="' + this.field + '" data-value="' + value + '">' + html + '</a>';
@@ -866,6 +869,15 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         value = Fast.api.escape(customValue);
                         field = this.customField;
                     }
+                    if (typeof that.searchList === 'object' && typeof that.searchList.then === 'function') {
+                        $.when(that.searchList).done(function (ret) {
+                            if (ret.data && ret.data.searchlist && $.isArray(ret.data.searchlist)) {
+                                that.searchList = ret.data.searchlist;
+                            } else if (ret.constructor === Array || ret.constructor === Object) {
+                                that.searchList = ret;
+                            }
+                        })
+                    }
                     if (typeof that.searchList === 'object' && typeof that.custom === 'undefined') {
                         var i = 0;
                         var searchValues = Object.values(colorArr);
@@ -879,14 +891,16 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
 
                     //渲染Flag
                     var html = [];
-                    var arr = value != '' ? value.split(',') : [];
+                    var arr = $.isArray(value) ? value : value != '' ? value.split(',') : [];
                     var color, display, label;
                     $.each(arr, function (i, value) {
                         value = value == null || value.length === 0 ? '' : value.toString();
-                        if (value == '')
+                        if (value === '')
                             return true;
                         color = value && typeof colorArr[value] !== 'undefined' ? colorArr[value] : 'primary';
                         display = typeof that.searchList !== 'undefined' && typeof that.searchList[value] !== 'undefined' ? that.searchList[value] : __(value.charAt(0).toUpperCase() + value.slice(1));
+                        value = Fast.api.escape(value);
+                        display = Fast.api.escape(display);
                         label = '<span class="label label-' + color + '">' + display + '</span>';
                         if (that.operate) {
                             html.push('<a href="javascript:;" class="searchit" data-toggle="tooltip" title="' + __('Click to search %s', display) + '" data-field="' + field + '" data-value="' + value + '">' + label + '</a>');

public/assets/js/require.js

@@ -1,5 +1,5 @@
 /** vim: et:ts=4:sw=4:sts=4
- * @license RequireJS 2.3.2 Copyright jQuery Foundation and other contributors.
+ * @license RequireJS 2.3.7 Copyright jQuery Foundation and other contributors.
  * Released under MIT license, https://github.com/requirejs/requirejs/blob/master/LICENSE
  */
 //Not using strict: uneven strict support in browsers, #392, and causes
@@ -11,7 +11,7 @@ var requirejs, require, define;
 (function (global, setTimeout) {
     var req, s, head, baseElement, dataMain, src,
         interactiveScript, currentlyAddingScript, mainScript, subPath,
-        version = '2.3.2',
+        version = '2.3.7',
         commentRegExp = /\/\*[\s\S]*?\*\/|([^:"'=]|^)\/\/.*$/mg,
         cjsRequireRegExp = /[^.]\s*require\s*\(\s*["']([^'"\s]+)["']\s*\)/g,
         jsSuffixRegExp = /\.js$/,
@@ -33,7 +33,8 @@ var requirejs, require, define;
         contexts = {},
         cfg = {},
         globalDefQueue = [],
-        useInteractive = false;
+        useInteractive = false,
+        disallowedProps = ['__proto__', 'constructor'];
 
     //Could match something like ')//comment', do not lose the prefix to comment.
     function commentReplace(match, singlePrefix) {
@@ -94,7 +95,7 @@ var requirejs, require, define;
     function eachProp(obj, func) {
         var prop;
         for (prop in obj) {
-            if (hasProp(obj, prop)) {
+            if (hasProp(obj, prop) && disallowedProps.indexOf(prop) == -1) {
                 if (func(obj[prop], prop)) {
                     break;
                 }
@@ -165,7 +166,7 @@ var requirejs, require, define;
      * @returns {Error}
      */
     function makeError(id, msg, err, requireModules) {
-        var e = new Error(msg + '\nhttp://requirejs.org/docs/errors.html#' + id);
+        var e = new Error(msg + '\nhttps://requirejs.org/docs/errors.html#' + id);
         e.requireType = id;
         e.requireModules = requireModules;
         if (err) {
@@ -440,7 +441,9 @@ var requirejs, require, define;
             //Account for relative paths if there is a base name.
             if (name) {
                 if (prefix) {
-                    if (pluginModule && pluginModule.normalize) {
+                    if (isNormalized) {
+                        normalizedName = name;
+                    } else if (pluginModule && pluginModule.normalize) {
                         //Plugin is loaded, use its normalize method.
                         normalizedName = pluginModule.normalize(name, function (name) {
                             return normalize(name, parentName, applyMap);
@@ -972,7 +975,8 @@ var requirejs, require, define;
                         //prefix and name should already be normalized, no need
                         //for applying map config again either.
                         normalizedMap = makeModuleMap(map.prefix + '!' + name,
-                                                      this.map.parentMap);
+                                                      this.map.parentMap,
+                                                      true);
                         on(normalizedMap,
                             'defined', bind(this, function (value) {
                                 this.map.normalizedMap = normalizedMap;

public/assets/less/backend.less

@@ -8,7 +8,7 @@
 @import url("../css/skins/skin-black-blue.css");
 @import url("../css/iconfont.css");
 @import url("../libs/font-awesome/css/font-awesome.min.css");
-@import url("../libs/toastr/toastr.min.css");
+@import url("../libs/toastr/build/toastr.min.css");
 @import url("../libs/fastadmin-layer/dist/theme/default/layer.css");
 @import url("../libs/bootstrap-table/dist/bootstrap-table.min.css");
 @import url("../libs/eonasdan-bootstrap-datetimepicker/build/css/bootstrap-datetimepicker.min.css");
@@ -16,7 +16,7 @@
 @import url("../libs/nice-validator/dist/jquery.validator.css");
 @import url("../libs/bootstrap-select/dist/css/bootstrap-select.min.css");
 @import url("../libs/fastadmin-selectpage/selectpage.css");
-@import url("../libs/bootstrap-slider/slider.css");
+@import url("../libs/bootstrap-slider/dist/css/bootstrap-slider.css");
 @import "tinycss.less";
 
 @main-bg: #f1f4f6;