新增bower-cleanup.js用于移除bower.json中ignores参数配置的文件或文件夹

bower.json新增ignores配置

.bowerrc

@@ -7,5 +7,8 @@
     "jspdf",
     "jspdf-autotable",
     "pdfmake"
-  ]
+  ],
+  "scripts":{
+    "postinstall": "node bower-cleanup.js"
+  }
 }

.gitignore

@@ -6,6 +6,7 @@
 /public/assets/libs/
 /public/assets/addons/*
 /public/uploads/*
+.DS_Store
 .idea
 composer.lock
 *.log

application/admin/command/Addon.php

@@ -201,16 +201,20 @@ class Addon extends Command
                     new \RecursiveDirectoryIterator($addonDir), \RecursiveIteratorIterator::LEAVES_ONLY
                 );
 
+                $addonDir = str_replace(DS, '/', $addonDir);
+                $excludeDirRegex = "/\/(\.git|\.svn|\.vscode|\.idea|unpackage)\//i";
                 foreach ($files as $name => $file) {
-                    if (!$file->isDir()) {
-                        $filePath = $file->getRealPath();
-                        $relativePath = str_replace(DS, '/', substr($filePath, strlen($addonDir)));
-                        if (!in_array($file->getFilename(), ['.git', '.DS_Store', 'Thumbs.db'])) {
-                            $zip->addFile($filePath, $relativePath);
-                        }
+                    $filePath = str_replace(DS, '/', $file->getPathname());
+                    if ($file->isDir() || preg_match($excludeDirRegex, $filePath))
+                        continue;
+                    $relativePath = substr($filePath, strlen($addonDir));
+                    if (!in_array($file->getFilename(), ['.DS_Store', 'Thumbs.db'])) {
+                        $zip->addFile($filePath, $relativePath);
                     }
                 }
+
                 $zip->close();
+                $output->info("Package Resource Path:" . $addonFile);
                 $output->info("Package Successed!");
                 break;
             case 'move':

application/admin/command/Api.php

@@ -98,13 +98,19 @@ class Api extends Command
             foreach ($files as $name => $file) {
                 if (!$file->isDir() && $file->getExtension() == 'php') {
                     $filePath = $file->getRealPath();
-                    $classes[] = $this->getClassFromFile($filePath);
+                    $className = $this->getClassFromFile($filePath);
+                    if ($className) {
+                        $classes[] = $className;
+                    }
                 }
             }
         } else {
             foreach ($controller as $index => $item) {
                 $filePath = $moduleDir . Config::get('url_controller_layer') . DS . $item . '.php';
-                $classes[] = $this->getClassFromFile($filePath);
+                $className = $this->getClassFromFile($filePath);
+                if ($className) {
+                    $classes[] = $className;
+                }
             }
         }
 
@@ -183,7 +189,7 @@ class Api extends Command
                 }
             }
         }
-
-        return $namespace . '\\' . $class;
+        $className = $namespace . '\\' . $class;
+        return preg_match('/([a-z0-9_\\]+)([a-z0-9_]+)$/i', $className) ? $className : '';
     }
 }

application/admin/command/Api/library/Builder.php

@@ -90,14 +90,15 @@ class Builder
 
         $typeArr = [
             'integer' => 'number',
-            'file' => 'file',
+            'file'    => 'file',
         ];
         $paramslist = array();
         foreach ($docs['ApiParams'] as $params) {
-            $inputtype = $params['type'] && isset($typeArr[$params['type']]) ? $typeArr[$params['type']] : ($params['name'] == 'password' ? 'password' : 'text');
+            $type = strtolower($params['type'] ?? 'string');
+            $inputtype = $typeArr[$type] ?? ($params['name'] == 'password' ? 'password' : 'text');
             $tr = array(
                 'name'        => $params['name'],
-                'type'        => $params['type'] ?? 'string',
+                'type'        => $type,
                 'inputtype'   => $inputtype,
                 'sample'      => $params['sample'] ?? '',
                 'required'    => $params['required'] ?? true,
@@ -162,7 +163,7 @@ class Builder
             'OPTIONS' => 'label-info'
         );
 
-        return isset($labes[$method]) ? $labes[$method] : $labes['GET'];
+        return $labes[$method] ?? $labes['GET'];
     }
 
     public function parse()
@@ -230,7 +231,7 @@ class Builder
         foreach ($docsList as $index => &$methods) {
             $methodSectorArr = [];
             foreach ($methods as $name => $method) {
-                $methodSectorArr[$name] = isset($method['weigh']) ? $method['weigh'] : 0;
+                $methodSectorArr[$name] = $method['weigh'] ?? 0;
             }
             arsort($methodSectorArr);
             $methods = array_merge(array_flip(array_keys($methodSectorArr)), $methods);
@@ -253,7 +254,6 @@ class Builder
     public function render($template, $vars = [])
     {
         $docsList = $this->parse();
-
         return $this->view->display(file_get_contents($template), array_merge($vars, ['docsList' => $docsList]));
     }
 }

application/admin/command/Api/template/index.html

@@ -154,8 +154,8 @@
             <div id="sidebar">
                 <div class="list-group panel">
                     {foreach name="docsList" id="docs"}
-                    <a href="#{$key}" class="list-group-item" data-toggle="collapse" data-parent="#sidebar">{$key}  <i class="fa fa-caret-down"></i></a>
-                    <div class="child collapse" id="{$key}">
+                    <a href="#{$key|md5|substr=0,8}" class="list-group-item" data-toggle="collapse" data-parent="#sidebar">{$key}  <i class="fa fa-caret-down"></i></a>
+                    <div class="child collapse" id="{$key|md5|substr=0,8}">
                         {foreach name="docs" id="api" }
                         <a href="javascript:;" data-id="{$api.id}" class="list-group-item">{$api.title}
                             <span class="tag">

application/admin/command/Crud.php

@@ -920,6 +920,7 @@ class Crud extends Command
                                 $replace = '\'{"custom[type]":"' . $table . '"}\'';
                             } elseif ($selectpageController == 'admin') {
                                 $attrArr['data-source'] = 'auth/admin/selectpage';
+                                $attrArr['data-field'] = 'nickname';
                             } elseif ($selectpageController == 'user') {
                                 $attrArr['data-source'] = 'user/user/index';
                                 $attrArr['data-field'] = 'nickname';

application/admin/command/Crud/stubs/mixins/checkbox.stub

@@ -1,7 +1,7 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         $valueArr = explode(',', $value);
         $list = $this->{%listMethodName%}();
         return implode(',', array_intersect_key($list, array_flip($valueArr)));

application/admin/command/Crud/stubs/mixins/datetime.stub

@@ -1,6 +1,6 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         return is_numeric($value) ? date("Y-m-d H:i:s", $value) : $value;
     }

application/admin/command/Crud/stubs/mixins/radio.stub

@@ -1,7 +1,7 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         $list = $this->{%listMethodName%}();
-        return isset($list[$value]) ? $list[$value] : '';
+        return $list[$value] ?? '';
     }

application/admin/command/Crud/stubs/mixins/select.stub

@@ -1,7 +1,7 @@
 
     public function {%methodName%}($value, $data)
     {
-        $value = $value ? $value : (isset($data['{%field%}']) ? $data['{%field%}'] : '');
+        $value = $value ?: ($data['{%field%}'] ?? '');
         $list = $this->{%listMethodName%}();
-        return isset($list[$value]) ? $list[$value] : '';
+        return $list[$value] ?? '';
     }

application/admin/command/Install.php

@@ -17,6 +17,13 @@ use think\View;
 
 class Install extends Command
 {
+
+    /**
+     * 最低PHP版本
+     * @var string
+     */
+    protected $minPhpVersion = '7.4.0';
+
     protected $model = null;
     /**
      * @var \think\View 视图类实例
@@ -70,7 +77,7 @@ class Install extends Command
 
         $adminName = $this->installation($hostname, $hostport, $database, $username, $password, $prefix, $adminUsername, $adminPassword, $adminEmail, $siteName);
         if ($adminName) {
-            $output->highlight("Admin url:http://www.example.com/{$adminName}");
+            $output->highlight("Admin url:https://www.example.com/{$adminName}");
         }
 
         $output->highlight("Admin username:{$adminUsername}");
@@ -207,22 +214,27 @@ class Install extends Command
         $adminFile = ROOT_PATH . 'public' . DS . 'admin.php';
 
         // 数据库配置文件
-        $dbConfigFile = APP_PATH . 'database.php';
-        $dbConfigText = @file_get_contents($dbConfigFile);
+        $envSampleFile = ROOT_PATH . '.env.sample';
+        $envFile = ROOT_PATH . '.env';
+        if (!file_exists($envFile)) {
+            if (!copy($envSampleFile, $envFile)) {
+                throw new Exception(__('Failed to copy %s to %s', '.env.sample', '.env'));
+            }
+        }
+
+        $envText = @file_get_contents($envFile);
+
         $callback = function ($matches) use ($mysqlHostname, $mysqlHostport, $mysqlUsername, $mysqlPassword, $mysqlDatabase, $mysqlPrefix) {
             $field = "mysql" . ucfirst($matches[1]);
             $replace = $$field;
-            if ($matches[1] == 'hostport' && $mysqlHostport == 3306) {
-                $replace = '';
-            }
-            return "'{$matches[1]}'{$matches[2]}=>{$matches[3]}Env::get('database.{$matches[1]}', '{$replace}'),";
+            return "{$matches[1]} = {$replace}";
         };
-        $dbConfigText = preg_replace_callback("/'(hostname|database|username|password|hostport|prefix)'(\s+)=>(\s+)Env::get\((.*)\)\,/", $callback, $dbConfigText);
+        $envText = preg_replace_callback("/(hostname|database|username|password|hostport|prefix)\s*=\s*(.*)/", $callback, $envText);
 
         // 检测能否成功写入数据库配置
-        $result = @file_put_contents($dbConfigFile, $dbConfigText);
+        $result = @file_put_contents($envFile, $envText);
         if (!$result) {
-            throw new Exception(__('The current permissions are insufficient to write the file %s', 'application/database.php'));
+            throw new Exception(__('The current permissions are insufficient to write the file %s', '.env'));
         }
 
         // 设置新的Token随机密钥key
@@ -237,7 +249,7 @@ class Install extends Command
             throw new Exception(__('The current permissions are insufficient to write the file %s', 'application/config.php'));
         }
 
-        $avatar = request()->domain() . '/assets/img/avatar.png';
+        $avatar = '/assets/img/avatar.png';
         // 变更默认管理员密码
         $adminPassword = $adminPassword ? $adminPassword : Random::alnum(8);
         $adminEmail = $adminEmail ? $adminEmail : "admin@admin.com";
@@ -309,8 +321,8 @@ class Install extends Command
         //数据库配置文件
         $dbConfigFile = APP_PATH . 'database.php';
 
-        if (version_compare(PHP_VERSION, '7.4.0', '<')) {
-            throw new Exception(__("The current version %s is too low, please use PHP 7.4 or higher", PHP_VERSION));
+        if (version_compare(PHP_VERSION, $this->minPhpVersion, '<')) {
+            throw new Exception(__("The current PHP %s is too low, please use PHP %s or higher", PHP_VERSION, $this->minPhpVersion));
         }
         if (!extension_loaded("PDO")) {
             throw new Exception(__("PDO is not currently installed and cannot be installed"));

application/admin/command/Install/zh-cn.php

@@ -27,7 +27,7 @@ return [
     'Password is too weak'                                                                                  => '密码太简单，请重新输入',
     'The two passwords you entered did not match'                                                           => '两次输入的密码不一致',
     'Please input correct website'                                                                          => '网站名称输入不正确',
-    'The current version %s is too low, please use PHP 7.4 or higher'                                       => '当前版本%s过低，请使用PHP7.4及以上版本',
+    'The current PHP %s is too low, please use PHP %s or higher'                                            => '当前版本PHP %s过低，请使用PHP %s及以上版本',
     'PDO is not currently installed and cannot be installed'                                                => '当前未开启PDO，无法进行安装',
     'The current permissions are insufficient to write the file %s'                                         => '当前权限不足，无法写入文件%s',
     'Please go to the official website to download the full package or resource package and try to install' => '当前代码仅包含核心代码，请前往官网下载完整包或资源包覆盖后再尝试安装',

application/admin/controller/Ajax.php

@@ -21,7 +21,6 @@ use think\Validate;
  */
 class Ajax extends Backend
 {
-
     protected $noNeedLogin = ['lang'];
     protected $noNeedRight = ['*'];
     protected $layout = '';
@@ -175,18 +174,18 @@ class Ajax extends Backend
             $weighdata[$v[$prikey]] = $v[$field];
         }
         $position = array_search($changeid, $ids);
-        $desc_id = isset($sour[$position]) ? $sour[$position] : end($sour);    //移动到目标的ID值,取出所处改变前位置的值
+        $desc_id = $sour[$position] ?? end($sour);    //移动到目标的ID值,取出所处改变前位置的值
         $sour_id = $changeid;
-        $weighids = array();
+        $weighids = [];
         $temp = array_values(array_diff_assoc($ids, $sour));
         foreach ($temp as $m => $n) {
             if ($n == $sour_id) {
                 $offset = $desc_id;
             } else {
                 if ($sour_id == $temp[0]) {
-                    $offset = isset($temp[$m + 1]) ? $temp[$m + 1] : $sour_id;
+                    $offset = $temp[$m + 1] ?? $sour_id;
                 } else {
-                    $offset = isset($temp[$m - 1]) ? $temp[$m - 1] : $sour_id;
+                    $offset = $temp[$m - 1] ?? $sour_id;
                 }
             }
             if (!isset($weighdata[$offset])) {
@@ -207,7 +206,6 @@ class Ajax extends Backend
             $type = $this->request->request("type");
             switch ($type) {
                 case 'all':
-                    // no break
                 case 'content':
                     //内容缓存
                     rmdirs(CACHE_PATH, false);
@@ -215,18 +213,21 @@ class Ajax extends Backend
                     if ($type == 'content') {
                         break;
                     }
+                    // no break
                 case 'template':
                     // 模板缓存
                     rmdirs(TEMP_PATH, false);
                     if ($type == 'template') {
                         break;
                     }
+                    // no break
                 case 'addons':
                     // 插件缓存
                     Service::refresh();
                     if ($type == 'addons') {
                         break;
                     }
+                    // no break
                 case 'browser':
                     // 浏览器缓存
                     // 只有生产环境下才修改
@@ -323,5 +324,4 @@ class Ajax extends Backend
         $response = Response::create($data, '', 200, $header);
         return $response;
     }
-
 }

application/admin/controller/auth/Adminlog.php

@@ -18,21 +18,13 @@ class Adminlog extends Backend
      * @var \app\admin\model\AdminLog
      */
     protected $model = null;
-    protected $childrenGroupIds = [];
     protected $childrenAdminIds = [];
 
     public function _initialize()
     {
         parent::_initialize();
         $this->model = model('AdminLog');
-
         $this->childrenAdminIds = $this->auth->getChildrenAdminIds(true);
-        $this->childrenGroupIds = $this->auth->getChildrenGroupIds(true);
-
-        $groupName = AuthGroup::where('id', 'in', $this->childrenGroupIds)
-            ->column('id,name');
-
-        $this->view->assign('groupdata', $groupName);
     }
 
     /**

application/admin/controller/auth/Rule.php

@@ -82,7 +82,6 @@ class Rule extends Backend
                 if ($result === false) {
                     $this->error($this->model->getError());
                 }
-                Cache::rm('__menu__');
                 $this->success();
             }
             $this->error();
@@ -124,7 +123,6 @@ class Rule extends Backend
                 if ($result === false) {
                     $this->error($row->getError());
                 }
-                Cache::rm('__menu__');
                 $this->success();
             }
             $this->error();

application/admin/lang/zh-cn.php

@@ -7,6 +7,7 @@ return [
     'Mobile'                                                => '手机',
     'Email'                                                 => '邮箱',
     'Password'                                              => '密码',
+    'Mobile'                                                => '手机号',
     'Sign up'                                               => '注 册',
     'Sign in'                                               => '登 录',
     'Sign out'                                              => '退 出',

application/admin/lang/zh-cn/index.php

@@ -30,6 +30,7 @@ return [
     'You\'ve logged in, do not login again'                      => '你已经登录，无需重复登录',
     'Username or password can not be empty'                      => '用户名密码不能为空',
     'Username or password is incorrect'                          => '用户名或密码不正确',
+    'Username must be 3 to 30 characters'                        => '用户名只能由3-30位数字、字母、下划线组合',
     'Username is incorrect'                                      => '用户名不正确',
     'Password is incorrect'                                      => '密码不正确',
     'Admin is forbidden'                                         => '管理员已经被禁止登录',

application/admin/view/addon/config.html

@@ -2,9 +2,9 @@
     {if $addon.tips && $addon.tips.value}
     <div class="alert {$addon.tips.extend|default='alert-info-light'}" style="margin-bottom:10px;">
         {if $addon.tips.title}
-        <b>{$addon.tips.title}</b><br>
+        <b>{$addon.tips.title|htmlentities}</b><br>
         {/if}
-        {$addon.tips.value}
+        {$addon.tips.value|htmlentities}
     </div>
     {/if}
 
@@ -14,7 +14,7 @@
             <ul class="nav nav-tabs nav-group">
                 <li class="active"><a href="#all" data-toggle="tab">全部</a></li>
                 {foreach name="groupList" id="tab"}
-                    <li><a href="#tab-{$key}" title="{$tab}" data-toggle="tab">{$tab}</a></li>
+                    <li><a href="#tab-{$key|htmlentities}" title="{$tab|htmlentities}" data-toggle="tab">{$tab|htmlentities}</a></li>
                 {/foreach}
             </ul>
         </div>
@@ -23,99 +23,99 @@
         <div class="panel-body no-padding">
             <div id="myTabContent" class="tab-content">
                 {foreach name="groupList" id="group" key="groupName"}
-                <div class="tab-pane fade active in" id="tab-{$groupName}">
+                <div class="tab-pane fade active in" id="tab-{$groupName|htmlentities}">
 
                     <table class="table table-striped table-config mb-0">
                         <tbody>
                         {foreach name="$addon.config" id="item"}
                         {if ((!isset($item['group']) || $item['group']=='') && $groupName=='other') || (isset($item['group']) && $item['group']==$group)}
-                        <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name}" class="{if $item.visible??''}hidden{/if}">
-                            <td width="15%">{$item.title}</td>
+                        <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name|htmlentities}" class="{if $item.visible??''}hidden{/if}">
+                            <td width="15%">{$item.title|htmlentities}</td>
                             <td>
                                 <div class="row">
                                     <div class="col-sm-8 col-xs-12">
                                         {switch $item.type}
                                         {case string}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                         {/case}
                                         {case password}
-                                        <input {$item.extend} type="password" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                        <input {$item.extend} type="password" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                         {/case}
                                         {case text}
-                                        <textarea {$item.extend} name="row[{$item.name}]" class="form-control" data-rule="{$item.rule}" rows="5" data-tip="{$item.tip}">{$item.value|htmlentities}</textarea>
+                                        <textarea {$item.extend} name="row[{$item.name|htmlentities}]" class="form-control" data-rule="{$item.rule|htmlentities}" rows="5" data-tip="{$item.tip|htmlentities}">{$item.value|htmlentities}</textarea>
                                         {/case}
                                         {case array}
-                                        <dl class="fieldlist" data-name="row[{$item.name}]">
+                                        <dl class="fieldlist" data-name="row[{$item.name|htmlentities}]">
                                             <dd>
                                                 <ins>{:__('Array key')}</ins>
                                                 <ins>{:__('Array value')}</ins>
                                             </dd>
                                             <dd><a href="javascript:;" class="btn btn-sm btn-success btn-append"><i class="fa fa-plus"></i> {:__('Append')}</a></dd>
-                                            <textarea name="row[{$item.name}]" cols="30" rows="5" class="hide">{$item.value|json_encode|htmlentities}</textarea>
+                                            <textarea name="row[{$item.name|htmlentities}]" cols="30" rows="5" class="hide">{$item.value|json_encode|htmlentities}</textarea>
                                         </dl>
                                         {/case}
                                         {case date}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case time}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case datetime}
-                                        <input {$item.extend} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case number}
-                                        <input {$item.extend} type="number" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                        <input {$item.extend} type="number" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                         {/case}
                                         {case checkbox}
                                         {foreach name="item.content" item="vo"}
-                                        <label for="row[{$item.name}][]-{$key}"><input id="row[{$item.name}][]-{$key}" name="row[{$item.name}][]" type="checkbox" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                        <label for="row[{$item.name|htmlentities}][]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}][]-{$key|htmlentities}" name="row[{$item.name|htmlentities}][]" type="checkbox" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                         {/foreach}
-                                        <span class="msg-box n-right" for="row[{$item.name}]"></span>
+                                        <span class="msg-box n-right" for="row[{$item.name|htmlentities}]"></span>
                                         {/case}
                                         {case radio}
                                         {foreach name="item.content" item="vo"}
-                                        <label for="row[{$item.name}]-{$key}"><input id="row[{$item.name}]-{$key}" name="row[{$item.name}]" type="radio" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                        <label for="row[{$item.name|htmlentities}]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}]-{$key|htmlentities}" name="row[{$item.name|htmlentities}]" type="radio" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                         {/foreach}
-                                        <span class="msg-box n-right" for="row[{$item.name}]"></span>
+                                        <span class="msg-box n-right" for="row[{$item.name|htmlentities}]"></span>
                                         {/case}
                                         {case value="select" break="0"}{/case}
                                         {case value="selects"}
-                                        <select {$item.extend} name="row[{$item.name}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip}" {$item.type=='selects'?'multiple':''}>
+                                        <select {$item.extend} name="row[{$item.name|htmlentities}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip|htmlentities}" {$item.type=='selects'?'multiple':''}>
                                             {foreach name="item.content" item="vo"}
-                                            <option value="{$key}" {in name="key" value="$item.value" }selected{/in}>{$vo}</option>
+                                            <option value="{$key|htmlentities}" {in name="key" value="$item.value" }selected{/in}>{$vo|htmlentities}</option>
                                             {/foreach}
                                         </select>
                                         {/case}
                                         {case value="image" break="0"}{/case}
                                         {case value="images"}
                                         <div class="form-inline">
-                                            <input id="c-{$item.name}" class="form-control" size="28" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
-                                            <span><button type="button" id="plupload-{$item.name}" class="btn btn-danger plupload" data-input-id="c-{$item.name}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                            <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                            <ul class="row list-inline plupload-preview" id="p-{$item.name}"></ul>
-                                            <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                            <input id="c-{$item.name|htmlentities}" class="form-control" size="28" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
+                                            <span><button type="button" id="plupload-{$item.name|htmlentities}" class="btn btn-danger plupload" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name|htmlentities}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                            <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                            <ul class="row list-inline plupload-preview" id="p-{$item.name|htmlentities}"></ul>
+                                            <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
                                         </div>
                                         {/case}
                                         {case value="file" break="0"}{/case}
                                         {case value="files"}
                                         <div class="form-inline">
-                                            <input id="c-{$item.name}" class="form-control" size="28" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
-                                            <span><button type="button" id="plupload-{$item.name}" class="btn btn-danger plupload" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                            <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                            <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                            <input id="c-{$item.name|htmlentities}" class="form-control" size="28" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
+                                            <span><button type="button" id="plupload-{$item.name|htmlentities}" class="btn btn-danger plupload" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                            <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                            <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
                                         </div>
                                         {/case}
                                         {case switch}
-                                        <input id="c-{$item.name}" name="row[{$item.name}]" type="hidden" value="{:$item.value?1:0}">
-                                        <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name}" data-yes="1" data-no="0">
+                                        <input id="c-{$item.name|htmlentities}" name="row[{$item.name|htmlentities}]" type="hidden" value="{:$item.value?1:0}">
+                                        <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name|htmlentities}" data-yes="1" data-no="0">
                                             <i class="fa fa-toggle-on text-success {if !$item.value}fa-flip-horizontal text-gray{/if} fa-2x"></i>
                                         </a>
                                         {/case}
                                         {case bool}
-                                        <label for="row[{$item.name}]-yes"><input id="row[{$item.name}]-yes" name="row[{$item.name}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip}" /> {:__('Yes')}</label>
-                                        <label for="row[{$item.name}]-no"><input id="row[{$item.name}]-no" name="row[{$item.name}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip}" /> {:__('No')}</label>
+                                        <label for="row[{$item.name|htmlentities}]-yes"><input id="row[{$item.name|htmlentities}]-yes" name="row[{$item.name|htmlentities}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip|htmlentities}" /> {:__('Yes')}</label>
+                                        <label for="row[{$item.name|htmlentities}]-no"><input id="row[{$item.name|htmlentities}]-no" name="row[{$item.name|htmlentities}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip|htmlentities}" /> {:__('No')}</label>
                                         {/case}
-                                        {default /}{$item.value}
+                                        {default /}{$item.value|htmlentities}
                                         {/switch}
                                     </div>
                                     <div class="col-sm-4"></div>

application/admin/view/addon/index.html

@@ -136,7 +136,7 @@
                     <div class="form-group">
                         <label class="control-label">{:__('Version')}</label>
                         <input type="hidden" class="operate" data-name="faversion" value="="/>
-                        <input class="form-control" name="faversion" type="text" value="{$Think.config.fastadmin.version}">
+                        <input class="form-control" name="faversion" type="text" value="{$Think.config.fastadmin.version|htmlentities}">
                     </div>
                 </div>
                 <div class="col-xs-12 col-sm-6 col-md-3">

application/admin/view/category/add.html

@@ -10,7 +10,7 @@
 
             <select id="c-type" data-rule="required" class="form-control selectpicker" name="row[type]">
                 {foreach name="typeList" item="vo"}
-                <option value="{$key}" {in name="key" value=""}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value=""}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -22,7 +22,7 @@
 
             <select id="c-pid" data-rule="required" class="form-control selectpicker" name="row[pid]">
                 {foreach name="parentList" item="vo"}
-                <option data-type="{$vo.type}" value="{$key}" {in name="key" value=""}selected{/in}>{$vo.name}</option>
+                <option data-type="{$vo.type|htmlentities}" value="{$key|htmlentities}" {in name="key" value=""}selected{/in}>{$vo.name|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -46,7 +46,7 @@
 
             <select  id="c-flag" class="form-control selectpicker" multiple="" name="row[flag][]">
                 {foreach name="flagList" item="vo"}
-                <option value="{$key}" {in name="key" value=""}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value=""}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 

application/admin/view/category/edit.html

@@ -6,7 +6,7 @@
 
             <select id="c-type" data-rule="required" class="form-control selectpicker" name="row[type]">
                 {foreach name="typeList" item="vo"}
-                <option value="{$key}" {in name="key" value="$row.type"}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value="$row.type"}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -18,7 +18,7 @@
 
             <select id="c-pid" data-rule="required" class="form-control selectpicker" name="row[pid]">
                 {foreach name="parentList" item="vo"}
-                <option data-type="{$vo.type}" class="{:$vo.type==$row.type||$vo.type=='all'?'':'hide'}" value="{$key}" {in name="key" value="$row.pid"}selected{/in}>{$vo.name}</option>
+                <option data-type="{$vo.type|htmlentities}" class="{:$vo.type==$row.type||$vo.type=='all'?'':'hide'}" value="{$key|htmlentities}" {in name="key" value="$row.pid"}selected{/in}>{$vo.name|htmlentities}</option>
                 {/foreach}
             </select>
 
@@ -42,7 +42,7 @@
 
             <select  id="c-flag" class="form-control selectpicker" multiple="" name="row[flag][]">
                 {foreach name="flagList" item="vo"}
-                <option value="{$key}" {in name="key" value="$row.flag"}selected{/in}>{$vo}</option>
+                <option value="{$key|htmlentities}" {in name="key" value="$row.flag"}selected{/in}>{$vo|htmlentities}</option>
                 {/foreach}
             </select>
 

application/admin/view/category/index.html

@@ -4,7 +4,7 @@
         <ul class="nav nav-tabs">
             <li class="active"><a href="#all" data-toggle="tab">{:__('All')}</a></li>
             {foreach name="typeList" item="vo"}
-                <li><a href="#{$key}" data-toggle="tab">{$vo}</a></li>
+                <li><a href="#{$key|htmlentities}" data-toggle="tab">{$vo|htmlentities}</a></li>
             {/foreach}
         </ul>
 

application/admin/view/common/header.html

@@ -117,10 +117,10 @@
     <div id="secondnav">
         <ul class="nav nav-tabs nav-addtabs disable-top-badge" role="tablist">
             {if $fixedmenu}
-            <li role="presentation" id="tab_{$fixedmenu.id}" class="{:$referermenu?'':'active'}"><a href="#con_{$fixedmenu.id}" node-id="{$fixedmenu.id}" aria-controls="{$fixedmenu.id}" role="tab" data-toggle="tab"><i class="fa fa-dashboard fa-fw"></i> <span>{$fixedmenu.title}</span> <span class="pull-right-container"> </span></a></li>
+            <li role="presentation" id="tab_{$fixedmenu.id|htmlentities}" class="{:$referermenu?'':'active'}"><a href="#con_{$fixedmenu.id|htmlentities}" node-id="{$fixedmenu.id|htmlentities}" aria-controls="{$fixedmenu.id|htmlentities}" role="tab" data-toggle="tab"><i class="fa fa-dashboard fa-fw"></i> <span>{$fixedmenu.title|htmlentities}</span> <span class="pull-right-container"> </span></a></li>
             {/if}
             {if $referermenu}
-            <li role="presentation" id="tab_{$referermenu.id}" class="active"><a href="#con_{$referermenu.id}" node-id="{$referermenu.id}" aria-controls="{$referermenu.id}" role="tab" data-toggle="tab"><i class="fa fa-list fa-fw"></i> <span>{$referermenu.title}</span> <span class="pull-right-container"> </span></a> <i class="close-tab fa fa-remove"></i></li>
+            <li role="presentation" id="tab_{$referermenu.id|htmlentities}" class="active"><a href="#con_{$referermenu.id|htmlentities}" node-id="{$referermenu.id|htmlentities}" aria-controls="{$referermenu.id|htmlentities}" role="tab" data-toggle="tab"><i class="fa fa-list fa-fw"></i> <span>{$referermenu.title|htmlentities}</span> <span class="pull-right-container"> </span></a> <i class="close-tab fa fa-remove"></i></li>
             {/if}
         </ul>
     </div>

application/admin/view/common/meta.html

@@ -7,10 +7,10 @@
 
 <link rel="shortcut icon" href="__CDN__/assets/img/favicon.ico" />
 <!-- Loading Bootstrap -->
-<link href="__CDN__/assets/css/backend{$Think.config.app_debug?'':'.min'}.css?v={$Think.config.site.version}" rel="stylesheet">
+<link href="__CDN__/assets/css/backend{$Think.config.app_debug?'':'.min'}.css?v={$Think.config.site.version|htmlentities}" rel="stylesheet">
 
 {if $Think.config.fastadmin.adminskin}
-<link href="__CDN__/assets/css/skins/{$Think.config.fastadmin.adminskin}.css?v={$Think.config.site.version}" rel="stylesheet">
+<link href="__CDN__/assets/css/skins/{$Think.config.fastadmin.adminskin|htmlentities}.css?v={$Think.config.site.version|htmlentities}" rel="stylesheet">
 {/if}
 
 <!-- HTML5 shim, for IE6-8 support of HTML5 elements. All other JS at the end of file. -->

application/admin/view/common/script.html

@@ -1 +1 @@
-<script src="__CDN__/assets/js/require{$Think.config.app_debug?'':'.min'}.js" data-main="__CDN__/assets/js/require-backend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>
+<script src="__CDN__/assets/js/require.min.js" data-main="__CDN__/assets/js/require-backend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>

application/admin/view/dashboard/index.html

@@ -176,7 +176,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-red"><i class="fa fa-users"></i></span>
                             <div class="sm-st-info">
-                                <span>{$totaluser}</span>
+                                <span>{$totaluser|htmlentities}</span>
                                 {:__('Total user')}
                             </div>
                         </div>
@@ -185,7 +185,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-violet"><i class="fa fa-magic"></i></span>
                             <div class="sm-st-info">
-                                <span>{$totaladdon}</span>
+                                <span>{$totaladdon|htmlentities}</span>
                                 {:__('Total addon')}
                             </div>
                         </div>
@@ -194,7 +194,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-blue"><i class="fa fa-leaf"></i></span>
                             <div class="sm-st-info">
-                                <span>{$attachmentnums}</span>
+                                <span>{$attachmentnums|htmlentities}</span>
                                 {:__('Total attachment')}
                             </div>
                         </div>
@@ -203,7 +203,7 @@
                         <div class="sm-st clearfix">
                             <span class="sm-st-icon st-green"><i class="fa fa-user"></i></span>
                             <div class="sm-st-info">
-                                <span>{$totaladmin}</span>
+                                <span>{$totaladmin|htmlentities}</span>
                                 {:__('Total admin')}
                             </div>
                         </div>
@@ -221,7 +221,7 @@
                                     <div class="col-xs-6 stat-col">
                                         <div class="stat-icon"><i class="fa fa-rocket"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$todayusersignup}</div>
+                                            <div class="value"> {$todayusersignup|htmlentities}</div>
                                             <div class="name"> {:__('Today user signup')}</div>
                                         </div>
                                         <div class="progress">
@@ -231,7 +231,7 @@
                                     <div class="col-xs-6 stat-col">
                                         <div class="stat-icon"><i class="fa fa-vcard"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$todayuserlogin}</div>
+                                            <div class="value"> {$todayuserlogin|htmlentities}</div>
                                             <div class="name"> {:__('Today user login')}</div>
                                         </div>
                                         <div class="progress">
@@ -241,7 +241,7 @@
                                     <div class="col-xs-6  stat-col">
                                         <div class="stat-icon"><i class="fa fa-calendar"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$threednu}</div>
+                                            <div class="value"> {$threednu|htmlentities}</div>
                                             <div class="name"> {:__('Three dnu')}</div>
                                         </div>
                                         <div class="progress">
@@ -251,7 +251,7 @@
                                     <div class="col-xs-6 stat-col">
                                         <div class="stat-icon"><i class="fa fa-calendar-plus-o"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$sevendnu}</div>
+                                            <div class="value"> {$sevendnu|htmlentities}</div>
                                             <div class="name"> {:__('Seven dnu')}</div>
                                         </div>
                                         <div class="progress">
@@ -261,7 +261,7 @@
                                     <div class="col-xs-6  stat-col">
                                         <div class="stat-icon"><i class="fa fa-user-circle"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$sevendau}</div>
+                                            <div class="value"> {$sevendau|htmlentities}</div>
                                             <div class="name"> {:__('Seven dau')}</div>
                                         </div>
                                         <div class="progress">
@@ -271,7 +271,7 @@
                                     <div class="col-xs-6  stat-col">
                                         <div class="stat-icon"><i class="fa fa-user-circle-o"></i></div>
                                         <div class="stat">
-                                            <div class="value"> {$thirtydau}</div>
+                                            <div class="value"> {$thirtydau|htmlentities}</div>
                                             <div class="name"> {:__('Thirty dau')}</div>
                                         </div>
                                         <div class="progress">
@@ -298,7 +298,7 @@
                                 <div class="panel-content">
                                     <div class="row">
                                         <div class="col-md-12">
-                                            <h1 class="no-margins">{$totalworkingaddon}</h1>
+                                            <h1 class="no-margins">{$totalworkingaddon|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-magic"></i>
                                                 <small>{:__('Working addon count tips')}</small>
                                             </div>
@@ -318,7 +318,7 @@
                                 <div class="ibox-content">
                                     <div class="row">
                                         <div class="col-md-6">
-                                            <h1 class="no-margins">{$dbtablenums}</h1>
+                                            <h1 class="no-margins">{$dbtablenums|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-database"></i>
                                                 <small>{:__('Database table nums')}</small>
                                             </div>
@@ -346,7 +346,7 @@
 
                                     <div class="row">
                                         <div class="col-md-6">
-                                            <h1 class="no-margins">{$attachmentnums}</h1>
+                                            <h1 class="no-margins">{$attachmentnums|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-files-o"></i>
                                                 <small>{:__('Attachment nums')}</small>
                                             </div>
@@ -373,7 +373,7 @@
 
                                     <div class="row">
                                         <div class="col-md-6">
-                                            <h1 class="no-margins">{$picturenums}</h1>
+                                            <h1 class="no-margins">{$picturenums|htmlentities}</h1>
                                             <div class="font-bold"><i class="fa fa-picture-o"></i>
                                                 <small>{:__('Picture nums')}</small>
                                             </div>

application/admin/view/general/attachment/add.html

@@ -15,7 +15,7 @@
                 <select name="category-third" id="category-third" class="form-control selectpicker">
                     <option value="">{:__('Please select category')}</option>
                     {foreach name="categoryList" id="item"}
-                    <option value="{$key}">{$item}</option>
+                    <option value="{$key|htmlentities}">{$item|htmlentities}</option>
                     {/foreach}
                 </select>
             </div>
@@ -42,13 +42,13 @@
                 <select name="category-local" id="category-local" class="form-control selectpicker">
                     <option value="">{:__('Please select category')}</option>
                     {foreach name="categoryList" id="item"}
-                    <option value="{$key}">{$item}</option>
+                    <option value="{$key|htmlentities}">{$item|htmlentities}</option>
                     {/foreach}
                 </select>
             </div>
-            <button type="button" id="faupload-local" class="btn btn-primary faupload" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}"><i class="fa fa-upload"></i> {:__("Upload to local")}</button>
+            <button type="button" id="faupload-local" class="btn btn-primary faupload" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}" data-cdnurl=""><i class="fa fa-upload"></i> {:__("Upload to local")}</button>
             {if $config.upload.chunking}
-            <button type="button" id="faupload-local-chunking" class="btn btn-primary faupload" data-chunking="true" data-maxsize="1gb" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}"><i class="fa fa-upload"></i> {:__("Upload to local by chunk")}</button>
+            <button type="button" id="faupload-local-chunking" class="btn btn-primary faupload" data-chunking="true" data-maxsize="1gb" data-input-id="c-local" data-multiple="true" data-preview-id="p-local" data-url="{:url('ajax/upload')}" data-cdnurl=""><i class="fa fa-upload"></i> {:__("Upload to local by chunk")}</button>
             {/if}
         </div>
     </div>

application/admin/view/general/attachment/edit.html

@@ -8,7 +8,7 @@
             <select name="row[category]" class="form-control">
                 <option value="">{:__('Please select category')}</option>
                 {foreach name="categoryList" id="item"}
-                <option value="{$key}" {if $key==$row.category}selected{/if}>{$item}</option>
+                <option value="{$key|htmlentities}" {if $key==$row.category}selected{/if}>{$item|htmlentities}</option>
                 {/foreach}
             </select>
         </div>

application/admin/view/general/attachment/index.html

@@ -5,14 +5,14 @@
         <ul class="nav nav-tabs" data-field="category">
             <li class="active"><a href="#t-all" data-value="" data-toggle="tab">{:__('All')}</a></li>
             {foreach name="categoryList" item="vo"}
-            <li><a href="#t-{$key}" data-value="{$key}" data-toggle="tab">{$vo}</a></li>
+            <li><a href="#t-{$key|htmlentities}" data-value="{$key|htmlentities}" data-toggle="tab">{$vo|htmlentities}</a></li>
             {/foreach}
             <li class="pull-right dropdown filter-type">
                 <a href="javascript:" class="dropdown-toggle" data-toggle="dropdown"><i class="fa fa-filter"></i> {:__('Filter Type')}</a>
                 <ul class="dropdown-menu text-left" role="menu">
                     <li class="active"><a href="javascript:" data-value="">{:__('All')}</a></li>
                     {foreach name="mimetypeList" id="item"}
-                    <li><a href="javascript:" data-value="{$key}">{$item}</a></li>
+                    <li><a href="javascript:" data-value="{$key|htmlentities}">{$item|htmlentities}</a></li>
                     {/foreach}
                 </ul>
             </li>
@@ -45,7 +45,7 @@
             <select name="category" class="form-control">
                 <option value="">{:__('Please select category')}</option>
                 {foreach name="categoryList" id="item"}
-                <option value="{$key}">{$item}</option>
+                <option value="{$key|htmlentities}">{$item|htmlentities}</option>
                 {/foreach}
             </select>
         </div>

application/admin/view/general/attachment/select.html

@@ -9,7 +9,7 @@
         <ul class="nav nav-tabs" data-field="category">
             <li class="active"><a href="#t-all" data-value="" data-toggle="tab">{:__('All')}</a></li>
             {foreach name="categoryList" item="vo"}
-            <li><a href="#t-{$key}" data-value="{$key}" data-toggle="tab">{$vo}</a></li>
+            <li><a href="#t-{$key|htmlentities}" data-value="{$key|htmlentities}" data-toggle="tab">{$vo|htmlentities}</a></li>
             {/foreach}
             {if stripos(request()->get('mimetype'),'image/')===false}
             <li class="pull-right dropdown filter-type">
@@ -17,7 +17,7 @@
                 <ul class="dropdown-menu text-left" role="menu">
                     <li class="active"><a href="javascript:" data-value="">{:__('All')}</a></li>
                     {foreach name="mimetypeList" id="item"}
-                    <li><a href="javascript:" data-value="{$key}">{$item}</a></li>
+                    <li><a href="javascript:" data-value="{$key|htmlentities}">{$item|htmlentities}</a></li>
                     {/foreach}
                 </ul>
             </li>

application/admin/view/general/config/index.html

@@ -27,7 +27,7 @@
         {:build_heading(null, false)}
         <ul class="nav nav-tabs">
             {foreach $siteList as $index=>$vo}
-            <li class="{$vo.active?'active':''}"><a href="#tab-{$vo.name}" data-toggle="tab">{:__($vo.title)}</a></li>
+            <li class="{$vo.active?'active':''}"><a href="#tab-{$vo.name|htmlentities}" data-toggle="tab">{:__($vo.title)}</a></li>
             {/foreach}
             {if $Think.config.app_debug}
             <li data-toggle="tooltip" title="{:__('Add new config')}">
@@ -41,9 +41,9 @@
         <div id="myTabContent" class="tab-content">
             <!--@formatter:off-->
             {foreach $siteList as $index=>$vo}
-            <div class="tab-pane fade {$vo.active ? 'active in' : ''}" id="tab-{$vo.name}">
+            <div class="tab-pane fade {$vo.active ? 'active in' : ''}" id="tab-{$vo.name|htmlentities}">
                 <div class="widget-body no-padding">
-                    <form id="{$vo.name}-form" class="edit-form form-horizontal" role="form" data-toggle="validator" method="POST" action="{:url('general.config/edit')}">
+                    <form id="{$vo.name|htmlentities}-form" class="edit-form form-horizontal" role="form" data-toggle="validator" method="POST" action="{:url('general.config/edit')}">
                         {:token()}
                         <table class="table table-striped">
                             <thead>
@@ -58,111 +58,111 @@
                             </thead>
                             <tbody>
                             {foreach $vo.list as $item}
-                            <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name}" class="{if $item.visible??''}hidden{/if}">
-                                <td>{$item.title}</td>
+                            <tr data-favisible="{$item.visible|default=''|htmlentities}" data-name="{$item.name|htmlentities}" class="{if $item.visible??''}hidden{/if}">
+                                <td>{$item.title|htmlentities}</td>
                                 <td>
                                     <div class="row">
                                         <div class="col-sm-8 col-xs-12">
                                             {switch $item.type}
                                             {case string}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                             {/case}
                                             {case password}
-                                            <input {$item.extend_html} type="password" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule}" data-tip="{$item.tip}"/>
+                                            <input {$item.extend_html|htmlentities} type="password" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-rule="{$item.rule|htmlentities}" data-tip="{$item.tip|htmlentities}"/>
                                             {/case}
                                             {case text}
-                                            <textarea {$item.extend_html} name="row[{$item.name}]" class="form-control" data-rule="{$item.rule}" rows="5" data-tip="{$item.tip}">{$item.value|htmlentities}</textarea>
+                                            <textarea {$item.extend_html|htmlentities} name="row[{$item.name|htmlentities}]" class="form-control" data-rule="{$item.rule|htmlentities}" rows="5" data-tip="{$item.tip|htmlentities}">{$item.value|htmlentities}</textarea>
                                             {/case}
                                             {case editor}
-                                            <textarea {$item.extend_html} name="row[{$item.name}]" id="editor-{$item.name}" class="form-control editor" data-rule="{$item.rule}" rows="5" data-tip="{$item.tip}">{$item.value|htmlentities}</textarea>
+                                            <textarea {$item.extend_html|htmlentities} name="row[{$item.name|htmlentities}]" id="editor-{$item.name|htmlentities}" class="form-control editor" data-rule="{$item.rule|htmlentities}" rows="5" data-tip="{$item.tip|htmlentities}">{$item.value|htmlentities}</textarea>
                                             {/case}
                                             {case array}
-                                            <dl {$item.extend_html} class="fieldlist" data-name="row[{$item.name}]">
+                                            <dl {$item.extend_html|htmlentities} class="fieldlist" data-name="row[{$item.name|htmlentities}]">
                                                 <dd>
                                                     <ins>{:isset($item["setting"]["key"])&&$item["setting"]["key"]?$item["setting"]["key"]:__('Array key')}</ins>
                                                     <ins>{:isset($item["setting"]["value"])&&$item["setting"]["value"]?$item["setting"]["value"]:__('Array value')}</ins>
                                                 </dd>
                                                 <dd><a href="javascript:;" class="btn btn-sm btn-success btn-append"><i class="fa fa-plus"></i> {:__('Append')}</a></dd>
-                                                <textarea name="row[{$item.name}]" class="form-control hide" cols="30" rows="5">{$item.value|htmlentities}</textarea>
+                                                <textarea name="row[{$item.name|htmlentities}]" class="form-control hide" cols="30" rows="5">{$item.value|htmlentities}</textarea>
                                             </dl>
                                             {/case}
                                             {case date}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case time}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case datetime}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimepicker" data-date-format="YYYY-MM-DD HH:mm:ss" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case datetimerange}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control datetimerange" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control datetimerange" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case number}
-                                            <input {$item.extend_html} type="number" name="row[{$item.name}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip}" data-rule="{$item.rule}"/>
+                                            <input {$item.extend_html|htmlentities} type="number" name="row[{$item.name|htmlentities}]" value="{$item.value|htmlentities}" class="form-control" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}"/>
                                             {/case}
                                             {case checkbox}
                                             <div class="checkbox">
                                             {foreach name="item.content" item="vo"}
-                                            <label for="row[{$item.name}][]-{$key}"><input id="row[{$item.name}][]-{$key}" name="row[{$item.name}][]" type="checkbox" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                            <label for="row[{$item.name|htmlentities}][]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}][]-{$key|htmlentities}" name="row[{$item.name|htmlentities}][]" type="checkbox" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                             {/foreach}
                                             </div>
                                             {/case}
                                             {case radio}
                                             <div class="radio">
                                             {foreach name="item.content" item="vo"}
-                                            <label for="row[{$item.name}]-{$key}"><input id="row[{$item.name}]-{$key}" name="row[{$item.name}]" type="radio" value="{$key}" data-tip="{$item.tip}" {in name="key" value="$item.value" }checked{/in} /> {$vo}</label>
+                                            <label for="row[{$item.name|htmlentities}]-{$key|htmlentities}"><input id="row[{$item.name|htmlentities}]-{$key|htmlentities}" name="row[{$item.name|htmlentities}]" type="radio" value="{$key|htmlentities}" data-tip="{$item.tip|htmlentities}" {in name="key" value="$item.value" }checked{/in} /> {$vo|htmlentities}</label>
                                             {/foreach}
                                             </div>
                                             {/case}
                                             {case value="select" break="0"}{/case}
                                             {case value="selects"}
-                                            <select {$item.extend_html} name="row[{$item.name}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip}" {$item.type=='selects'?'multiple':''}>
+                                            <select {$item.extend_html|htmlentities} name="row[{$item.name|htmlentities}]{$item.type=='selects'?'[]':''}" class="form-control selectpicker" data-tip="{$item.tip|htmlentities}" {$item.type=='selects'?'multiple':''}>
                                                 {foreach name="item.content" item="vo"}
-                                                <option value="{$key}" {in name="key" value="$item.value" }selected{/in}>{$vo}</option>
+                                                <option value="{$key|htmlentities}" {in name="key" value="$item.value" }selected{/in}>{$vo|htmlentities}</option>
                                                 {/foreach}
                                             </select>
                                             {/case}
                                             {case value="image" break="0"}{/case}
                                             {case value="images"}
                                             <div class="form-inline">
-                                                <input id="c-{$item.name}" class="form-control" size="50" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
-                                                <span><button type="button" id="faupload-{$item.name}" class="btn btn-danger faupload" data-input-id="c-{$item.name}" data-mimetype="image/gif,image/jpeg,image/png,image/jpg,image/bmp,image/webp" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                                <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                                <span class="msg-box n-right" for="c-{$item.name}"></span>
-                                                <ul class="row list-inline faupload-preview" id="p-{$item.name}"></ul>
+                                                <input id="c-{$item.name|htmlentities}" class="form-control" size="50" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
+                                                <span><button type="button" id="faupload-{$item.name|htmlentities}" class="btn btn-danger faupload" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/gif,image/jpeg,image/png,image/jpg,image/bmp,image/webp" data-multiple="{$item.type=='image'?'false':'true'}" data-preview-id="p-{$item.name|htmlentities}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                                <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-mimetype="image/*" data-multiple="{$item.type=='image'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                                <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
+                                                <ul class="row list-inline faupload-preview" id="p-{$item.name|htmlentities}"></ul>
                                             </div>
                                             {/case}
                                             {case value="file" break="0"}{/case}
                                             {case value="files"}
                                             <div class="form-inline">
-                                                <input id="c-{$item.name}" class="form-control" size="50" name="row[{$item.name}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip}">
-                                                <span><button type="button" id="faupload-{$item.name}" class="btn btn-danger faupload" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
-                                                <span><button type="button" id="fachoose-{$item.name}" class="btn btn-primary fachoose" data-input-id="c-{$item.name}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
-                                                <span class="msg-box n-right" for="c-{$item.name}"></span>
+                                                <input id="c-{$item.name|htmlentities}" class="form-control" size="50" name="row[{$item.name|htmlentities}]" type="text" value="{$item.value|htmlentities}" data-tip="{$item.tip|htmlentities}">
+                                                <span><button type="button" id="faupload-{$item.name|htmlentities}" class="btn btn-danger faupload" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
+                                                <span><button type="button" id="fachoose-{$item.name|htmlentities}" class="btn btn-primary fachoose" data-input-id="c-{$item.name|htmlentities}" data-multiple="{$item.type=='file'?'false':'true'}"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
+                                                <span class="msg-box n-right" for="c-{$item.name|htmlentities}"></span>
                                             </div>
                                             {/case}
                                             {case switch}
-                                            <input id="c-{$item.name}" name="row[{$item.name}]" type="hidden" value="{:$item.value?1:0}">
-                                            <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name}" data-yes="1" data-no="0">
+                                            <input id="c-{$item.name|htmlentities}" name="row[{$item.name|htmlentities}]" type="hidden" value="{:$item.value?1:0}">
+                                            <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name|htmlentities}" data-yes="1" data-no="0">
                                                 <i class="fa fa-toggle-on text-success {if !$item.value}fa-flip-horizontal text-gray{/if} fa-2x"></i>
                                             </a>
                                             {/case}
                                             {case bool}
-                                            <label for="row[{$item.name}]-yes"><input id="row[{$item.name}]-yes" name="row[{$item.name}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip}" /> {:__('Yes')}</label>
-                                            <label for="row[{$item.name}]-no"><input id="row[{$item.name}]-no" name="row[{$item.name}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip}" /> {:__('No')}</label>
+                                            <label for="row[{$item.name|htmlentities}]-yes"><input id="row[{$item.name|htmlentities}]-yes" name="row[{$item.name|htmlentities}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip|htmlentities}" /> {:__('Yes')}</label>
+                                            <label for="row[{$item.name|htmlentities}]-no"><input id="row[{$item.name|htmlentities}]-no" name="row[{$item.name|htmlentities}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip|htmlentities}" /> {:__('No')}</label>
                                             {/case}
                                             {case city}
                                             <div style="position:relative">
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" id="c-{$item.name}" value="{$item.value|htmlentities}" class="form-control" data-toggle="city-picker" data-tip="{$item.tip}" data-rule="{$item.rule}" />
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" id="c-{$item.name|htmlentities}" value="{$item.value|htmlentities}" class="form-control" data-toggle="city-picker" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}" />
                                             </div>
                                             {/case}
                                             {case value="selectpage" break="0"}{/case}
                                             {case value="selectpages"}
-                                            <input {$item.extend_html} type="text" name="row[{$item.name}]" id="c-{$item.name}" value="{$item.value|htmlentities}" class="form-control selectpage" data-source="{:url('general.config/selectpage')}?id={$item.id}" data-primary-key="{$item.setting.primarykey}" data-field="{$item.setting.field}" data-multiple="{$item.type=='selectpage'?'false':'true'}" data-tip="{$item.tip}" data-rule="{$item.rule}" />
+                                            <input {$item.extend_html|htmlentities} type="text" name="row[{$item.name|htmlentities}]" id="c-{$item.name|htmlentities}" value="{$item.value|htmlentities}" class="form-control selectpage" data-source="{:url('general.config/selectpage')}?id={$item.id|htmlentities}" data-primary-key="{$item.setting.primarykey|htmlentities}" data-field="{$item.setting.field|htmlentities}" data-multiple="{$item.type=='selectpage'?'false':'true'}" data-tip="{$item.tip|htmlentities}" data-rule="{$item.rule|htmlentities}" />
                                             {/case}
                                             {case custom}
-                                            {$item.extend_html}
+                                            {$item.extend_html|htmlentities}
                                             {/case}
                                             {/switch}
                                         </div>
@@ -172,7 +172,7 @@
                                 </td>
                                 {if $Think.config.app_debug}
                                 <td>{php}echo "{\$site.". $item['name'] . "}";{/php}</td>
-                                <td>{if $item['id']>18}<a href="javascript:;" class="btn-delcfg text-muted" data-name="{$item.name}"><i class="fa fa-times"></i></a>{/if}</td>
+                                <td>{if $item['id']>18}<a href="javascript:;" class="btn-delcfg text-muted" data-name="{$item.name|htmlentities}"><i class="fa fa-times"></i></a>{/if}</td>
                                 {/if}
                             </tr>
                             {/foreach}
@@ -205,7 +205,7 @@
                         <div class="col-xs-12 col-sm-4">
                             <select name="row[group]" class="form-control selectpicker">
                                 {foreach name="groupList" item="vo"}
-                                <option value="{$key}" {in name="key" value="basic" }selected{/in}>{$vo}</option>
+                                <option value="{$key|htmlentities}" {in name="key" value="basic" }selected{/in}>{$vo|htmlentities}</option>
                                 {/foreach}
                             </select>
                         </div>
@@ -215,7 +215,7 @@
                         <div class="col-xs-12 col-sm-4">
                             <select name="row[type]" id="c-type" class="form-control selectpicker">
                                 {foreach name="typeList" item="vo"}
-                                <option value="{$key}" {in name="key" value="string" }selected{/in}>{$vo}</option>
+                                <option value="{$key|htmlentities}" {in name="key" value="string" }selected{/in}>{$vo|htmlentities}</option>
                                 {/foreach}
                             </select>
                         </div>
@@ -306,7 +306,7 @@ value2|title2</textarea>
                                     <button class="btn btn-primary dropdown-toggle" data-toggle="dropdown" type="button">{:__('Choose')}</button>
                                     <ul class="dropdown-menu pull-right rulelist">
                                         {volist name="ruleList" id="item"}
-                                        <li><a href="javascript:;" data-value="{$key}">{$item}<span class="text-muted">({$key})</span></a></li>
+                                        <li><a href="javascript:;" data-value="{$key|htmlentities}">{$item|htmlentities}<span class="text-muted">({$key|htmlentities})</span></a></li>
                                         {/volist}
                                     </ul>
                                 </span>

application/admin/view/index/index.html

@@ -27,13 +27,13 @@
             <!-- 主体内容区域 -->
             <div class="content-wrapper tab-content tab-addtabs">
                 {if $fixedmenu}
-                <div role="tabpanel" class="tab-pane {:$referermenu?'':'active'}" id="con_{$fixedmenu.id}">
-                    <iframe src="{$fixedmenu.url}{:stripos($fixedmenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
+                <div role="tabpanel" class="tab-pane {:$referermenu?'':'active'}" id="con_{$fixedmenu.id|htmlentities}">
+                    <iframe src="{$fixedmenu.url|htmlentities}{:stripos($fixedmenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
                 </div>
                 {/if}
                 {if $referermenu}
-                <div role="tabpanel" class="tab-pane active" id="con_{$referermenu.id}">
-                    <iframe src="{$referermenu.url}{:stripos($referermenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
+                <div role="tabpanel" class="tab-pane active" id="con_{$referermenu.id|htmlentities}">
+                    <iframe src="{$referermenu.url|htmlentities}{:stripos($referermenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
                 </div>
                 {/if}
             </div>
@@ -42,7 +42,7 @@
             <footer class="main-footer hide">
                 <div class="pull-right hidden-xs">
                 </div>
-                <strong>Copyright &copy; 2017-{:date("Y")} <a href="__PUBLIC__">{$site.name}</a>.</strong> All rights reserved.
+                <strong>Copyright &copy; 2017-{:date("Y")} <a href="__PUBLIC__">{$site.name|htmlentities}</a>.</strong> All rights reserved.
             </footer>
 
             <!-- 右侧控制栏 -->

application/admin/view/index/login.html

@@ -81,7 +81,7 @@
     {if $background}
         <style type="text/css">
             body{
-                background-image: url('{$background}');
+                background-image: url('{$background|htmlentities}');
             }
         </style>
     {/if}
@@ -116,7 +116,7 @@
                         {if $Think.config.fastadmin.login_captcha}
                         <div class="input-group">
                             <div class="input-group-addon"><span class="glyphicon glyphicon-option-horizontal" aria-hidden="true"></span></div>
-                            <input type="text" name="captcha" class="form-control" placeholder="{:__('Captcha')}" data-rule="{:__('Captcha')}:required;length({$Think.config.captcha.length})" autocomplete="off"/>
+                            <input type="text" name="captcha" class="form-control" placeholder="{:__('Captcha')}" data-rule="{:__('Captcha')}:required;length({$Think.config.captcha.length|htmlentities})" autocomplete="off"/>
                             <span class="input-group-addon" style="padding:0;border:none;cursor:pointer;">
                                     <img src="{:rtrim('__PUBLIC__', '/')}/index.php?s=/captcha" width="100" height="30" onclick="this.src = '{:rtrim('__PUBLIC__', '/')}/index.php?s=/captcha&r=' + Math.random();"/>
                             </span>

application/admin/view/layout/default.html

@@ -26,7 +26,7 @@
                                 </ol>
                                 <ol class="breadcrumb pull-right">
                                     {foreach $breadcrumb as $vo}
-                                    <li><a href="javascript:;" data-url="{$vo.url}">{$vo.title}</a></li>
+                                    <li><a href="javascript:;" data-url="{$vo.url|htmlentities}">{$vo.title|htmlentities}</a></li>
                                     {/foreach}
                                 </ol>
                             </div>

application/admin/view/user/group/add.html

@@ -22,7 +22,7 @@
 
             <div class="radio">
                 {foreach name="statusList" item="vo"}
-                <label for="row[status]-{$key}"><input id="row[status]-{$key}" name="row[status]" type="radio" value="{$key}" {in name="key" value="normal"}checked{/in} /> {$vo}</label>
+                <label for="row[status]-{$key|htmlentities}"><input id="row[status]-{$key|htmlentities}" name="row[status]" type="radio" value="{$key|htmlentities}" {in name="key" value="normal"}checked{/in} /> {$vo|htmlentities}</label>
                 {/foreach}
             </div>
 

application/admin/view/user/group/edit.html

@@ -22,7 +22,7 @@
 
             <div class="radio">
             {foreach name="statusList" item="vo"}
-            <label for="row[status]-{$key}"><input id="row[status]-{$key}" name="row[status]" type="radio" value="{$key}" {in name="key" value="$row.status"}checked{/in} /> {$vo}</label>
+            <label for="row[status]-{$key|htmlentities}"><input id="row[status]-{$key|htmlentities}" name="row[status]" type="radio" value="{$key|htmlentities}" {in name="key" value="$row.status"}checked{/in} /> {$vo|htmlentities}</label>
             {/foreach}
             </div>
 

application/api/controller/Common.php

@@ -80,7 +80,7 @@ class Common extends Api
     /**
      * 上传文件
      * @ApiMethod (POST)
-     * @ApiParams (name="file", type="File", required=true, description="文件流")
+     * @ApiParams (name="file", type="file", required=true, description="文件流")
      */
     public function upload()
     {

application/common/controller/Backend.php

@@ -577,6 +577,7 @@ class Backend extends Controller
                     $result = array_intersect_key(($item instanceof Model ? $item->toArray() : (array)$item), array_flip($fields));
                 }
                 $result['pid'] = isset($item['pid']) ? $item['pid'] : (isset($item['parent_id']) ? $item['parent_id'] : 0);
+                $result = array_map("htmlentities", $result);
                 $list[] = $result;
             }
             if ($istree && !$primaryvalue) {

application/common/library/Auth.php

@@ -224,6 +224,7 @@ class Auth
 
         if ($user->loginfailure >= 10 && time() - $user->loginfailuretime < 86400) {
             $this->setError('Please try again after 1 day');
+            return false;
         }
 
         if ($user->password != $this->getEncryptPassword($password, $user->salt)) {

application/common/library/Log.php

@@ -19,10 +19,8 @@ class Log extends AbstractLogger
      * @param array  $context
      *
      * @return void
-     *
-     * @throws \Psr\Log\InvalidArgumentException
      */
-    public function log($level, $message, array $context = array())
+    public function log($level, $message, array $context = [])
     {
         \think\Log::write($message);
     }

application/common/model/Config.php

@@ -219,7 +219,7 @@ class Config extends Model
         }
         file_put_contents(
             CONF_PATH . 'extra' . DS . 'site.php',
-            '<?php' . "\n\nreturn " . var_export_short($config) . ";\n"
+            '<?php' . "\n\nreturn " . var_export($config, true) . ";\n"
         );
         return true;
     }

application/common/model/User.php

@@ -7,6 +7,10 @@ use think\Model;
 
 /**
  * 会员模型
+ * @method static mixed getByUsername($str) 通过用户名查询用户
+ * @method static mixed getByNickname($str) 通过昵称查询用户
+ * @method static mixed getByMobile($str) 通过手机查询用户
+ * @method static mixed getByEmail($str) 通过邮箱查询用户
  */
 class User extends Model
 {

application/common/view/tpl/dispatch_jump.tpl

@@ -41,18 +41,19 @@
     <p class="clearfix">
         <a href="__PUBLIC__" class="btn btn-grey">{:__('Go back')}</a>
         {if $url}
-            <a href="{$url|htmlentities}" class="btn btn-primary">{:__('Jump now')}</a>
+            <a id="href" href="{$url|htmlentities}" class="btn btn-primary">{:__('Jump now')}</a>
         {/if}
     </p>
 </div>
 {if $url}
     <script type="text/javascript">
         (function () {
-            var wait = document.getElementById('wait');
+            var wait = document.getElementById('wait'),
+                href = document.getElementById('href').href;
             var interval = setInterval(function () {
                 var time = --wait.innerHTML;
                 if (time <= 0) {
-					location.href = "{$url|htmlentities}";
+                    location.href = href;
                     clearInterval(interval);
                 }
             }, 1000);
@@ -60,4 +61,4 @@
     </script>
 {/if}
 </body>
-</html>
+</html>

application/config.php

@@ -302,7 +302,7 @@ return [
         //允许跨域的域名,多个以,分隔
         'cors_request_domain'   => 'localhost,127.0.0.1',
         //版本号
-        'version'               => '1.5.2.20240906',
+        'version'               => '1.5.4.20250312',
         //API接口地址
         'api_url'               => 'https://api.fastadmin.net',
     ],

application/extra/upload.php

@@ -26,6 +26,10 @@ return [
      * 是否支持批量上传
      */
     'multiple'  => false,
+    /**
+     * 上传超时时长，这里仅用于JS上传超时控制
+     */
+    'timeout'  => 60000,
     /**
      * 是否支持分片上传
      */

application/index/lang/zh-cn/user.php

@@ -57,11 +57,12 @@ return [
     'Change password successful'                 => '修改密码成功',
     'Password and confirm password don\'t match' => '两次输入的密码不一致',
     'Captcha is incorrect'                       => '验证码不正确',
+    'Please try again after 1 day'               => '请于1天后再尝试登录',
     'Logged in successful'                       => '登录成功',
     'Logout successful'                          => '退出成功',
     'User center already closed'                 => '会员中心已经关闭',
     'Don\'t have an account? Sign up'            => '还没有账号？点击注册',
-    'Already have an account? Sign in'            => '已经有账号？点击登录',
+    'Already have an account? Sign in'           => '已经有账号？点击登录',
     'Operation failed'                           => '操作失败',
     'Invalid parameters'                         => '参数不正确',
     'Change password failure'                    => '修改密码失败',

application/index/view/common/script.html

@@ -1 +1 @@
-<script src="__CDN__/assets/js/require{$Think.config.app_debug?'':'.min'}.js" data-main="__CDN__/assets/js/require-frontend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>
+<script src="__CDN__/assets/js/require{$Think.config.app_debug?'':'.min'}.js" data-main="__CDN__/assets/js/require-frontend{$Think.config.app_debug?'':'.min'}.js?v={$site.version|htmlentities}"></script>

bower-cleanup.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const minimatch = require('minimatch');
+
+// bower.json和bower_components目录路径
+const bowerJsonPath = path.resolve(__dirname, './bower.json');
+const bowerDir = path.resolve(__dirname, './public/assets/libs');
+
+console.log('Bower postinstall: 开始清理依赖包...');
+
+// 检查bower.json是否存在
+if (!fs.existsSync(bowerJsonPath)) {
+    console.error('未找到bower.json文件');
+    process.exit(1);
+}
+
+// 读取bower.json配置
+let bowerConfig;
+try {
+    bowerConfig = JSON.parse(fs.readFileSync(bowerJsonPath, 'utf8'));
+} catch (err) {
+    console.error('读取bower.json文件失败:', err);
+    process.exit(1);
+}
+
+// 递归删除文件夹
+function deleteFolderRecursive(folderPath) {
+    if (fs.existsSync(folderPath)) {
+        fs.readdirSync(folderPath).forEach(file => {
+            const curPath = path.join(folderPath, file);
+            if (fs.lstatSync(curPath).isDirectory()) {
+                // 递归删除子文件夹
+                deleteFolderRecursive(curPath);
+            } else {
+                // 删除文件
+                fs.unlinkSync(curPath);
+            }
+        });
+        // 删除空文件夹
+        fs.rmdirSync(folderPath);
+    }
+}
+
+// 获取要删除的文件列表（支持gitignore语法）
+function getFilesToRemove(packagePath, patterns) {
+    const result = [];
+
+    // 递归查找匹配的文件和文件夹
+    function findMatches(dir, relativePath = '') {
+        if (!fs.existsSync(dir)) return;
+
+        const files = fs.readdirSync(dir);
+
+        for (const file of files) {
+            const fullPath = path.join(dir, file);
+            const relPath = relativePath ? path.join(relativePath, file) : file;
+            const stats = fs.statSync(fullPath);
+
+            let matched = false;
+
+            // 检查是否匹配任何模式
+            for (const pattern of patterns) {
+                // 处理目录特定模式（以/结尾）
+                if (pattern.endsWith('/') && stats.isDirectory()) {
+                    if (minimatch(relPath, pattern.slice(0, -1)) ||
+                        minimatch(relPath + '/', pattern)) {
+                        matched = true;
+                        break;
+                    }
+                }
+                // 普通模式匹配
+                else if (minimatch(relPath, pattern)) {
+                    matched = true;
+                    break;
+                }
+            }
+
+            if (matched) {
+                result.push(fullPath);
+            }
+            // 如果是目录且未匹配，则递归查找
+            else if (stats.isDirectory()) {
+                findMatches(fullPath, relPath);
+            }
+        }
+    }
+
+    findMatches(packagePath);
+    return result;
+}
+
+// 获取ignores配置
+const ignores = bowerConfig.ignores || {};
+
+// 处理每个包的ignores配置
+Object.keys(ignores).forEach(packageName => {
+    const packagePath = path.join(bowerDir, packageName);
+
+    // 检查包是否存在
+    if (!fs.existsSync(packagePath)) {
+        console.log(`包 ${packageName} 不存在，跳过`);
+        return;
+    }
+
+    console.log(`处理包: ${packageName}`);
+
+    // 获取要删除的文件/文件夹模式列表
+    const patterns = ignores[packageName] || [];
+
+    // 如果没有模式，跳过
+    if (patterns.length === 0) {
+        console.log(`包 ${packageName} 没有配置忽略模式，跳过`);
+        return;
+    }
+
+    // 获取匹配的文件和文件夹
+    const filesToRemove = getFilesToRemove(packagePath, patterns);
+
+    // 按照路径长度排序，确保先删除深层文件
+    filesToRemove.sort((a, b) => b.length - a.length);
+
+    // 删除匹配的文件和文件夹
+    filesToRemove.forEach(itemPath => {
+        if (fs.existsSync(itemPath)) {
+            const stats = fs.statSync(itemPath);
+
+            if (stats.isDirectory()) {
+                console.log(`删除冗余文件夹: ${itemPath}`);
+                deleteFolderRecursive(itemPath);
+            } else {
+                console.log(`删除冗余文件: ${itemPath}`);
+                fs.unlinkSync(itemPath);
+            }
+        }
+    });
+});
+
+console.log('Bower postinstall清理完成');

bower.json

@@ -6,7 +6,7 @@
   "homepage": "https://www.fastadmin.net",
   "private": true,
   "dependencies": {
-    "jquery": "^3.7.0",
+    "jquery": "^3.7.1",
     "bootstrap": "^3.3.7",
     "font-awesome": "^4.6.1",
     "bootstrap-table": "fastadmin-bootstraptable#~1.11.5",
@@ -19,7 +19,7 @@
     "tableExport.jquery.plugin": "~1.10.3",
     "jquery-slimscroll": "~1.3.8",
     "jquery.cookie": "~1.4.1",
-    "Sortable": "~1.10.0",
+    "Sortable": "~1.10.2",
     "nice-validator": "karsonzhang/fastadmin-nicevalidator#~1.1.6",
     "art-template": "~3.1.3",
     "bootstrap-daterangepicker": "~2.1.25",
@@ -27,8 +27,78 @@
     "fastadmin-cxselect": "~1.4.0",
     "fastadmin-dragsort": "~1.0.0",
     "fastadmin-addtabs": "~1.0.8",
-    "fastadmin-selectpage": "~1.0.12",
+    "fastadmin-selectpage": "^1.0.12",
     "fastadmin-layer": "~3.5.1",
     "bootstrap-slider": "*"
+  },
+  "ignores": {
+    "art-template": [
+      ".*",
+      "demo",
+      "doc",
+      "loader",
+      "node",
+      "src",
+      "test"
+    ],
+    "jquery": [
+      "src",
+      "test",
+      "external"
+    ],
+    "bootstrap": [
+      "grunt",
+      "js",
+      "nuget"
+    ],
+    "bootstrap-daterangepicker": [
+      "example",
+      "website",
+      "*.html"
+    ],
+    "bootstrap-table": [
+      "src"
+    ],
+    "eonasdan-bootstrap-datetimepicker": [
+      "docs",
+      "src",
+      "tasks"
+    ],
+    "fastadmin-citypicker": [
+      "src"
+    ],
+    "fastadmin-cxselect": [
+      "*.html"
+    ],
+    "fastadmin-layer": [
+      "src",
+      "test"
+    ],
+    "jquery-slimscroll": [
+      "examples"
+    ],
+    "jstree": [
+      "src"
+    ],
+    "moment": [
+      "src",
+      "ts3.1-*"
+    ],
+    "require-css": [
+      "*.sh"
+    ],
+    "Sortable": [
+      "entry",
+      "modular",
+      "plugins",
+      "scripts",
+      "src",
+      "st",
+      ".*",
+      "*.html"
+    ]
+  },
+  "resolutions": {
+    "jquery": "^3.7.1"
   }
 }

extend/fast/Date.php

@@ -124,7 +124,7 @@ class Date
      */
     public static function human($remote, $local = null)
     {
-        $time_diff = (is_null($local) || $local ? time() : $local) - $remote;
+        $time_diff = (is_null($local) ? time() : $local) - $remote;
         $tense = $time_diff < 0 ? 'after' : 'ago';
         $time_diff = abs($time_diff);
         $chunks = [
@@ -146,7 +146,7 @@ class Date
                 break;
             }
         }
-        return __("%d $name%s $tense", $count, ($count > 1 ? 's' : ''));
+        return __("%d $name%s $tense", [$count, ($count > 1 ? 's' : '')]);
     }
 
     /**

extend/fast/Random.php

@@ -14,7 +14,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function alnum($len = 6)
+    public static function alnum(int $len = 6): string
     {
         return self::build('alnum', $len);
     }
@@ -25,7 +25,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function alpha($len = 6)
+    public static function alpha(int $len = 6): string
     {
         return self::build('alpha', $len);
     }
@@ -36,7 +36,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function numeric($len = 4)
+    public static function numeric(int $len = 4): string
     {
         return self::build('numeric', $len);
     }
@@ -47,7 +47,7 @@ class Random
      * @param int $len 长度
      * @return string
      */
-    public static function nozero($len = 4)
+    public static function nozero(int $len = 4): string
     {
         return self::build('nozero', $len);
     }
@@ -58,7 +58,7 @@ class Random
      * @param int    $len  长度
      * @return string
      */
-    public static function build($type = 'alnum', $len = 8)
+    public static function build(string $type = 'alnum', int $len = 8): string
     {
         switch ($type) {
             case 'alpha':
@@ -93,7 +93,7 @@ class Random
      * 获取全球唯一标识
      * @return string
      */
-    public static function uuid()
+    public static function uuid(): string
     {
         return sprintf(
             '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',

extend/fast/Tree.php

@@ -325,7 +325,7 @@ class Tree
                     '@url'       => $childdata || !isset($value['@url']) ? "javascript:;" : $value['@url'],
                     '@addtabs'   => $childdata || !isset($value['@url']) ? "" : (stripos($value['@url'], "?") !== false ? "&" : "?") . "ref=addtabs",
                     '@caret'     => ($childdata && (!isset($value['@badge']) || !$value['@badge']) ? '<i class="fa fa-angle-left"></i>' : ''),
-                    '@badge'     => isset($value['@badge']) ? $value['@badge'] : '',
+                    '@badge'     => $value['@badge'] ?? '',
                     '@class'     => ($selected ? ' active' : '') . ($disabled ? ' disabled' : '') . ($childdata ? ' treeview' . (config('fastadmin.show_submenu') ? ' treeview-open' : '') : ''),
                 );
                 $str .= strtr($nstr, $value);
@@ -422,7 +422,7 @@ class Tree
     {
         $arr = [];
         foreach ($data as $k => $v) {
-            $childlist = isset($v['childlist']) ? $v['childlist'] : [];
+            $childlist = $v['childlist'] ?? [];
             unset($v['childlist']);
             $v[$field] = $v['spacer'] . ' ' . $v[$field];
             $v['haschild'] = $childlist ? 1 : 0;

public/assets/js/backend/addon.js

@@ -165,7 +165,10 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                             title: __('Operate'),
                             table: table,
                             formatter: Controller.api.formatter.operate,
-                            align: 'right'
+                            align: 'right',
+                            cellStyle: function (value, row, index) {
+                                return {css: {'min-width': '158px'}};
+                            }
                         },
                     ]
                 ],
@@ -238,6 +241,27 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                             Layer.close(index);
                         });
                         return false;
+                    } else if (ret && ret.code === -3) {
+                        //插件目录发现影响全局的文件
+                        Layer.open({
+                            content: Template("conflicttpl", ret.data),
+                            shade: 0.8,
+                            area: area,
+                            title: __('Warning'),
+                            btn: [__('Continue install'), __('Cancel')],
+                            end: function () {
+
+                            },
+                            yes: function (index) {
+                                up.removeFile(file);
+                                file.force = true;
+                                up.uploadFile(file);
+                                Layer.close(index);
+                            }
+                        });
+
+                    } else {
+                        Layer.alert(ret.msg, {title: __('Warning'), icon: 0});
                     }
                 });
 
@@ -480,7 +504,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                         //如果登录已经超时,重新提醒登录
                         if (uid && uid != ret.data.uid) {
                             Controller.api.userinfo.set(null);
-                            $(".operate[data-name='" + name + "'] .btn-install").trigger("click");
+                            $(".operate[data-name='" + name + "'] .btn-install:first").trigger("click");
                             return;
                         }
                         top.Fast.api.open(ret.data.payurl, __('Pay now'), {

public/assets/js/backend/auth/rule.js

@@ -20,7 +20,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
             table.bootstrapTable({
                 url: $.fn.bootstrapTable.defaults.extend.index_url,
                 sortName: '',
-                escape: false,
+                escape: true,
                 columns: [
                     [
                         {field: 'state', checkbox: true,},
@@ -180,7 +180,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
                 var iconfunc = function () {
                     Layer.open({
                         type: 1,
-                        area: ['99%', '98%'], //宽高
+                        area: ['80%', '80%'], //宽高
                         content: Template('chooseicontpl', {iconlist: iconlist})
                     });
                 };
@@ -192,8 +192,8 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
                 });
                 $(document).on('click', ".btn-search-icon", function () {
                     if (iconlist.length == 0) {
-                        $.get(Config.site.cdnurl + "/assets/libs/font-awesome/less/variables.less", function (ret) {
-                            var exp = /fa-var-(.*):/ig;
+                        $.get(Config.site.cdnurl + "/assets/libs/font-awesome/css/font-awesome.css", function (ret) {
+                            var exp = /fa-(.*):before/ig;
                             var result;
                             while ((result = exp.exec(ret)) != null) {
                                 iconlist.push(result[1]);

public/assets/js/backend/general/attachment.js

@@ -167,7 +167,7 @@ define(['jquery', 'bootstrap', 'backend', 'form', 'table'], function ($, undefin
                         {
                             field: 'operate', title: __('Operate'), width: 85, events: {
                                 'click .btn-chooseone': function (e, value, row, index) {
-                                    Fast.api.close({url: row.url, multiple: multiple});
+                                    Fast.api.close($.extend({multiple: multiple}, row));
                                 },
                             }, formatter: function () {
                                 return '<a href="javascript:;" class="btn btn-danger btn-chooseone btn-xs"><i class="fa fa-check"></i> ' + __('Choose') + '</a>';

public/assets/js/backend/user/rule.js

@@ -21,7 +21,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefin
                 url: $.fn.bootstrapTable.defaults.extend.index_url,
                 pk: 'id',
                 sortName: 'weigh',
-                escape: false,
+                escape: true,
                 columns: [
                     [
                         {checkbox: true},

public/assets/js/backend/user/user.js

@@ -21,6 +21,8 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefin
                 url: $.fn.bootstrapTable.defaults.extend.index_url,
                 pk: 'id',
                 sortName: 'user.id',
+                fixedColumns: true,
+                fixedRightNumber: 1,
                 columns: [
                     [
                         {checkbox: true},

public/assets/js/bootstrap-table-commonsearch.js

@@ -157,7 +157,7 @@
             } else {
                 key = isArray ? value : key;
             }
-            optionList.push(sprintf("<option value='" + key + "' %s>" + value + "</option>", key == vObjCol.defaultValue ? 'selected' : ''));
+            optionList.push(sprintf("<option value='" + Fast.api.escape(key) + "' %s>" + Fast.api.escape(value) + "</option>", key == vObjCol.defaultValue ? 'selected' : ''));
         });
         return optionList;
     };
@@ -208,7 +208,7 @@
             } else {
                 value = process ? process(obj.val()) : obj.val();
             }
-            if (removeempty && (value == '' || value == null || ($.isArray(value) && value.length == 0)) && !sym.match(/null/i)) {
+            if (removeempty && (value === '' || value == null || ($.isArray(value) && value.length === 0)) && !sym.match(/null/i)) {
                 return true;
             }
 
@@ -268,7 +268,7 @@
             return "Common search";
         },
         formatCommonSubmitButton: function () {
-            return "Submit";
+            return "Search";
         },
         formatCommonResetButton: function () {
             return "Reset";

public/assets/js/require-form.js

@@ -102,6 +102,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                 //绑定select元素事件
                 if ($(".selectpicker", form).length > 0) {
                     require(['bootstrap-select', 'bootstrap-select-lang'], function () {
+                        $.fn.selectpicker.Constructor.BootstrapVersion = '3';
                         $('.selectpicker', form).selectpicker();
                         $(form).on("reset", function () {
                             setTimeout(function () {
@@ -218,7 +219,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         };
                         var origincallback = function (start, end) {
                             $(this.element).val(start.format(this.locale.format) + " - " + end.format(this.locale.format));
-                            $(this.element).trigger('change');
+                            $(this.element).trigger('change').trigger('validate');
                         };
                         $(".datetimerange", form).each(function () {
                             var callback = typeof $(this).data('callback') == 'function' ? $(this).data('callback') : origincallback;
@@ -226,7 +227,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                 callback.call(picker, picker.startDate, picker.endDate);
                             });
                             $(this).on('cancel.daterangepicker', function (ev, picker) {
-                                $(this).val('').trigger('change');
+                                $(this).val('').trigger('change').trigger('validate');
                             });
                             $(this).daterangepicker($.extend(true, {}, options, $(this).data() || {}, $(this).data("daterangepicker-options") || {}));
                         });
@@ -294,6 +295,9 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                     var url = Config.upload.fullmode ? Fast.api.cdnurl(data.url) : data.url;
                                     $("#" + input_id).val(url).trigger("change").trigger("validate");
                                 }
+
+                                // 触发选择文件自定义事件
+                                button.trigger("fa.event.selectedfile", data);
                             }
                         });
                         return false;
@@ -567,7 +571,9 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         }
                     };
                     // @formatter:on
+                    var $disabledElements = form.find(':disabled').removeAttr('disabled');
                     var dataArr = form.serializeArray(), dataObj = {}, fieldName, fieldValue;
+                    $disabledElements.attr('disabled', 'disabled');
                     $(dataArr).each(function (i, field) {
                         fieldName = field.name;
                         fieldValue = field.value;

public/assets/js/require-table.js

@@ -131,7 +131,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         return __('Common search');
                     },
                     formatCommonSubmitButton: function () {
-                        return __('Submit');
+                        return __('Search');
                     },
                     formatCommonResetButton: function () {
                         return __('Reset');
@@ -764,7 +764,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         suffix = /[\.]?([a-zA-Z0-9]+)$/.exec(value);
                         suffix = suffix ? suffix[1] : 'file';
                         url = Fast.api.fixurl("ajax/icon?suffix=" + suffix);
-                        html.push('<a href="' + value + '" target="_blank"><img src="' + url + '" class="' + classname + '"></a>');
+                        html.push('<a href="' + value + '" target="_blank"><img src="' + url + '" class="' + classname + '" width="30" height="30"></a>');
                     });
                     return html.join(' ');
                 },
@@ -866,6 +866,15 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         value = Fast.api.escape(customValue);
                         field = this.customField;
                     }
+                    if (typeof that.searchList === 'object' && typeof that.searchList.then === 'function') {
+                        $.when(that.searchList).done(function (ret) {
+                            if (ret.data && ret.data.searchlist && $.isArray(ret.data.searchlist)) {
+                                that.searchList = ret.data.searchlist;
+                            } else if (ret.constructor === Array || ret.constructor === Object) {
+                                that.searchList = ret;
+                            }
+                        })
+                    }
                     if (typeof that.searchList === 'object' && typeof that.custom === 'undefined') {
                         var i = 0;
                         var searchValues = Object.values(colorArr);
@@ -879,11 +888,11 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
 
                     //渲染Flag
                     var html = [];
-                    var arr = value != '' ? value.split(',') : [];
+                    var arr = $.isArray(value) ? value : value != '' ? value.split(',') : [];
                     var color, display, label;
                     $.each(arr, function (i, value) {
                         value = value == null || value.length === 0 ? '' : value.toString();
-                        if (value == '')
+                        if (value === '')
                             return true;
                         color = value && typeof colorArr[value] !== 'undefined' ? colorArr[value] : 'primary';
                         display = typeof that.searchList !== 'undefined' && typeof that.searchList[value] !== 'undefined' ? that.searchList[value] : __(value.charAt(0).toUpperCase() + value.slice(1));

public/assets/js/require.js

@@ -1,5 +1,5 @@
 /** vim: et:ts=4:sw=4:sts=4
- * @license RequireJS 2.3.2 Copyright jQuery Foundation and other contributors.
+ * @license RequireJS 2.3.7 Copyright jQuery Foundation and other contributors.
  * Released under MIT license, https://github.com/requirejs/requirejs/blob/master/LICENSE
  */
 //Not using strict: uneven strict support in browsers, #392, and causes
@@ -11,7 +11,7 @@ var requirejs, require, define;
 (function (global, setTimeout) {
     var req, s, head, baseElement, dataMain, src,
         interactiveScript, currentlyAddingScript, mainScript, subPath,
-        version = '2.3.2',
+        version = '2.3.7',
         commentRegExp = /\/\*[\s\S]*?\*\/|([^:"'=]|^)\/\/.*$/mg,
         cjsRequireRegExp = /[^.]\s*require\s*\(\s*["']([^'"\s]+)["']\s*\)/g,
         jsSuffixRegExp = /\.js$/,
@@ -33,7 +33,8 @@ var requirejs, require, define;
         contexts = {},
         cfg = {},
         globalDefQueue = [],
-        useInteractive = false;
+        useInteractive = false,
+        disallowedProps = ['__proto__', 'constructor'];
 
     //Could match something like ')//comment', do not lose the prefix to comment.
     function commentReplace(match, singlePrefix) {
@@ -94,7 +95,7 @@ var requirejs, require, define;
     function eachProp(obj, func) {
         var prop;
         for (prop in obj) {
-            if (hasProp(obj, prop)) {
+            if (hasProp(obj, prop) && disallowedProps.indexOf(prop) == -1) {
                 if (func(obj[prop], prop)) {
                     break;
                 }
@@ -165,7 +166,7 @@ var requirejs, require, define;
      * @returns {Error}
      */
     function makeError(id, msg, err, requireModules) {
-        var e = new Error(msg + '\nhttp://requirejs.org/docs/errors.html#' + id);
+        var e = new Error(msg + '\nhttps://requirejs.org/docs/errors.html#' + id);
         e.requireType = id;
         e.requireModules = requireModules;
         if (err) {
@@ -440,7 +441,9 @@ var requirejs, require, define;
             //Account for relative paths if there is a base name.
             if (name) {
                 if (prefix) {
-                    if (pluginModule && pluginModule.normalize) {
+                    if (isNormalized) {
+                        normalizedName = name;
+                    } else if (pluginModule && pluginModule.normalize) {
                         //Plugin is loaded, use its normalize method.
                         normalizedName = pluginModule.normalize(name, function (name) {
                             return normalize(name, parentName, applyMap);
@@ -972,7 +975,8 @@ var requirejs, require, define;
                         //prefix and name should already be normalized, no need
                         //for applying map config again either.
                         normalizedMap = makeModuleMap(map.prefix + '!' + name,
-                                                      this.map.parentMap);
+                                                      this.map.parentMap,
+                                                      true);
                         on(normalizedMap,
                             'defined', bind(this, function (value) {
                                 this.map.normalizedMap = normalizedMap;