修复会员表结构字段

优化版本依赖

README.md

@@ -24,12 +24,10 @@ FastAdmin是一款基于ThinkPHP+Bootstrap的极速后台开发框架。
 * 多语言支持，服务端及客户端支持
 * 支持大文件分片上传、剪切板粘贴上传、拖拽上传，进度条显示，图片上传前压缩
 * 支持表格固定列、固定表头、跨页选择、Excel导出、模板渲染等功能
-* 强大的第三方应用模块支持([CMS](https://www.fastadmin.net/store/cms.html)、[博客](https://www.fastadmin.net/store/blog.html)、[知识付费问答](https://www.fastadmin.net/store/ask.html)、[在线投票系统](https://www.fastadmin.net/store/vote.html)、[B2C商城](https://www.fastadmin.net/store/shopro.html)、[B2B2C商城](https://www.fastadmin.net/store/wanlshop.html))
+* 强大的第三方应用模块支持([CMS](https://www.fastadmin.net/store/cms.html)、[CRM](https://www.fastadmin.net/store/facrm.html)、[企业网站管理系统](https://www.fastadmin.net/store/ldcms.html)、[知识库文档系统](https://www.fastadmin.net/store/knowbase.html)、[在线投票系统](https://www.fastadmin.net/store/vote.html)、[B2C商城](https://www.fastadmin.net/store/shopro.html)、[B2B2C商城](https://www.fastadmin.net/store/wanlshop.html))
-* 支持CMS、博客、知识付费问答无缝整合[Xunsearch全文搜索](https://www.fastadmin.net/store/xunsearch.html)
-* 第三方小程序支持([CMS小程序](https://www.fastadmin.net/store/cms.html)、[预订小程序](https://www.fastadmin.net/store/ball.html)、[问答小程序](https://www.fastadmin.net/store/ask.html)、[点餐小程序](https://www.fastadmin.net/store/unidrink.html)、[B2C小程序](https://www.fastadmin.net/store/shopro.html)、[B2B2C小程序](https://www.fastadmin.net/store/wanlshop.html)、[博客小程序](https://www.fastadmin.net/store/blog.html))
 * 整合第三方短信接口(阿里云、腾讯云短信)
-* 无缝整合第三方云存储(七牛云、阿里云OSS、又拍云)功能，支持云储存分片上传
+* 无缝整合第三方云存储(七牛云、阿里云OSS、腾讯云存储、又拍云)功能，支持云储存分片上传
-* 第三方富文本编辑器支持(Summernote、Kindeditor、百度编辑器)
+* 第三方富文本编辑器支持(Summernote、百度编辑器)
 * 第三方登录(QQ、微信、微博)整合
 * 第三方支付(微信、支付宝)无缝整合，微信支持PC端扫码支付
 * 丰富的插件应用市场
@@ -55,9 +53,7 @@ https://demo.fastadmin.net
 
 在使用中有任何问题，请使用以下联系方式联系我们
 
-交流社区: https://ask.fastadmin.net
+问答社区: https://ask.fastadmin.net
-
-QQ 1 群（满）、QQ 2 群（满）、QQ 3 群（满）、QQ 4 群（满）、QQ 5 群（满）、QQ 6 群（满）、[QQ 7 群](https://www.fastadmin.net/goto/qun)。
 
 Github: https://github.com/karsonzhang/fastadmin
 
@@ -92,6 +88,6 @@ FastAdmin遵循Apache2开源协议发布，并提供免费使用。
 
 本项目包含的第三方源码和二进制文件之版权信息另行标注。
 
-版权所有Copyright © 2017-2022 by FastAdmin (https://www.fastadmin.net)
+版权所有Copyright © 2017-2024 by FastAdmin (https://www.fastadmin.net)
 
 All rights reserved。

application/admin/behavior/AdminLog.php

@@ -4,7 +4,7 @@ namespace app\admin\behavior;
 
 class AdminLog
 {
-    public function run(&$params)
+    public function run(&$response)
     {
         //只记录POST请求的日志
         if (request()->isPost() && config('fastadmin.auto_record_log')) {

application/admin/command/Addon.php

@@ -15,7 +15,6 @@ use think\exception\PDOException;
 
 class Addon extends Command
 {
-
     protected function configure()
     {
         $this
@@ -33,6 +32,7 @@ class Addon extends Command
 
     protected function execute(Input $input, Output $output)
     {
+        \think\Config::load(dirname(dirname(__FILE__)) . DS . 'config.php');
         $name = $input->getOption('name') ?: '';
         $action = $input->getOption('action') ?: '';
         if (stripos($name, 'addons' . DS) !== false) {
@@ -82,7 +82,6 @@ class Addon extends Command
                         $createTableSql = $result[0]['Create Table'];
                     }
                 } catch (PDOException $e) {
-
                 }
 
                 $data = [
@@ -177,12 +176,12 @@ class Addon extends Command
                 if (!$info) {
                     throw new Exception(__('Addon info file data incorrect'));
                 }
-                $infoname = isset($info['name']) ? $info['name'] : '';
+                $infoname = $info['name'] ?? '';
                 if (!$infoname || !preg_match("/^[a-z]+$/i", $infoname) || $infoname != $name) {
                     throw new Exception(__('Addon info name incorrect'));
                 }
 
-                $infoversion = isset($info['version']) ? $info['version'] : '';
+                $infoversion = $info['version'] ?? '';
                 if (!$infoversion || !preg_match("/^\d+\.\d+\.\d+$/i", $infoversion)) {
                     throw new Exception(__('Addon info version incorrect'));
                 }
@@ -340,5 +339,4 @@ class Addon extends Command
     {
         return __DIR__ . '/Addon/stubs/' . $name . '.stub';
     }
-
 }

application/admin/command/Api/template/index.html

@@ -8,15 +8,15 @@
         <title>{$config.title}</title>
 
         <!-- Bootstrap Core CSS -->
-        <link href="https://cdn.staticfile.org/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">
+        <link href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/twitter-bootstrap/3.4.1/css/bootstrap.min.css" rel="stylesheet">
 
         <!-- Plugin CSS -->
-        <link href="https://cdn.staticfile.org/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
+        <link href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
 
         <!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
         <!--[if lt IE 9]>
-        <script src="https://cdn.staticfile.org/html5shiv/3.7.3/html5shiv.min.js"></script>
+        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/html5shiv/3.7.3/html5shiv.min.js"></script>
-        <script src="https://cdn.staticfile.org/respond.js/1.4.2/respond.min.js"></script>
+        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/respond.js/1.4.2/respond.min.js"></script>
         <![endif]-->
 
         <style type="text/css">
@@ -401,10 +401,10 @@
         </div> <!-- /container -->
 
         <!-- jQuery -->
-        <script src="https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js"></script>
+        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/jquery/3.6.0/jquery.min.js"></script>
 
         <!-- Bootstrap Core JavaScript -->
-        <script src="https://cdn.staticfile.org/twitter-bootstrap/3.3.7/js/bootstrap.min.js"></script>
+        <script src="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/twitter-bootstrap/3.4.1/js/bootstrap.min.js"></script>
 
         <script type="text/javascript">
             function syntaxHighlight(json) {

application/admin/command/Crud.php

@@ -152,7 +152,7 @@ class Crud extends Command
     /**
      * JSON后缀
      */
-    protected $jsonSuffix = ['json'];
+    protected $jsonSuffix = ['json', 'array'];
 
     /**
      * 标签后缀
@@ -435,16 +435,19 @@ class Crud extends Command
         $modelName = $table = stripos($table, $prefix) === 0 ? substr($table, strlen($prefix)) : $table;
         $modelTableType = 'table';
         $modelTableTypeName = $modelTableName = $modelName;
-        $modelTableInfo = $dbconnect->query("SHOW TABLE STATUS LIKE '{$modelTableName}'", [], true);
+        $modelTableInfo = null;
-        if (!$modelTableInfo) {
+        if (!$input->getOption('delete')) {
-            $modelTableType = 'name';
-            $modelTableName = $prefix . $modelName;
             $modelTableInfo = $dbconnect->query("SHOW TABLE STATUS LIKE '{$modelTableName}'", [], true);
             if (!$modelTableInfo) {
-                throw new Exception("table not found");
+                $modelTableType = 'name';
+                $modelTableName = $prefix . $modelName;
+                $modelTableInfo = $dbconnect->query("SHOW TABLE STATUS LIKE '{$modelTableName}'", [], true);
+                if (!$modelTableInfo) {
+                    throw new Exception("table not found");
+                }
             }
+            $modelTableInfo = $modelTableInfo[0];
         }
-        $modelTableInfo = $modelTableInfo[0];
 
         $relations = [];
         //检查关联表
@@ -466,7 +469,7 @@ class Crud extends Command
                     }
                 }
                 $relationTableInfo = $relationTableInfo[0];
-                $relationModel = isset($relationModels[$index]) ? $relationModels[$index] : '';
+                $relationModel = $relationModels[$index] ?? '';
 
                 list($relationNamespace, $relationName, $relationFile) = $this->getModelData($modelModuleName, $relationModel, $relationName);
 
@@ -666,8 +669,8 @@ class Crud extends Command
         //如果是关联模型
         foreach ($relations as $index => &$relation) {
             if ($relation['relationMode'] == 'hasone') {
-                $relationForeignKey = $relation['relationForeignKey'] ? $relation['relationForeignKey'] : $table . "_id";
+                $relationForeignKey = $relation['relationForeignKey'] ?: $table . "_id";
-                $relationPrimaryKey = $relation['relationPrimaryKey'] ? $relation['relationPrimaryKey'] : $priKey;
+                $relationPrimaryKey = $relation['relationPrimaryKey'] ?: $priKey;
 
                 if (!in_array($relationForeignKey, $relation['relationFieldList'])) {
                     throw new Exception('relation table [' . $relation['relationTableName'] . '] must be contain field [' . $relationForeignKey . ']');
@@ -676,8 +679,8 @@ class Crud extends Command
                     throw new Exception('table [' . $modelTableName . '] must be contain field [' . $relationPrimaryKey . ']');
                 }
             } elseif ($relation['relationMode'] == 'belongsto') {
-                $relationForeignKey = $relation['relationForeignKey'] ? $relation['relationForeignKey'] : Loader::parseName($relation['relationName']) . "_id";
+                $relationForeignKey = $relation['relationForeignKey'] ?: Loader::parseName($relation['relationName']) . "_id";
-                $relationPrimaryKey = $relation['relationPrimaryKey'] ? $relation['relationPrimaryKey'] : $relation['relationPriKey'];
+                $relationPrimaryKey = $relation['relationPrimaryKey'] ?: $relation['relationPriKey'];
                 if (!in_array($relationForeignKey, $fieldArr)) {
                     throw new Exception('table [' . $modelTableName . '] must be contain field [' . $relationForeignKey . ']');
                 }
@@ -685,8 +688,8 @@ class Crud extends Command
                     throw new Exception('relation table [' . $relation['relationTableName'] . '] must be contain field [' . $relationPrimaryKey . ']');
                 }
             } elseif ($relation['relationMode'] == 'hasmany') {
-                $relationForeignKey = $relation['relationForeignKey'] ? $relation['relationForeignKey'] : $table . "_id";
+                $relationForeignKey = $relation['relationForeignKey'] ?: $table . "_id";
-                $relationPrimaryKey = $relation['relationPrimaryKey'] ? $relation['relationPrimaryKey'] : $priKey;
+                $relationPrimaryKey = $relation['relationPrimaryKey'] ?: $priKey;
                 if (!in_array($relationForeignKey, $relation['relationFieldList'])) {
                     throw new Exception('relation table [' . $relation['relationTableName'] . '] must be contain field [' . $relationForeignKey . ']');
                 }
@@ -879,7 +882,7 @@ class Crud extends Command
                         $formEditElement = Form::input('text', $fieldName, $editValue, $attrArr);
                     } elseif ($inputType == 'fieldlist') {
                         $itemArr = $this->getItemArray($itemArr, $field, $v['COLUMN_COMMENT']);
-                        $templateName = !isset($itemArr['key']) && !isset($itemArr['value']) && count($itemArr) > 0 ? 'fieldlist-template' : 'fieldlist';
+                        $templateName = !isset($itemArr['key']) && count($itemArr) > 0 ? (isset($itemArr['value']) && count($itemArr) === 1 ? 'fieldlist-array' : 'fieldlist-template') : 'fieldlist';
                         $itemKey = isset($itemArr['key']) ? ucfirst($itemArr['key']) : 'Key';
                         $itemValue = isset($itemArr['value']) ? ucfirst($itemArr['value']) : 'Value';
                         $theadListArr = $tbodyListArr = [];
@@ -901,6 +904,12 @@ class Crud extends Command
                             $cssClassArr[] = 'selectpage';
                             $selectpageTable = substr($field, 0, strripos($field, '_'));
                             $selectpageField = '';
+                            foreach ($relations as $index => $relation) {
+                                if ($relation['relationForeignKey'] === $field) {
+                                    $selectpageTable = substr($relation['relationTableName'], strlen($prefix));
+                                    break;
+                                }
+                            }
                             $selectpageController = str_replace('_', '/', $selectpageTable);
                             $attrArr['data-source'] = $selectpageController . "/index";
                             //如果是类型表需要特殊处理下
@@ -1075,7 +1084,7 @@ class Crud extends Command
             }
 
             //表注释
-            $tableComment = $modelTableInfo['Comment'];
+            $tableComment = $modelTableInfo ? $modelTableInfo['Comment'] : '';
             $tableComment = mb_substr($tableComment, -1) == '表' ? mb_substr($tableComment, 0, -1) . '管理' : $tableComment;
 
             $modelInit = '';
@@ -1536,7 +1545,7 @@ EOD;
     {
         $itemArr = [];
         $comment = str_replace('，', ',', $comment);
-        if (stripos($comment, ':') !== false && stripos($comment, ',') && stripos($comment, '=') !== false) {
+        if (stripos($comment, ':') !== false && stripos($comment, '=') !== false) {
             list($fieldLang, $item) = explode(':', $comment);
             $itemArr = [];
             foreach (explode(',', $item) as $k => $v) {

application/admin/command/Crud/stubs/html/fieldlist-array.stub

@@ -0,0 +1,21 @@
+
+            <dl class="list-unstyled fieldlist" data-name="{%fieldName%}" data-template="{%fieldName%}tpl">
+                <dd>
+                    <ins>{:__('{%itemValue%}')}</ins>
+                </dd>
+                <dd>
+                    <ins><a href="javascript:;" class="btn btn-sm btn-success btn-append"><i class="fa fa-plus"></i> {:__('Append')}</a></ins>
+                </dd>
+            </dl>
+
+            <textarea name="{%fieldName%}" class="form-control hide" cols="30" rows="5">{%fieldValue%}</textarea>
+            <script id="{%fieldName%}tpl" type="text/html">
+                <dd class="form-inline">
+                    <ins><input type="text" name="<%=name%>[<%=index%>][value]" class="form-control" size="15" value="<%=row%>"/></ins>
+                    <ins>
+                        <span class="btn btn-sm btn-danger btn-remove"><i class="fa fa-times"></i></span>
+                        <span class="btn btn-sm btn-primary btn-dragsort"><i class="fa fa-arrows"></i></span>
+                    </ins>
+                </dd>
+            </script>
+

application/admin/command/Crud/stubs/mixins/modelinit.stub

@@ -2,7 +2,9 @@
     protected static function init()
     {
         self::afterInsert(function ($row) {
-            $pk = $row->getPk();
+            if (!$row['{%order%}']) {
-            $row->getQuery()->where($pk, $row[$pk])->update(['{%order%}' => $row[$pk]]);
+                $pk = $row->getPk();
+                $row->getQuery()->where($pk, $row[$pk])->update(['{%order%}' => $row[$pk]]);
+            }
         });
     }

application/admin/command/Install.php

@@ -70,7 +70,7 @@ class Install extends Command
 
         $adminName = $this->installation($hostname, $hostport, $database, $username, $password, $prefix, $adminUsername, $adminPassword, $adminEmail, $siteName);
         if ($adminName) {
-            $output->highlight("Admin url:http://www.yoursite.com/{$adminName}");
+            $output->highlight("Admin url:http://www.example.com/{$adminName}");
         }
 
         $output->highlight("Admin username:{$adminUsername}");
@@ -86,7 +86,7 @@ class Install extends Command
      */
     public function index()
     {
-        $this->view = View::instance(Config::get('template'), Config::get('view_replace_str'));
+        $this->view = View::instance(array_merge(Config::get('template'), ['tpl_cache' => false]));
         $this->request = Request::instance();
 
         define('INSTALL_PATH', APP_PATH . 'admin' . DS . 'command' . DS . 'Install' . DS);
@@ -309,8 +309,8 @@ class Install extends Command
         //数据库配置文件
         $dbConfigFile = APP_PATH . 'database.php';
 
-        if (version_compare(PHP_VERSION, '7.2.0', '<')) {
+        if (version_compare(PHP_VERSION, '7.4.0', '<')) {
-            throw new Exception(__("The current version %s is too low, please use PHP 7.2 or higher", PHP_VERSION));
+            throw new Exception(__("The current version %s is too low, please use PHP 7.4 or higher", PHP_VERSION));
         }
         if (!extension_loaded("PDO")) {
             throw new Exception(__("PDO is not currently installed and cannot be installed"));

application/admin/command/Install/fastadmin.sql

@@ -1,6 +1,6 @@
 /*
  FastAdmin Install SQL
- Date: 2023-06-07 15:17:57
+ Date: 2024-09-03 15:05:25
 */
 
 SET FOREIGN_KEY_CHECKS = 0;
@@ -32,7 +32,7 @@ CREATE TABLE `fa_admin` (
 -- Records of fa_admin
 -- ----------------------------
 BEGIN;
-INSERT INTO `fa_admin` VALUES (1, 'admin', 'Admin', '', '', '/assets/img/avatar.png', 'admin@admin.com', '', 0, 1491635035, '127.0.0.1',1491635035, 1491635035, '', 'normal');
+INSERT INTO `fa_admin` VALUES (1, 'admin', 'Admin', '', '', '/assets/img/avatar.png', 'admin@example.com', '', 0, 1491635035, '127.0.0.1',1491635035, 1491635035, '', 'normal');
 COMMIT;
 
 -- ----------------------------
@@ -81,8 +81,8 @@ CREATE TABLE `fa_attachment` (
   `admin_id` int(10) unsigned NOT NULL DEFAULT '0' COMMENT '管理员ID',
   `user_id` int(10) unsigned NOT NULL DEFAULT '0' COMMENT '会员ID',
   `url` varchar(255) DEFAULT '' COMMENT '物理路径',
-  `imagewidth` varchar(30) DEFAULT '' COMMENT '宽度',
+  `imagewidth` int(10) unsigned DEFAULT 0 COMMENT '宽度',
-  `imageheight` varchar(30) DEFAULT '' COMMENT '高度',
+  `imageheight` int(10) unsigned DEFAULT 0 COMMENT '高度',
   `imagetype` varchar(30) DEFAULT '' COMMENT '图片类型',
   `imageframes` int(10) unsigned NOT NULL DEFAULT '0' COMMENT '图片帧数',
   `filename` varchar(100) DEFAULT '' COMMENT '文件名称',
@@ -342,10 +342,10 @@ INSERT INTO `fa_config` VALUES (10, 'configgroup', 'dictionary', 'Config group',
 INSERT INTO `fa_config` VALUES (11, 'mail_type', 'email', 'Mail type', '选择邮件发送方式', 'select', '', '1', '[\"请选择\",\"SMTP\"]', '', '', '');
 INSERT INTO `fa_config` VALUES (12, 'mail_smtp_host', 'email', 'Mail smtp host', '错误的配置发送邮件会导致服务器超时', 'string', '', 'smtp.qq.com', '', '', '', '');
 INSERT INTO `fa_config` VALUES (13, 'mail_smtp_port', 'email', 'Mail smtp port', '(不加密默认25,SSL默认465,TLS默认587)', 'string', '', '465', '', '', '', '');
-INSERT INTO `fa_config` VALUES (14, 'mail_smtp_user', 'email', 'Mail smtp user', '（填写完整用户名）', 'string', '', '10000', '', '', '', '');
+INSERT INTO `fa_config` VALUES (14, 'mail_smtp_user', 'email', 'Mail smtp user', '（填写完整用户名）', 'string', '', '', '', '', '', '');
-INSERT INTO `fa_config` VALUES (15, 'mail_smtp_pass', 'email', 'Mail smtp password', '（填写您的密码或授权码）', 'string', '', 'password', '', '', '', '');
+INSERT INTO `fa_config` VALUES (15, 'mail_smtp_pass', 'email', 'Mail smtp password', '（填写您的密码或授权码）', 'password', '', '', '', '', '', '');
 INSERT INTO `fa_config` VALUES (16, 'mail_verify_type', 'email', 'Mail vertify type', '（SMTP验证方式[推荐SSL]）', 'select', '', '2', '[\"无\",\"TLS\",\"SSL\"]', '', '', '');
-INSERT INTO `fa_config` VALUES (17, 'mail_from', 'email', 'Mail from', '', 'string', '', '10000@qq.com', '', '', '', '');
+INSERT INTO `fa_config` VALUES (17, 'mail_from', 'email', 'Mail from', '', 'string', '', '', '', '', '', '');
 INSERT INTO `fa_config` VALUES (18, 'attachmentcategory', 'dictionary', 'Attachment category', '', 'array', '', '{\"category1\":\"Category1\",\"category2\":\"Category2\",\"custom\":\"Custom\"}', '', '', '', '');
 COMMIT;
 
@@ -399,7 +399,8 @@ CREATE TABLE `fa_test` (
   `keywords` varchar(255) DEFAULT '' COMMENT '关键字',
   `description` varchar(255) DEFAULT '' COMMENT '描述',
   `city` varchar(100) DEFAULT '' COMMENT '省市',
-  `json` varchar(255) DEFAULT NULL COMMENT '配置:key=名称,value=值',
+  `array` varchar(255) DEFAULT '' COMMENT '数组:value=值',
+  `json` varchar(255) DEFAULT '' COMMENT '配置:key=名称,value=值',
   `multiplejson` varchar(1500) DEFAULT '' COMMENT '二维数组:title=标题,intro=介绍,author=作者,age=年龄',
   `price` decimal(10,2) unsigned DEFAULT '0.00' COMMENT '价格',
   `views` int(10) unsigned DEFAULT '0' COMMENT '点击',
@@ -423,7 +424,7 @@ CREATE TABLE `fa_test` (
 -- Records of fa_test
 -- ----------------------------
 BEGIN;
-INSERT INTO `fa_test` VALUES (1, 1, 1, 12, '12,13', '互联网,计算机', 'monday', 'hot,index', 'male', 'music,reading', '我是一篇测试文章', '<p>我是测试内容</p>', '/assets/img/avatar.png', '/assets/img/avatar.png,/assets/img/qrcode.png', '/assets/img/avatar.png', '关键字', '我是一篇测试文章描述，内容过多时将自动隐藏', '广西壮族自治区/百色市/平果县', '{\"a\":\"1\",\"b\":\"2\"}', '[{\"title\":\"标题一\",\"intro\":\"介绍一\",\"author\":\"小明\",\"age\":\"21\"}]', 0.00, 0, '2020-10-01 00:00:00 - 2021-10-31 23:59:59', '2017-07-10', '2017-07-10 18:24:45', 2017, '18:24:45', 1491635035, 1491635035, 1491635035, NULL, 0, 1, 'normal', '1');
+INSERT INTO `fa_test` VALUES (1, 1, 1, 12, '12,13', '互联网,计算机', 'monday', 'hot,index', 'male', 'music,reading', '我是一篇测试文章', '<p>我是测试内容</p>', '/assets/img/avatar.png', '/assets/img/avatar.png,/assets/img/qrcode.png', '/assets/img/avatar.png', '关键字', '我是一篇测试文章描述，内容过多时将自动隐藏', '广西壮族自治区/百色市/平果县', '[\"a\",\"b\"]', '{\"a\":\"1\",\"b\":\"2\"}', '[{\"title\":\"标题一\",\"intro\":\"介绍一\",\"author\":\"小明\",\"age\":\"21\"}]', 0.00, 0, '2020-10-01 00:00:00 - 2021-10-31 23:59:59', '2017-07-10', '2017-07-10 18:24:45', 2017, '18:24:45', 1491635035, 1491635035, 1491635035, NULL, 0, 1, 'normal', '1');
 COMMIT;
 
 -- ----------------------------
@@ -451,6 +452,7 @@ CREATE TABLE `fa_user` (
   `logintime` bigint(16) DEFAULT NULL COMMENT '登录时间',
   `loginip` varchar(50) DEFAULT '' COMMENT '登录IP',
   `loginfailure` tinyint(1) unsigned NOT NULL DEFAULT '0' COMMENT '失败次数',
+  `loginfailuretime` bigint(16) DEFAULT NULL COMMENT '最后登录失败时间',
   `joinip` varchar(50) DEFAULT '' COMMENT '加入IP',
   `jointime` bigint(16) DEFAULT NULL COMMENT '加入时间',
   `createtime` bigint(16) DEFAULT NULL COMMENT '创建时间',
@@ -468,7 +470,7 @@ CREATE TABLE `fa_user` (
 -- Records of fa_user
 -- ----------------------------
 BEGIN;
-INSERT INTO `fa_user` VALUES (1, 1, 'admin', 'admin', '', '', 'admin@163.com', '13888888888', '', 0, 0, '2017-04-08', '', 0, 0, 1, 1, 1491635035, 1491635035, '127.0.0.1', 0, '127.0.0.1', 1491635035, 0, 1491635035, '', 'normal','');
+INSERT INTO `fa_user` VALUES (1, 1, 'admin', 'admin', '', '', 'admin@163.com', '13000000000', '', 0, 0, '2017-04-08', '', 0, 0, 1, 1, 1491635035, 1491635035, '127.0.0.1', 0, 1491635035,'127.0.0.1', 1491635035, 0, 1491635035, '', 'normal','');
 COMMIT;
 
 -- ----------------------------

application/admin/command/Install/install.html

@@ -254,7 +254,7 @@
         </form>
 
         <!-- jQuery -->
-        <script src="https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js"></script>
+        <script src="__ROOT__/assets/libs/jquery/dist/jquery.min.js"></script>
 
         <script>
             $(function () {

application/admin/command/Install/zh-cn.php

@@ -20,14 +20,14 @@ return [
     'Dashboard'                                                                                             => '进入后台',
     'Go back'                                                                                               => '返回上一页',
     'Install Successed'                                                                                     => '安装成功！',
-    'Security tips'                                                                                         => '温馨提示：请将以下后台登录入口添加到你的收藏夹，为了你的安全，不要泄漏或发送给他人！如有泄漏请及时修改！',
+    'Security tips'                                                                                         => '温馨提示：请将以下后台登录入口添加到你的收藏夹，为了你的站点安全，不要泄漏或发送给他人！如有泄漏请及时修改！',
     'Please input correct database'                                                                         => '请输入正确的数据库名',
     'Please input correct username'                                                                         => '用户名只能由3-30位数字、字母、下划线组合',
     'Please input correct password'                                                                         => '密码长度必须在6-30位之间，不能包含空格',
     'Password is too weak'                                                                                  => '密码太简单，请重新输入',
     'The two passwords you entered did not match'                                                           => '两次输入的密码不一致',
     'Please input correct website'                                                                          => '网站名称输入不正确',
-    'The current version %s is too low, please use PHP 7.1 or higher'                                       => '当前版本%s过低，请使用PHP7.1以上版本',
+    'The current version %s is too low, please use PHP 7.4 or higher'                                       => '当前版本%s过低，请使用PHP7.4及以上版本',
     'PDO is not currently installed and cannot be installed'                                                => '当前未开启PDO，无法进行安装',
     'The current permissions are insufficient to write the file %s'                                         => '当前权限不足，无法写入文件%s',
     'Please go to the official website to download the full package or resource package and try to install' => '当前代码仅包含核心代码，请前往官网下载完整包或资源包覆盖后再尝试安装',

application/admin/common.php

@@ -18,8 +18,8 @@ if (!function_exists('build_select')) {
      */
     function build_select($name, $options, $selected = [], $attr = [])
     {
-        $options = is_array($options) ? $options : explode(',', $options);
+        $options = is_array($options) ? $options : explode(',', $options ?? '');
-        $selected = is_array($selected) ? $selected : explode(',', $selected);
+        $selected = is_array($selected) ? $selected : explode(',', $selected ?? '');
         return Form::select($name, $options, $selected, $attr);
     }
 }
@@ -121,7 +121,7 @@ if (!function_exists('build_toolbar')) {
         $html = [];
         foreach ($btns as $k => $v) {
             //如果未定义或没有权限
-            if (!isset($btnAttr[$v]) || ($v !== 'refresh' && !$auth->check("{$controller}/{$v}"))) {
+            if (!isset($btnAttr[$v]) || ($v !== 'refresh' && !$auth->check("{$controller}/{$v}", $auth->id))) {
                 continue;
             }
             list($href, $class, $icon, $text, $title) = $btnAttr[$v];

application/admin/controller/Addon.php

@@ -95,19 +95,24 @@ class Addon extends Backend
         }
         $tips = [];
         $groupList = [];
+        $ungroupList = [];
         foreach ($config as $index => &$item) {
             //如果有设置分组
             if (isset($item['group']) && $item['group']) {
                 if (!in_array($item['group'], $groupList)) {
                     $groupList["custom" . (count($groupList) + 1)] = $item['group'];
                 }
+            } elseif ($item['name'] != '__tips__') {
+                $ungroupList[] = $item['name'];
             }
             if ($item['name'] == '__tips__') {
                 $tips = $item;
                 unset($config[$index]);
             }
         }
-        $groupList['other'] = '其它';
+        if ($ungroupList) {
+            $groupList['other'] = '其它';
+        }
         $this->view->assign("groupList", $groupList);
         $this->view->assign("addon", ['info' => $info, 'config' => $config, 'tips' => $tips]);
         $configFile = ADDON_PATH . $name . DS . 'config.html';
@@ -230,6 +235,7 @@ class Addon extends Backend
             $uid = $this->request->post("uid");
             $token = $this->request->post("token");
             $faversion = $this->request->post("faversion");
+            $force = $this->request->post("force");
             if (!$uid || !$token) {
                 throw new Exception(__('Please login and try to install'));
             }
@@ -238,7 +244,7 @@ class Addon extends Backend
                 'token'     => $token,
                 'faversion' => $faversion
             ];
-            $info = Service::local($file, $extend);
+            $info = Service::local($file, $extend, $force);
         } catch (AddonException $e) {
             $this->result($e->getData(), $e->getCode(), __($e->getMessage()));
         } catch (Exception $e) {
@@ -319,9 +325,8 @@ class Addon extends Backend
     {
         $offset = (int)$this->request->get("offset");
         $limit = (int)$this->request->get("limit");
-        $filter = $this->request->get("filter");
+        $filter = $this->request->get("filter", '');
-        $search = $this->request->get("search");
+        $search = $this->request->get("search", '', 'strip_tags,htmlspecialchars');
-        $search = htmlspecialchars(strip_tags($search));
         $onlineaddons = $this->getAddonList();
         $filter = (array)json_decode($filter, true);
         $addons = get_addon_list();
@@ -442,8 +447,11 @@ class Addon extends Backend
             } catch (\Exception $e) {
 
             }
-            $rows = isset($json['rows']) ? $json['rows'] : [];
+            $rows = $json['rows'] ?? [];
             foreach ($rows as $index => $row) {
+                if (!isset($row['name'])) {
+                    continue;
+                }
                 $onlineaddons[$row['name']] = $row;
             }
             Cache::set("onlineaddons", $onlineaddons, 600);

application/admin/controller/Ajax.php

@@ -11,6 +11,7 @@ use think\Cache;
 use think\Config;
 use think\Db;
 use think\Lang;
+use think\Loader;
 use think\Response;
 use think\Validate;
 
@@ -47,9 +48,20 @@ class Ajax extends Backend
             $header['Expires'] = gmdate("D, d M Y H:i:s", time() + $offset) . " GMT";
         }
 
+        $controllername = $this->request->get('controllername');
+        $lang = $this->request->get('lang');
+        if (!$lang || !in_array($lang, config('allow_lang_list')) || !$controllername || !preg_match("/^[a-z0-9_\.]+$/i", $controllername)) {
+            return jsonp(['errmsg' => '参数错误'], 200, [], ['json_encode_param' => JSON_FORCE_OBJECT | JSON_UNESCAPED_UNICODE]);
+        }
+
         $controllername = input("controllername");
-        //默认只加载了控制器对应的语言名，你还根据控制器名来加载额外的语言包
+        $className = Loader::parseClass($this->request->module(), 'controller', $controllername, false);
-        $this->loadlang($controllername);
+
+        //存在对应的类才加载
+        if (class_exists($className)) {
+            $this->loadlang($controllername);
+        }
+
         return jsonp(Lang::get(), 200, $header, ['json_encode_param' => JSON_FORCE_OBJECT | JSON_UNESCAPED_UNICODE]);
     }
 

application/admin/controller/auth/Adminlog.php

@@ -53,6 +53,7 @@ class Adminlog extends Backend
                         $query->where('admin_id', 'in', $childrenAdminIds);
                     }
                 })
+                ->field('content,useragent', true)
                 ->order($sort, $order)
                 ->paginate($limit);
 

application/admin/controller/general/Profile.php

@@ -74,6 +74,7 @@ class Profile extends Backend
                 $admin->save($params);
                 //因为个人资料面板读取的Session显示，修改自己资料后同时更新Session
                 Session::set("admin", $admin->toArray());
+                Session::set("admin.safecode", $this->auth->getEncryptSafecode($admin));
                 $this->success();
             }
             $this->error();

application/admin/controller/user/User.php

@@ -24,7 +24,7 @@ class User extends Backend
     public function _initialize()
     {
         parent::_initialize();
-        $this->model = model('User');
+        $this->model = new \app\admin\model\User;
     }
 
     /**

application/admin/lang/zh-cn/addon.php

@@ -33,6 +33,7 @@ return [
     'Store not available tips'                                => '插件市场暂不可用，是否切换到本地插件？',
     'Switch to the local'                                     => '切换到本地插件',
     'try to reload'                                           => '重新尝试加载',
+    'Please disable addon first'                              => '请先禁用插件再进行操作',
     'Please disable the add before trying to upgrade'         => '请先禁用插件再进行升级',
     'Please disable the add before trying to uninstall'       => '请先禁用插件再进行卸载',
     'Login now'                                               => '立即登录',

application/admin/lang/zh-cn/general/profile.php

@@ -2,7 +2,7 @@
 
 return [
     'Url'                                         => '链接',
-    'Userame'                                     => '用户名',
+    'Username'                                    => '用户名',
     'Createtime'                                  => '操作时间',
     'Click to edit'                               => '点击编辑',
     'Admin log'                                   => '操作日志',

application/admin/lang/zh-cn/index.php

@@ -25,6 +25,8 @@ return [
     'Disable top menu badge'                                     => '禁用顶部彩色小角标',
     'Disable top menu badge without left menu'                   => '左边菜单栏的彩色小角标不受影响',
     'Skins'                                                      => '皮肤',
+    'Username must be 3 to 30 characters'                        => '用户名只能由3-30位数字、字母、下划线组合',
+    'Password must be 6 to 30 characters'                        => '密码长度必须在6-30位之间，不能包含空格',
     'You\'ve logged in, do not login again'                      => '你已经登录，无需重复登录',
     'Username or password can not be empty'                      => '用户名密码不能为空',
     'Username or password is incorrect'                          => '用户名或密码不正确',

application/admin/library/Auth.php

@@ -339,7 +339,7 @@ class Auth extends \fast\Auth
             }
         }
         // 取出所有分组
-        $groupList = \app\admin\model\AuthGroup::where(['status' => 'normal'])->select();
+        $groupList = \app\admin\model\AuthGroup::where($this->isSuperAdmin() ? '1=1' : ['status' => 'normal'])->select();
         $objList = [];
         foreach ($groups as $k => $v) {
             if ($v['rules'] === '*') {
@@ -371,8 +371,7 @@ class Auth extends \fast\Auth
         $childrenAdminIds = [];
         if (!$this->isSuperAdmin()) {
             $groupIds = $this->getChildrenGroupIds(false);
-            $authGroupList = \app\admin\model\AuthGroupAccess::
+            $authGroupList = \app\admin\model\AuthGroupAccess::field('uid,group_id')
-            field('uid,group_id')
                 ->where('group_id', 'in', $groupIds)
                 ->select();
             foreach ($authGroupList as $k => $v) {
@@ -418,7 +417,6 @@ class Auth extends \fast\Auth
                 $titleArr[$pathArr[$rule['name']]] = $rule['title'];
                 $menuArr[$pathArr[$rule['name']]] = $rule;
             }
-
         }
         ksort($menuArr);
         $this->breadcrumb = $menuArr;
@@ -444,9 +442,9 @@ class Auth extends \fast\Auth
         foreach ($params as $k => $v) {
             $url = $k;
             if (is_array($v)) {
-                $nums = isset($v[0]) ? $v[0] : 0;
+                $nums = $v[0] ?? 0;
-                $color = isset($v[1]) ? $v[1] : $colorArr[(is_numeric($nums) ? $nums : strlen($nums)) % $colorNums];
+                $color = $v[1] ?? $colorArr[(is_numeric($nums) ? $nums : strlen($nums)) % $colorNums];
-                $class = isset($v[2]) ? $v[2] : 'label';
+                $class = $v[2] ?? 'label';
             } else {
                 $nums = $v;
                 $color = $colorArr[(is_numeric($nums) ? $nums : strlen($nums)) % $colorNums];
@@ -474,7 +472,7 @@ class Auth extends \fast\Auth
             ->column('name,pid');
         $pidArr = array_unique(array_filter(array_column($ruleList, 'pid')));
         foreach ($ruleList as $k => &$v) {
-            if (!in_array($v['name'], $userRule)) {
+            if (!in_array(strtolower($v['name']), $userRule)) {
                 unset($ruleList[$k]);
                 continue;
             }
@@ -485,7 +483,7 @@ class Auth extends \fast\Auth
             }
             $v['icon'] = $v['icon'] . ' fa-fw';
             $v['url'] = isset($v['url']) && $v['url'] ? $v['url'] : '/' . $module . '/' . $v['name'];
-            $v['badge'] = isset($badgeList[$v['name']]) ? $badgeList[$v['name']] : '';
+            $v['badge'] = $badgeList[$v['name']] ?? '';
             $v['title'] = __($v['title']);
             $v['url'] = preg_match("/^((?:[a-z]+:)?\/\/|data:image\/)(.*)/i", $v['url']) ? $v['url'] : url($v['url']);
             $v['menuclass'] = in_array($v['menutype'], ['dialog', 'ajax']) ? 'btn-' . $v['menutype'] : '';

application/admin/library/traits/Backend.php

@@ -460,7 +460,7 @@ trait Backend
             if ($has_admin_id) {
                 $auth = Auth::instance();
                 foreach ($insert as &$val) {
-                    if (!isset($val['admin_id']) || empty($val['admin_id'])) {
+                    if (empty($val['admin_id'])) {
                         $val['admin_id'] = $auth->isLogin() ? $auth->id : 0;
                     }
                 }

application/admin/model/AdminLog.php

@@ -41,8 +41,8 @@ class AdminLog extends Model
 
     /**
      * 记录日志
-     * @param string $title
+     * @param string $title   日志标题
-     * @param string $content
+     * @param string $content 日志内容
      */
     public static function record($title = '', $content = '')
     {
@@ -50,6 +50,9 @@ class AdminLog extends Model
         $admin_id = $auth->isLogin() ? $auth->id : 0;
         $username = $auth->isLogin() ? $auth->username : __('Unknown');
 
+        // 设置过滤函数
+        request()->filter('trim,strip_tags,htmlspecialchars');
+
         $controllername = Loader::parseName(request()->controller());
         $actionname = strtolower(request()->action());
         $path = str_replace('.', '/', $controllername) . '/' . $actionname;
@@ -60,12 +63,12 @@ class AdminLog extends Model
                 }
             }
         }
-        $content = $content ? $content : self::$content;
+        $content = $content ?: self::$content;
         if (!$content) {
-            $content = request()->param('', null, 'trim,strip_tags,htmlspecialchars');
+            $content = request()->param('') ?: file_get_contents("php://input");
             $content = self::getPureContent($content);
         }
-        $title = $title ? $title : self::$title;
+        $title = $title ?: self::$title;
         if (!$title) {
             $title = [];
             $breadcrumb = Auth::instance()->getBreadcrumb($path);
@@ -77,18 +80,18 @@ class AdminLog extends Model
         self::create([
             'title'     => $title,
             'content'   => !is_scalar($content) ? json_encode($content, JSON_UNESCAPED_UNICODE) : $content,
-            'url'       => substr(request()->url(), 0, 1500),
+            'url'       => substr(xss_clean(strip_tags(request()->url())), 0, 1500),
             'admin_id'  => $admin_id,
             'username'  => $username,
             'useragent' => substr(request()->server('HTTP_USER_AGENT'), 0, 255),
-            'ip'        => request()->ip()
+            'ip'        => xss_clean(strip_tags(request()->ip()))
         ]);
     }
 
     /**
      * 获取已屏蔽关键信息的数据
      * @param $content
-     * @return false|string
+     * @return array
      */
     protected static function getPureContent($content)
     {

application/admin/model/UserGroup.php

@@ -28,7 +28,7 @@ class UserGroup extends Model
     {
         $value = $value ? $value : $data['status'];
         $list = $this->getStatusList();
-        return isset($list[$value]) ? $list[$value] : '';
+        return $list[$value] ?? '';
     }
 
 }

application/admin/model/UserRule.php

@@ -23,8 +23,10 @@ class UserRule extends Model
     protected static function init()
     {
         self::afterInsert(function ($row) {
-            $pk = $row->getPk();
+            if (!$row['weigh']) {
-            $row->getQuery()->where($pk, $row[$pk])->update(['weigh' => $row[$pk]]);
+                $pk = $row->getPk();
+                $row->getQuery()->where($pk, $row[$pk])->update(['weigh' => $row[$pk]]);
+            }
         });
     }
 
@@ -42,7 +44,7 @@ class UserRule extends Model
     {
         $value = $value ? $value : $data['status'];
         $list = $this->getStatusList();
-        return isset($list[$value]) ? $list[$value] : '';
+        return $list[$value] ?? '';
     }
 
     public static function getTreeList($selected = [])

application/admin/view/addon/config.html

@@ -105,6 +105,12 @@
                                             <span class="msg-box n-right" for="c-{$item.name}"></span>
                                         </div>
                                         {/case}
+                                        {case switch}
+                                        <input id="c-{$item.name}" name="row[{$item.name}]" type="hidden" value="{:$item.value?1:0}">
+                                        <a href="javascript:;" data-toggle="switcher" class="btn-switcher" data-input-id="c-{$item.name}" data-yes="1" data-no="0">
+                                            <i class="fa fa-toggle-on text-success {if !$item.value}fa-flip-horizontal text-gray{/if} fa-2x"></i>
+                                        </a>
+                                        {/case}
                                         {case bool}
                                         <label for="row[{$item.name}]-yes"><input id="row[{$item.name}]-yes" name="row[{$item.name}]" type="radio" value="1" {$item.value?'checked':''} data-tip="{$item.tip}" /> {:__('Yes')}</label>
                                         <label for="row[{$item.name}]-no"><input id="row[{$item.name}]-no" name="row[{$item.name}]" type="radio" value="0" {$item.value?'':'checked'} data-tip="{$item.tip}" /> {:__('No')}</label>

application/admin/view/addon/index.html

@@ -167,6 +167,11 @@
         </div>
     </div>
 </script>
+<script id="upgradetpl" type="text/html">
+    <div class="">
+        <div class=""><%=#__("Upgrade tips", addon['title'])%></div>
+    </div>
+</script>
 <script id="conflicttpl" type="text/html">
     <div class="alert alert-dismissable alert-danger">
         <button type="button" class="close" data-dismiss="alert">×</button>

application/admin/view/auth/admin/edit.html

@@ -39,7 +39,7 @@
     <div class="form-group">
         <label for="loginfailure" class="control-label col-xs-12 col-sm-2">{:__('Loginfailure')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="number" class="form-control" id="loginfailure" name="row[loginfailure]" value="{$row.loginfailure}" data-rule="required" />
+            <input type="number" class="form-control" id="loginfailure" name="row[loginfailure]" value="{$row.loginfailure|htmlentities}" data-rule="required" />
         </div>
     </div>
     <div class="form-group">

application/admin/view/auth/rule/edit.html

@@ -34,8 +34,8 @@
         <label for="icon" class="control-label col-xs-12 col-sm-2">{:__('Icon')}:</label>
         <div class="col-xs-12 col-sm-8">
             <div class="input-group input-groupp-md">
-                <span class="input-group-addon"><i class="{$row.icon}" id="icon-style"></i></span>
+                <span class="input-group-addon"><i class="{$row.icon|htmlentities}" id="icon-style"></i></span>
-                <input type="text" class="form-control" id="icon" name="row[icon]" value="{$row.icon}" />
+                <input type="text" class="form-control" id="icon" name="row[icon]" value="{$row.icon|htmlentities}" />
                 <a href="javascript:;" class="btn-search-icon input-group-addon">{:__('Search icon')}</a>
             </div>
         </div>
@@ -67,7 +67,7 @@
     <div class="form-group">
         <label for="weigh" class="control-label col-xs-12 col-sm-2">{:__('Weigh')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="text" class="form-control" id="weigh" name="row[weigh]" value="{$row.weigh}" data-rule="required" />
+            <input type="text" class="form-control" id="weigh" name="row[weigh]" value="{$row.weigh|htmlentities}" data-rule="required" />
         </div>
     </div>
     <div class="form-group">

application/admin/view/category/edit.html

@@ -52,7 +52,7 @@
         <label for="c-image" class="control-label col-xs-12 col-sm-2">{:__('Image')}:</label>
         <div class="col-xs-12 col-sm-8">
             <div class="input-group">
-                <input id="c-image" class="form-control" size="35" name="row[image]" type="text" value="{$row.image}">
+                <input id="c-image" class="form-control" size="35" name="row[image]" type="text" value="{$row.image|htmlentities}">
                 <div class="input-group-addon no-border no-padding">
                     <span><button type="button" id="faupload-image" class="btn btn-danger faupload" data-input-id="c-image" data-mimetype="image/gif,image/jpeg,image/png,image/jpg,image/bmp" data-multiple="false" data-preview-id="p-image"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
                     <span><button type="button" id="fachoose-image" class="btn btn-primary fachoose" data-input-id="c-image" data-mimetype="image/*" data-multiple="false"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
@@ -77,7 +77,7 @@
     <div class="form-group">
         <label for="c-weigh" class="control-label col-xs-12 col-sm-2">{:__('Weigh')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input id="c-weigh" class="form-control" name="row[weigh]" type="number" value="{$row.weigh}">
+            <input id="c-weigh" class="form-control" name="row[weigh]" type="number" value="{$row.weigh|htmlentities}">
         </div>
     </div>
     <div class="form-group">

application/admin/view/general/attachment/edit.html

@@ -22,13 +22,13 @@
     <div class="form-group">
         <label for="c-imagewidth" class="control-label col-xs-12 col-sm-2">{:__('Imagewidth')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="text" name="row[imagewidth]" value="{$row.imagewidth}"  id="c-imagewidth" class="form-control" required />
+            <input type="text" name="row[imagewidth]" value="{$row.imagewidth|htmlentities}"  id="c-imagewidth" class="form-control" required />
         </div>
     </div>
     <div class="form-group">
         <label for="c-imageheight" class="control-label col-xs-12 col-sm-2">{:__('Imageheight')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="text" name="row[imageheight]" value="{$row.imageheight}"  id="c-imageheight" class="form-control" required />
+            <input type="text" name="row[imageheight]" value="{$row.imageheight|htmlentities}"  id="c-imageheight" class="form-control" required />
         </div>
     </div>
     <div class="form-group">
@@ -40,7 +40,7 @@
     <div class="form-group">
         <label for="c-imageframes" class="control-label col-xs-12 col-sm-2">{:__('Imageframes')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="number" name="row[imageframes]" value="{$row.imageframes}"  id="c-imageframes" class="form-control" />
+            <input type="number" name="row[imageframes]" value="{$row.imageframes|htmlentities}"  id="c-imageframes" class="form-control" />
         </div>
     </div>
     <div class="form-group">
@@ -52,7 +52,7 @@
     <div class="form-group">
         <label for="c-filesize" class="control-label col-xs-12 col-sm-2">{:__('Filesize')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="number" name="row[filesize]" value="{$row.filesize}"  id="c-filesize" class="form-control" />
+            <input type="number" name="row[filesize]" value="{$row.filesize|htmlentities}"  id="c-filesize" class="form-control" />
         </div>
     </div>
     <div class="form-group">
@@ -76,7 +76,7 @@
     <div class="form-group">
         <label for="c-storage" class="control-label col-xs-12 col-sm-2">{:__('Storage')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input type="text" name="row[storage]" value="{$row.storage}"  id="c-storage" class="form-control" />
+            <input type="text" name="row[storage]" value="{$row.storage|htmlentities}"  id="c-storage" class="form-control" />
         </div>
     </div>
     <div class="form-group hide layer-footer">

application/admin/view/index/index.html

@@ -28,12 +28,12 @@
             <div class="content-wrapper tab-content tab-addtabs">
                 {if $fixedmenu}
                 <div role="tabpanel" class="tab-pane {:$referermenu?'':'active'}" id="con_{$fixedmenu.id}">
-                    <iframe src="{$fixedmenu.url}?addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
+                    <iframe src="{$fixedmenu.url}{:stripos($fixedmenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
                 </div>
                 {/if}
                 {if $referermenu}
                 <div role="tabpanel" class="tab-pane active" id="con_{$referermenu.id}">
-                    <iframe src="{$referermenu.url}?addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
+                    <iframe src="{$referermenu.url}{:stripos($referermenu.url, '?') !== false ? '&' : '?'}addtabs=1" width="100%" height="100%" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling-x="no" scrolling-y="auto" allowtransparency="yes"></iframe>
                 </div>
                 {/if}
             </div>

application/admin/view/user/group/edit.html

@@ -1,6 +1,6 @@
 <form id="edit-form" class="form-horizontal" role="form" data-toggle="validator" method="POST" action="">
     {:token()}
-    <input type="hidden" name="row[rules]" value="{$row.rules}" />
+    <input type="hidden" name="row[rules]" value="{$row.rules|htmlentities}" />
     <div class="form-group">
         <label for="c-name" class="control-label col-xs-12 col-sm-2">{:__('Name')}:</label>
         <div class="col-xs-12 col-sm-8">

application/admin/view/user/rule/edit.html

@@ -33,7 +33,7 @@
     <div class="form-group">
         <label for="c-weigh" class="control-label col-xs-12 col-sm-2">{:__('Weigh')}:</label>
         <div class="col-xs-12 col-sm-8">
-            <input id="c-weigh" class="form-control" name="row[weigh]" type="number" value="{$row.weigh}">
+            <input id="c-weigh" class="form-control" name="row[weigh]" type="number" value="{$row.weigh|htmlentities}">
         </div>
     </div>
     <div class="form-group">

application/admin/view/user/user/edit.html

@@ -1,6 +1,6 @@
 <form id="edit-form" class="form-horizontal" role="form" data-toggle="validator" method="POST" action="">
     {:token()}
-    <input type="hidden" name="row[id]" value="{$row.id}">
+    <input type="hidden" name="row[id]" value="{$row.id|htmlentities}">
     <div class="form-group">
         <label class="control-label col-xs-12 col-sm-2">{:__('Group')}:</label>
         <div class="col-xs-12 col-sm-4">
@@ -41,7 +41,7 @@
         <label for="c-avatar" class="control-label col-xs-12 col-sm-2">{:__('Avatar')}:</label>
         <div class="col-xs-12 col-sm-8">
             <div class="input-group">
-                <input id="c-avatar" data-rule="" class="form-control" size="50" name="row[avatar]" type="text" value="{$row.avatar}">
+                <input id="c-avatar" data-rule="" class="form-control" size="50" name="row[avatar]" type="text" value="{$row.avatar|htmlentities}">
                 <div class="input-group-addon no-border no-padding">
                     <span><button type="button" id="faupload-avatar" class="btn btn-danger faupload" data-input-id="c-avatar" data-mimetype="image/gif,image/jpeg,image/png,image/jpg,image/bmp" data-multiple="false" data-preview-id="p-avatar"><i class="fa fa-upload"></i> {:__('Upload')}</button></span>
                     <span><button type="button" id="fachoose-avatar" class="btn btn-primary fachoose" data-input-id="c-avatar" data-mimetype="image/*" data-multiple="false"><i class="fa fa-list"></i> {:__('Choose')}</button></span>
@@ -54,7 +54,7 @@
     <div class="form-group">
         <label for="c-level" class="control-label col-xs-12 col-sm-2">{:__('Level')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-level" data-rule="required" class="form-control" name="row[level]" type="number" value="{$row.level}">
+            <input id="c-level" data-rule="required" class="form-control" name="row[level]" type="number" value="{$row.level|htmlentities}">
         </div>
     </div>
     <div class="form-group">
@@ -66,7 +66,7 @@
     <div class="form-group">
         <label for="c-birthday" class="control-label col-xs-12 col-sm-2">{:__('Birthday')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-birthday" data-rule="" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-use-current="true" name="row[birthday]" type="text" value="{$row.birthday}">
+            <input id="c-birthday" data-rule="" class="form-control datetimepicker" data-date-format="YYYY-MM-DD" data-use-current="true" name="row[birthday]" type="text" value="{$row.birthday|htmlentities}">
         </div>
     </div>
     <div class="form-group">
@@ -78,25 +78,25 @@
     <div class="form-group">
         <label for="c-money" class="control-label col-xs-12 col-sm-2">{:__('Money')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-money" data-rule="required" class="form-control" name="row[money]" type="number" value="{$row.money}">
+            <input id="c-money" data-rule="required" class="form-control" name="row[money]" type="number" value="{$row.money|htmlentities}">
         </div>
     </div>
     <div class="form-group">
         <label for="c-score" class="control-label col-xs-12 col-sm-2">{:__('Score')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-score" data-rule="required" class="form-control" name="row[score]" type="number" value="{$row.score}">
+            <input id="c-score" data-rule="required" class="form-control" name="row[score]" type="number" value="{$row.score|htmlentities}">
         </div>
     </div>
     <div class="form-group">
         <label for="c-successions" class="control-label col-xs-12 col-sm-2">{:__('Successions')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-successions" data-rule="required" class="form-control" name="row[successions]" type="number" value="{$row.successions}">
+            <input id="c-successions" data-rule="required" class="form-control" name="row[successions]" type="number" value="{$row.successions|htmlentities}">
         </div>
     </div>
     <div class="form-group">
         <label for="c-maxsuccessions" class="control-label col-xs-12 col-sm-2">{:__('Maxsuccessions')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-maxsuccessions" data-rule="required" class="form-control" name="row[maxsuccessions]" type="number" value="{$row.maxsuccessions}">
+            <input id="c-maxsuccessions" data-rule="required" class="form-control" name="row[maxsuccessions]" type="number" value="{$row.maxsuccessions|htmlentities}">
         </div>
     </div>
     <div class="form-group">
@@ -114,19 +114,19 @@
     <div class="form-group">
         <label for="c-loginip" class="control-label col-xs-12 col-sm-2">{:__('Loginip')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-loginip" data-rule="required" class="form-control" name="row[loginip]" type="text" value="{$row.loginip}">
+            <input id="c-loginip" data-rule="required" class="form-control" name="row[loginip]" type="text" value="{$row.loginip|htmlentities}">
         </div>
     </div>
     <div class="form-group">
         <label for="c-loginfailure" class="control-label col-xs-12 col-sm-2">{:__('Loginfailure')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-loginfailure" data-rule="required" class="form-control" name="row[loginfailure]" type="number" value="{$row.loginfailure}">
+            <input id="c-loginfailure" data-rule="required" class="form-control" name="row[loginfailure]" type="number" value="{$row.loginfailure|htmlentities}">
         </div>
     </div>
     <div class="form-group">
         <label for="c-joinip" class="control-label col-xs-12 col-sm-2">{:__('Joinip')}:</label>
         <div class="col-xs-12 col-sm-4">
-            <input id="c-joinip" data-rule="required" class="form-control" name="row[joinip]" type="text" value="{$row.joinip}">
+            <input id="c-joinip" data-rule="required" class="form-control" name="row[joinip]" type="text" value="{$row.joinip|htmlentities}">
         </div>
     </div>
     <div class="form-group">

application/api/controller/Common.php

@@ -38,9 +38,9 @@ class Common extends Api
     /**
      * 加载初始化
      *
-     * @param string $version 版本号
+     * @ApiParams (name="version", type="string", required=true, description="版本号")
-     * @param string $lng 经度
+     * @ApiParams (name="lng", type="string", required=true, description="经度")
-     * @param string $lat 纬度
+     * @ApiParams (name="lat", type="string", required=true, description="纬度")
      */
     public function init()
     {
@@ -80,7 +80,7 @@ class Common extends Api
     /**
      * 上传文件
      * @ApiMethod (POST)
-     * @param File $file 文件流
+     * @ApiParams (name="file", type="File", required=true, description="文件流")
      */
     public function upload()
     {
@@ -137,6 +137,8 @@ class Common extends Api
                 $attachment = $upload->upload();
             } catch (UploadException $e) {
                 $this->error($e->getMessage());
+            } catch (\Exception $e) {
+                $this->error($e->getMessage());
             }
 
             $this->success(__('Uploaded successful'), ['url' => $attachment->url, 'fullurl' => cdnurl($attachment->url, true)]);
@@ -146,7 +148,7 @@ class Common extends Api
 
     /**
      * 验证码
-     * @param $id
+     * @ApiParams (name="id", type="string", required=true, description="要生成验证码的标识")
      * @return \think\Response
      */
     public function captcha($id = "")

application/api/controller/Ems.php

@@ -24,8 +24,8 @@ class Ems extends Api
      * 发送验证码
      *
      * @ApiMethod (POST)
-     * @param string $email 邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
-     * @param string $event 事件名称
+     * @ApiParams (name="event", type="string", required=true, description="事件名称")
      */
     public function send()
     {
@@ -33,10 +33,35 @@ class Ems extends Api
         $event = $this->request->post("event");
         $event = $event ? $event : 'register';
 
+        if (!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            $this->error(__('邮箱格式错误'));
+        }
+        if (!preg_match("/^[a-z0-9_\-]{3,30}\$/i", $event)) {
+            $this->error(__('事件名称错误'));
+        }
+
+        //发送前验证码
+        if (config('fastadmin.user_api_captcha')) {
+
+            if (!preg_match("/^[a-z0-9]{4,6}\$/i", $captcha)) {
+                $this->error(__('验证码格式错误'));
+            }
+
+            if (!\think\Validate::is($captcha, 'captcha')) {
+                $this->error("验证码不正确");
+            }
+        }
+
         $last = Emslib::get($email, $event);
         if ($last && time() - $last['createtime'] < 60) {
             $this->error(__('发送频繁'));
         }
+
+        $ipSendTotal = \app\common\model\Ems::where(['ip' => $this->request->ip()])->whereTime('createtime', '-1 hours')->count();
+        if ($ipSendTotal >= 5) {
+            $this->error(__('发送频繁'));
+        }
+
         if ($event) {
             $userinfo = User::getByEmail($email);
             if ($event == 'register' && $userinfo) {
@@ -62,9 +87,9 @@ class Ems extends Api
      * 检测验证码
      *
      * @ApiMethod (POST)
-     * @param string $email   邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
-     * @param string $event   事件名称
+     * @ApiParams (name="event", type="string", required=true, description="事件名称")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
      */
     public function check()
     {
@@ -73,6 +98,17 @@ class Ems extends Api
         $event = $event ? $event : 'register';
         $captcha = $this->request->post("captcha");
 
+        if (!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            $this->error(__('邮箱格式错误'));
+        }
+        if (!preg_match("/^[a-z0-9_\-]{3,30}\$/i", $event)) {
+            $this->error(__('事件名称错误'));
+        }
+
+        if (!preg_match("/^[a-z0-9]{4,6}\$/i", $captcha)) {
+            $this->error(__('验证码格式错误'));
+        }
+
         if ($event) {
             $userinfo = User::getByEmail($email);
             if ($event == 'register' && $userinfo) {

application/api/controller/Sms.php

@@ -19,8 +19,8 @@ class Sms extends Api
      * 发送验证码
      *
      * @ApiMethod (POST)
-     * @param string $mobile 手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $event 事件名称
+     * @ApiParams (name="event", type="string", required=true, description="事件名称")
      */
     public function send()
     {
@@ -67,9 +67,9 @@ class Sms extends Api
      * 检测验证码
      *
      * @ApiMethod (POST)
-     * @param string $mobile 手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $event 事件名称
+     * @ApiParams (name="event", type="string", required=true, description="事件名称")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
      */
     public function check()
     {

application/api/controller/User.php

@@ -39,8 +39,8 @@ class User extends Api
      * 会员登录
      *
      * @ApiMethod (POST)
-     * @param string $account  账号
+     * @ApiParams (name="account", type="string", required=true, description="账号")
-     * @param string $password 密码
+     * @ApiParams (name="password", type="string", required=true, description="密码")
      */
     public function login()
     {
@@ -62,8 +62,8 @@ class User extends Api
      * 手机验证码登录
      *
      * @ApiMethod (POST)
-     * @param string $mobile  手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
      */
     public function mobilelogin()
     {
@@ -101,11 +101,11 @@ class User extends Api
      * 注册会员
      *
      * @ApiMethod (POST)
-     * @param string $username 用户名
+     * @ApiParams (name="username", type="string", required=true, description="用户名")
-     * @param string $password 密码
+     * @ApiParams (name="password", type="string", required=true, description="密码")
-     * @param string $email    邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
-     * @param string $mobile   手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $code     验证码
+     * @ApiParams (name="code", type="string", required=true, description="验证码")
      */
     public function register()
     {
@@ -153,10 +153,10 @@ class User extends Api
      * 修改会员个人信息
      *
      * @ApiMethod (POST)
-     * @param string $avatar   头像地址
+     * @ApiParams (name="avatar", type="string", required=true, description="头像地址")
-     * @param string $username 用户名
+     * @ApiParams (name="username", type="string", required=true, description="用户名")
-     * @param string $nickname 昵称
+     * @ApiParams (name="nickname", type="string", required=true, description="昵称")
-     * @param string $bio      个人简介
+     * @ApiParams (name="bio", type="string", required=true, description="个人简介")
      */
     public function profile()
     {
@@ -189,8 +189,8 @@ class User extends Api
      * 修改邮箱
      *
      * @ApiMethod (POST)
-     * @param string $email   邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
      */
     public function changeemail()
     {
@@ -224,8 +224,8 @@ class User extends Api
      * 修改手机号
      *
      * @ApiMethod (POST)
-     * @param string $mobile  手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
      */
     public function changemobile()
     {
@@ -259,8 +259,8 @@ class User extends Api
      * 第三方登录
      *
      * @ApiMethod (POST)
-     * @param string $platform 平台名称
+     * @ApiParams (name="platform", type="string", required=true, description="平台名称")
-     * @param string $code     Code码
+     * @ApiParams (name="code", type="string", required=true, description="Code码")
      */
     public function third()
     {
@@ -291,9 +291,9 @@ class User extends Api
      * 重置密码
      *
      * @ApiMethod (POST)
-     * @param string $mobile      手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $newpassword 新密码
+     * @ApiParams (name="newpassword", type="string", required=true, description="新密码")
-     * @param string $captcha     验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
      */
     public function resetpwd()
     {

application/api/controller/Validate.php

@@ -23,8 +23,8 @@ class Validate extends Api
      * 检测邮箱
      *
      * @ApiMethod (POST)
-     * @param string $email 邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
-     * @param string $id    排除会员ID
+     * @ApiParams (name="id", type="string", required=true, description="排除会员ID")
      */
     public function check_email_available()
     {
@@ -41,8 +41,8 @@ class Validate extends Api
      * 检测用户名
      *
      * @ApiMethod (POST)
-     * @param string $username 用户名
+     * @ApiParams (name="username", type="string", required=true, description="用户名")
-     * @param string $id       排除会员ID
+     * @ApiParams (name="id", type="string", required=true, description="排除会员ID")
      */
     public function check_username_available()
     {
@@ -59,8 +59,8 @@ class Validate extends Api
      * 检测昵称
      *
      * @ApiMethod (POST)
-     * @param string $nickname 昵称
+     * @ApiParams (name="nickname", type="string", required=true, description="昵称")
-     * @param string $id       排除会员ID
+     * @ApiParams (name="id", type="string", required=true, description="排除会员ID")
      */
     public function check_nickname_available()
     {
@@ -77,8 +77,8 @@ class Validate extends Api
      * 检测手机
      *
      * @ApiMethod (POST)
-     * @param string $mobile 手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $id     排除会员ID
+     * @ApiParams (name="id", type="string", required=true, description="排除会员ID")
      */
     public function check_mobile_available()
     {
@@ -95,7 +95,7 @@ class Validate extends Api
      * 检测手机
      *
      * @ApiMethod (POST)
-     * @param string $mobile 手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
      */
     public function check_mobile_exist()
     {
@@ -111,7 +111,7 @@ class Validate extends Api
      * 检测邮箱
      *
      * @ApiMethod (POST)
-     * @param string $mobile 邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
      */
     public function check_email_exist()
     {
@@ -127,9 +127,9 @@ class Validate extends Api
      * 检测手机验证码
      *
      * @ApiMethod (POST)
-     * @param string $mobile  手机号
+     * @ApiParams (name="mobile", type="string", required=true, description="手机号")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
-     * @param string $event   事件
+     * @ApiParams (name="event", type="string", required=true, description="事件")
      */
     public function check_sms_correct()
     {
@@ -146,9 +146,9 @@ class Validate extends Api
      * 检测邮箱验证码
      *
      * @ApiMethod (POST)
-     * @param string $email   邮箱
+     * @ApiParams (name="email", type="string", required=true, description="邮箱")
-     * @param string $captcha 验证码
+     * @ApiParams (name="captcha", type="string", required=true, description="验证码")
-     * @param string $event   事件
+     * @ApiParams (name="event", type="string", required=true, description="事件")
      */
     public function check_ems_correct()
     {

application/api/lang/zh-cn.php

@@ -86,7 +86,7 @@ return [
     'You can only upload a maximum of %s files'      => '你最多允许上传 %s 个文件',
     'You can\'t upload files of this type'           => '不允许上传的文件类型',
     'Server responded with %s code'                  => '服务端响应(Code:%s)',
-    'File is too big (%sMiB), Max filesize: %sMiB'   => '当前上传(%sM)，最大允许上传文件大小:%sM',
+    'File is too big (%sMiB), Max filesize: %sMiB.'  => '当前上传(%sM)，最大允许上传文件大小:%sM',
     'Redirect now'                                   => '立即跳转',
     'Operation completed'                            => '操作成功!',
     'Operation failed'                               => '操作失败!',

application/common.php

@@ -10,7 +10,7 @@ if (!function_exists('__')) {
     /**
      * 获取语言变量值
      * @param string $name 语言变量名
-     * @param array  $vars 动态变量值
+     * @param string | array  $vars 动态变量值
      * @param string $lang 语言
      * @return mixed
      */
@@ -40,7 +40,7 @@ if (!function_exists('format_bytes')) {
     function format_bytes($size, $delimiter = '', $precision = 2)
     {
         $units = array('B', 'KB', 'MB', 'GB', 'TB', 'PB');
-        for ($i = 0; $size >= 1024 && $i < 6; $i++) {
+        for ($i = 0; $size >= 1024 && $i < 5; $i++) {
             $size /= 1024;
         }
         return round($size, $precision) . $delimiter . $units[$i];
@@ -248,9 +248,10 @@ if (!function_exists('addtion')) {
             if ($v['model']) {
                 $model = new $v['model'];
             } else {
-                $model = $v['name'] ? \think\Db::name($v['name']) : \think\Db::table($v['table']);
+                // 优先判断使用table的配置
+                $model = $v['table'] ? \think\Db::table($v['table']) : \think\Db::name($v['name']);
             }
-            $primary = $v['primary'] ? $v['primary'] : $model->getPk();
+            $primary = $v['primary'] ?: $model->getPk();
             $result[$v['field']] = isset($ids[$v['field']]) ? $model->where($primary, 'in', $ids[$v['field']])->column($v['column'], $primary) : [];
         }
 
@@ -279,60 +280,6 @@ if (!function_exists('var_export_short')) {
     function var_export_short($data, $return = true)
     {
         return var_export($data, $return);
-        $replaced = [];
-        $count = 0;
-
-        //判断是否是对象
-        if (is_resource($data) || is_object($data)) {
-            return var_export($data, $return);
-        }
-
-        //判断是否有特殊的键名
-        $specialKey = false;
-        array_walk_recursive($data, function (&$value, &$key) use (&$specialKey) {
-            if (is_string($key) && (stripos($key, "\n") !== false || stripos($key, "array (") !== false)) {
-                $specialKey = true;
-            }
-        });
-        if ($specialKey) {
-            return var_export($data, $return);
-        }
-        array_walk_recursive($data, function (&$value, &$key) use (&$replaced, &$count, &$stringcheck) {
-            if (is_object($value) || is_resource($value)) {
-                $replaced[$count] = var_export($value, true);
-                $value = "##<{$count}>##";
-            } else {
-                if (is_string($value) && (stripos($value, "\n") !== false || stripos($value, "array (") !== false)) {
-                    $index = array_search($value, $replaced);
-                    if ($index === false) {
-                        $replaced[$count] = var_export($value, true);
-                        $value = "##<{$count}>##";
-                    } else {
-                        $value = "##<{$index}>##";
-                    }
-                }
-            }
-            $count++;
-        });
-
-        $dump = var_export($data, true);
-
-        $dump = preg_replace('#(?:\A|\n)([ ]*)array \(#i', '[', $dump); // Starts
-        $dump = preg_replace('#\n([ ]*)\),#', "\n$1],", $dump); // Ends
-        $dump = preg_replace('#=> \[\n\s+\],\n#', "=> [],\n", $dump); // Empties
-        $dump = preg_replace('#\)$#', "]", $dump); //End
-
-        if ($replaced) {
-            $dump = preg_replace_callback("/'##<(\d+)>##'/", function ($matches) use ($replaced) {
-                return $replaced[$matches[1]] ?? "''";
-            }, $dump);
-        }
-
-        if ($return === true) {
-            return $dump;
-        } else {
-            echo $dump;
-        }
     }
 }
 
@@ -520,7 +467,7 @@ if (!function_exists('check_url_allowed')) {
         }
 
         //如果是站外链接则需要判断HOST是否允许
-        if (preg_match("/((http[s]?:\/\/)+(?>[a-z\-0-9]{2,}\.){1,}[a-z]{2,8})(?:\s|\/)/i", $url)) {
+        if (preg_match("/((http[s]?:\/\/)+((?>[a-z\-0-9]{2,}\.)+[a-z]{2,8}|((?>([0-9]{1,3}\.)){3}[0-9]{1,3}))(:[0-9]{1,5})?)(?:\s|\/)/i", $url)) {
             $chkHost = parse_url(strtolower($url), PHP_URL_HOST);
             if ($chkHost && in_array($chkHost, $allowedHostArr)) {
                 return true;

application/common/behavior/Common.php

@@ -63,7 +63,7 @@ class Common
         }
         // 切换多语言
         if (Config::get('lang_switch_on')) {
-            $lang = $request->get('lang');
+            $lang = $request->get('lang', '');
             if (preg_match("/^([a-zA-Z\-_]{2,10})\$/i", $lang)) {
                 \think\Cookie::set('think_var', $lang);
             }

application/common/controller/Api.php

@@ -204,8 +204,8 @@ class Api
             'time' => Request::instance()->server('REQUEST_TIME'),
             'data' => $data,
         ];
-        // 如果未设置类型则自动判断
+        // 如果未设置类型则使用默认类型判断
-        $type = $type ? $type : ($this->request->param(config('var_jsonp_handler')) ? 'jsonp' : $this->responseType);
+        $type = $type ? : $this->responseType;
 
         if (isset($header['statuscode'])) {
             $code = $header['statuscode'];

application/common/controller/Backend.php

@@ -268,12 +268,13 @@ class Backend extends Controller
         $op = $this->request->get("op", '', 'trim');
         $sort = $this->request->get("sort", !empty($this->model) && $this->model->getPk() ? $this->model->getPk() : 'id');
         $order = $this->request->get("order", "DESC");
-        $offset = $this->request->get("offset/d", 0);
+        $offset = max(0, $this->request->get("offset/d", 0));
-        $limit = $this->request->get("limit/d", 999999);
+        $limit = max(0, $this->request->get("limit/d", 0));
+        $limit = $limit ?: 999999;
         //新增自动计算页码
         $page = $limit ? intval($offset / $limit) + 1 : 1;
         if ($this->request->has("page")) {
-            $page = $this->request->get("page/d", 1);
+            $page = max(0, $this->request->get("page/d", 1));
         }
         $this->request->get([config('paginate.var_page') => $page]);
         $filter = (array)json_decode($filter, true);

application/common/library/Auth.php

@@ -221,7 +221,13 @@ class Auth
             $this->setError('Account is locked');
             return false;
         }
+
+        if ($user->loginfailure >= 10 && time() - $user->loginfailuretime < 86400) {
+            $this->setError('Please try again after 1 day');
+        }
+
         if ($user->password != $this->getEncryptPassword($password, $user->salt)) {
+            $user->save(['loginfailure' => $user->loginfailure + 1, 'loginfailuretime' => time()]);
             $this->setError('Password is incorrect');
             return false;
         }

application/common/library/Ems.php

@@ -28,7 +28,7 @@ class Ems
      *
      * @param int    $email 邮箱
      * @param string $event 事件
-     * @return  Ems
+     * @return  Ems|null
      */
     public static function get($email, $event = 'default')
     {
@@ -36,7 +36,7 @@ class Ems
             ->order('id', 'DESC')
             ->find();
         Hook::listen('ems_get', $ems, null, true);
-        return $ems ? $ems : null;
+        return $ems ?: null;
     }
 
     /**

application/common/library/Sms.php

@@ -36,7 +36,7 @@ class Sms
             ->order('id', 'DESC')
             ->find();
         Hook::listen('sms_get', $sms, null, true);
-        return $sms ? $sms : null;
+        return $sms ?: null;
     }
 
     /**

application/common/library/Token.php

@@ -150,7 +150,7 @@ class Token
     /**
      * 清除Token
      * @access public
-     * @param int user_id 会员ID
+     * @param int $user_id 会员ID
      * @return boolean
      */
     public static function clear($user_id = null)

application/common/library/Upload.php

@@ -147,7 +147,7 @@ class Upload
         $size = $matches ? $matches[1] : $this->config['maxsize'];
         $type = $matches ? strtolower($matches[2]) : 'b';
         $typeDict = ['b' => 0, 'k' => 1, 'kb' => 1, 'm' => 2, 'mb' => 2, 'gb' => 3, 'g' => 3];
-        $size = $size * pow(1024, $typeDict[$type] ?? 0);
+        $size = (int)($size * pow(1024, $typeDict[$type] ?? 0));
         if ($this->fileInfo['size'] > $size) {
             throw new UploadException(__(
                 'File is too big (%sMiB), Max filesize: %sMiB.',
@@ -305,7 +305,7 @@ class Upload
 
             $attachment = $this->upload();
         } catch (\Exception $e) {
-            @unlink($destFile);
+            @unlink($uploadPath);
             throw new UploadException($e->getMessage());
         }
         return $attachment;

application/common/library/token/Driver.php

@@ -76,6 +76,7 @@ abstract class Driver
     protected function getEncryptedToken($token)
     {
         $config = \think\Config::get('token');
+        $token = $token ?? ''; // 为兼容 php8
         return hash_hmac($config['hashalgo'], $token, $config['key']);
     }
 

application/common/library/token/driver/Redis.php

@@ -60,6 +60,7 @@ class Redis extends Driver
     protected function getEncryptedToken($token)
     {
         $config = \think\Config::get('token');
+        $token = $token ?? ''; // 为兼容 php8
         return $this->options['tokenprefix'] . hash_hmac($config['hashalgo'], $token, $config['key']);
     }
 

application/common/model/Category.php

@@ -24,7 +24,9 @@ class Category extends Model
     protected static function init()
     {
         self::afterInsert(function ($row) {
-            $row->save(['weigh' => $row['id']]);
+            if (!$row['weigh']) {
+                $row->save(['weigh' => $row['id']]);
+            }
         });
     }
 

application/common/view/tpl/think_exception.tpl

@@ -19,7 +19,7 @@ if (isset($_GET['lang'])) {
     $langSet = strtolower($_COOKIE['think_var']);
 } elseif (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
 preg_match('/^([a-z\d\-]+)/i', $_SERVER['HTTP_ACCEPT_LANGUAGE'], $matches);
-    $langSet     = strtolower($matches[1]);
+    $langSet     = strtolower($matches[1] ?? '');
 }
 $langSet = $langSet && in_array($langSet, ['zh-cn', 'en']) ? $langSet : 'zh-cn';
 $langSet == 'en' && $lang = array_combine(array_keys($lang), array_keys($lang));

application/config.php

@@ -302,7 +302,7 @@ return [
         //允许跨域的域名,多个以,分隔
         'cors_request_domain'   => 'localhost,127.0.0.1',
         //版本号
-        'version'               => '1.4.0.20230711',
+        'version'               => '1.5.2.20240906',
         //API接口地址
         'api_url'               => 'https://api.fastadmin.net',
     ],

application/extra/site.php

@@ -33,8 +33,8 @@ return [
     'mail_type' => '1',
     'mail_smtp_host' => 'smtp.qq.com',
     'mail_smtp_port' => '465',
-    'mail_smtp_user' => '10000',
+    'mail_smtp_user' => '',
-    'mail_smtp_pass' => 'password',
+    'mail_smtp_pass' => '',
     'mail_verify_type' => '2',
-    'mail_from' => '10000@qq.com',
+    'mail_from' => '',
 ];

application/index/controller/Ajax.php

@@ -4,6 +4,7 @@ namespace app\index\controller;
 
 use app\common\controller\Frontend;
 use think\Lang;
+use think\Loader;
 use think\Response;
 
 /**
@@ -31,8 +32,20 @@ class Ajax extends Frontend
             $header['Expires'] = gmdate("D, d M Y H:i:s", time() + $offset) . " GMT";
         }
 
+        $controllername = $this->request->get('controllername');
+        $lang = $this->request->get('lang');
+        if (!$lang || !in_array($lang, config('allow_lang_list')) || !$controllername || !preg_match("/^[a-z0-9_\.]+$/i", $controllername)) {
+            return jsonp(['errmsg' => '参数错误'], 200, [], ['json_encode_param' => JSON_FORCE_OBJECT | JSON_UNESCAPED_UNICODE]);
+        }
+
         $controllername = input("controllername");
-        $this->loadlang($controllername);
+        $className = Loader::parseClass($this->request->module(), 'controller', $controllername, false);
+
+        //存在对应的类才加载
+        if (class_exists($className)) {
+            $this->loadlang($controllername);
+        }
+
         //强制输出JSON Object
         return jsonp(Lang::get(), 200, $header, ['json_encode_param' => JSON_FORCE_OBJECT | JSON_UNESCAPED_UNICODE]);
     }

bower.json

@@ -20,14 +20,14 @@
     "jquery-slimscroll": "~1.3.8",
     "jquery.cookie": "~1.4.1",
     "Sortable": "~1.10.0",
-    "nice-validator": "~1.1.1",
+    "nice-validator": "karsonzhang/fastadmin-nicevalidator#~1.1.6",
     "art-template": "~3.1.3",
     "bootstrap-daterangepicker": "~2.1.25",
     "fastadmin-citypicker": "~1.3.1",
     "fastadmin-cxselect": "~1.4.0",
     "fastadmin-dragsort": "~1.0.0",
     "fastadmin-addtabs": "~1.0.8",
-    "fastadmin-selectpage": "~1.0.6",
+    "fastadmin-selectpage": "~1.0.12",
     "fastadmin-layer": "~3.5.1",
     "bootstrap-slider": "*"
   }

composer.json

@@ -15,17 +15,16 @@
         }
     ],
     "require": {
-        "php": ">=7.2.0",
+        "php": ">=7.4.0",
         "topthink/framework": "dev-master",
-        "topthink/think-captcha": "^1.0",
+        "topthink/think-captcha": "^1.0.9",
         "topthink/think-installer": "^1.0.14",
         "topthink/think-queue": "1.1.6",
         "topthink/think-helper": "^1.0.7",
-        "karsonzhang/fastadmin-addons": "~1.3.2",
+        "karsonzhang/fastadmin-addons": "~1.4.0",
         "overtrue/pinyin": "^3.0",
-        "phpoffice/phpspreadsheet": "1.19",
+        "phpoffice/phpspreadsheet": "^1.29.1",
         "overtrue/wechat": "^4.6",
-        "nelexa/zip": "^3.3",
         "ext-json": "*",
         "ext-curl": "*",
         "ext-pdo": "*",
@@ -33,12 +32,25 @@
         "txthinking/mailer": "^2.0"
     },
     "config": {
-        "preferred-install": "dist"
+        "preferred-install": "dist",
+        "allow-plugins": {
+            "topthink/think-installer": true,
+            "easywechat-composer/easywechat-composer": true
+        }
+    },
+    "autoload": {
+        "psr-4": {
+            "addons\\": "addons/"
+        }
     },
     "repositories": [
         {
             "type": "git",
             "url": "https://gitee.com/fastadminnet/framework.git"
+        },
+        {
+            "type": "git",
+            "url": "https://gitee.com/fastadminnet/think-captcha.git"
         }
     ]
 }

extend/fast/Http.php

@@ -60,15 +60,15 @@ class Http
             } else {
                 $defaults[CURLOPT_CUSTOMREQUEST] = $method;
             }
-            $defaults[CURLOPT_POSTFIELDS] = $params;
+            $defaults[CURLOPT_POSTFIELDS] = is_array($params) && count(array_filter($params, 'is_array')) > 0 ? $query_string : $params;
         }
 
         $defaults[CURLOPT_HEADER] = false;
         $defaults[CURLOPT_USERAGENT] = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.98 Safari/537.36";
         $defaults[CURLOPT_FOLLOWLOCATION] = true;
         $defaults[CURLOPT_RETURNTRANSFER] = true;
-        $defaults[CURLOPT_CONNECTTIMEOUT] = 3;
+        $defaults[CURLOPT_CONNECTTIMEOUT] = 10;
-        $defaults[CURLOPT_TIMEOUT] = 3;
+        $defaults[CURLOPT_TIMEOUT] = 10;
 
         // disable 100-continue
         curl_setopt($ch, CURLOPT_HTTPHEADER, array('Expect:'));
@@ -133,12 +133,12 @@ class Http
         }
         $parts['query'] = isset($parts['query']) && $parts['query'] ? '?' . $parts['query'] : '';
         //发送socket请求,获得连接句柄
-        $fp = fsockopen($parts['host'], isset($parts['port']) ? $parts['port'] : 80, $errno, $errstr, 3);
+        $fp = fsockopen($parts['host'], $parts['port'] ?? 80, $errno, $errstr, 10);
         if (!$fp) {
             return false;
         }
         //设置超时时间
-        stream_set_timeout($fp, 3);
+        stream_set_timeout($fp, 10);
         $out = "{$method} {$parts['path']}{$parts['query']} HTTP/1.1\r\n";
         $out .= "Host: {$parts['host']}\r\n";
         $out .= "Content-Type: application/x-www-form-urlencoded\r\n";

public/assets/css/frontend.css

@@ -317,6 +317,10 @@ a:focus {
     height: 60px;
     line-height: 27px;
   }
+  .navbar-white .navbar-brand {
+    height: 60px;
+    line-height: 27px;
+  }
   .navbar-white .navbar-nav > li > a {
     height: 60px;
     line-height: 27px;

public/assets/js/backend/addon.js

@@ -73,12 +73,13 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
             Template.helper("Moment", Moment);
             Template.helper("addons", Config['addons']);
 
-            $("#faupload-addon").data("params", function () {
+            $("#faupload-addon").data("params", function (files, xhr) {
                 var userinfo = Controller.api.userinfo.get();
                 return {
                     uid: userinfo ? userinfo.id : '',
                     token: userinfo ? userinfo.token : '',
-                    version: Config.faversion
+                    version: Config.faversion,
+                    force: (files[0].force || false) ? 1 : 0
                 };
             });
 
@@ -114,7 +115,14 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                             align: 'left',
                             formatter: Controller.api.formatter.title
                         },
-                        {field: 'intro', title: __('Intro'), operate: 'LIKE', align: 'left', class: 'visible-lg'},
+                        {
+                            field: 'intro',
+                            title: __('Intro'),
+                            operate: 'LIKE',
+                            align: 'left',
+                            class: 'visible-lg',
+                            formatter: Controller.api.formatter.intro
+                        },
                         {
                             field: 'author',
                             title: __('Author'),
@@ -185,7 +193,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
 
             // 离线安装
             require(['upload'], function (Upload) {
-                Upload.api.upload("#faupload-addon", function (data, ret) {
+                Upload.api.upload("#faupload-addon", function (data, ret, up, file) {
                     Config['addons'][data.addon.name] = data.addon;
                     var addon = data.addon;
                     var testdata = data.addon.testdata;
@@ -213,7 +221,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                         });
                     });
                     return false;
-                }, function (data, ret) {
+                }, function (data, ret, up, file) {
                     if (ret.msg && ret.msg.match(/(login|登录)/g)) {
                         return Layer.alert(ret.msg, {
                             title: __('Warning'),
@@ -222,6 +230,14 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                                 $(".btn-userinfo").trigger("click");
                             }
                         });
+                    } else if (ret.code === -1) {
+                        Layer.confirm(__('Upgrade tips', data.title), {title: __('Warmtips')}, function (index, layero) {
+                            up.removeFile(file);
+                            file.force = true;
+                            up.uploadFile(file);
+                            Layer.close(index);
+                        });
+                        return false;
                     }
                 });
 
@@ -229,10 +245,16 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                 $(document).on("mousedown", "#faupload-addon", function (e) {
                     var userinfo = Controller.api.userinfo.get();
                     var uid = userinfo ? userinfo.id : 0;
+                    var uploadBtn = Upload.list['faupload-addon'];
 
                     if (parseInt(uid) === 0) {
+                        uploadBtn.disable();
                         $(".btn-userinfo").trigger("click");
                         return false;
+                    } else {
+                        if (uploadBtn.disabled) {
+                            uploadBtn.enable();
+                        }
                     }
                 });
             });
@@ -623,6 +645,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                     return false;
                 }
                 Template.helper("__", __);
+                tables = [];
                 Layer.confirm(Template("uninstalltpl", {addon: Config['addons'][name]}), {focusBtn: false, title: __("Warning")}, function (index, layero) {
                     uninstall(name, false, $("input[name='droptables']", layero).prop("checked"));
                 });
@@ -650,7 +673,7 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                 }
                 var version = $(this).data("version");
 
-                Layer.confirm(__('Upgrade tips', Config['addons'][name].title), function (index, layero) {
+                Layer.confirm(__('Upgrade tips', Config['addons'][name].title), {title: __('Warmtips')}, function (index, layero) {
                     upgrade(name, version);
                 });
             });
@@ -700,12 +723,15 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template', 'cookie']
                     if ($(".btn-switch.active").data("type") == "local") {
                         // return value;
                     }
-                    var title = '<a class="title" href="' + row.url + '" data-toggle="tooltip" title="' + __('View addon home page') + '" target="_blank">' + value + '</a>';
+                    var title = '<a class="title" href="' + row.url + '" data-toggle="tooltip" title="' + __('View addon home page') + '" target="_blank"><span class="' + Fast.api.escape(row.color) + '">' + value + '</span></a>';
                     if (row.screenshots && row.screenshots.length > 0) {
                         title += ' <a href="javascript:;" data-index="' + index + '" class="view-screenshots text-success" title="' + __('View addon screenshots') + '" data-toggle="tooltip"><i class="fa fa-image"></i></a>';
                     }
                     return title;
                 },
+                intro: function (value, row, index) {
+                    return row.intro + (row.extend ? "<a href='" + Fast.api.escape(row.extend[1]) + "' class='" + Fast.api.escape(row.extend[2]) + "'>" + Fast.api.escape(row.extend[0]) + "</a>" : "");
+                },
                 operate: function (value, row, index) {
                     return Template("operatetpl", {item: row, index: index});
                 },

public/assets/js/backend/auth/adminlog.js

@@ -29,7 +29,6 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefin
                         {field: 'title', title: __('Title'), operate: 'LIKE %...%', placeholder: '模糊搜索'},
                         {field: 'url', title: __('Url'), formatter: Table.api.formatter.url},
                         {field: 'ip', title: __('IP'), events: Table.api.events.ip, formatter: Table.api.formatter.search},
-                        {field: 'browser', title: __('Browser'), operate: false, formatter: Controller.api.formatter.browser},
                         {field: 'createtime', title: __('Create time'), formatter: Table.api.formatter.datetime, operate: 'RANGE', addclass: 'datetimerange', sortable: true},
                         {
                             field: 'operate', title: __('Operate'), table: table,

public/assets/js/backend/index.js

@@ -33,7 +33,7 @@ define(['jquery', 'bootstrap', 'backend', 'addtabs', 'adminlte', 'form'], functi
                 if (val != '') {
                     $("ul.sidebar-menu li a[addtabs]:not([href^='javascript:;'])").each(function () {
                         if ($("span:first", this).text().indexOf(val) > -1 || $(this).attr("py").indexOf(val) > -1 || $(this).attr("pinyin").indexOf(val) > -1) {
-                            html.push('<a data-url="' + $(this).attr("href") + '" href="javascript:;">' + $("span:first", this).text() + '</a>');
+                            html.push('<a data-url="' + ($(this).attr("url") || $(this).attr("href")) + '" href="javascript:;">' + $("span:first", this).text() + '</a>');
                             if (html.length >= 100) {
                                 return false;
                             }
@@ -333,11 +333,13 @@ define(['jquery', 'bootstrap', 'backend', 'addtabs', 'adminlte', 'form'], functi
 
             // 切换菜单栏
             $(document).on("click", ".sidebar-toggle", function () {
-                var value = $("body").hasClass("sidebar-collapse") ? 1 : 0;
+                setTimeout(function(){
-                setTimeout(function () {
+                    var value = $("body").hasClass("sidebar-collapse") ? 1 : 0;
-                    $(window).trigger("resize");
+                    setTimeout(function () {
-                }, 300);
+                        $(window).trigger("resize");
-                createCookie('sidebar_collapse', value);
+                    }, 300);
+                    createCookie('sidebar_collapse', value);
+                }, 0);
             });
 
             // 切换多级菜单

public/assets/js/bootstrap-table-commonsearch.js

@@ -43,7 +43,7 @@
 
             setTimeout(function () {
                 that.onCommonSearch();
-            }, 0);
+            }, 1);
         });
 
     };
@@ -61,7 +61,7 @@
         htmlForm.push('<div class="row">');
         for (var i in pColumns) {
             var vObjCol = pColumns[i];
-            if (!vObjCol.checkbox && vObjCol.field !== 'operate' && vObjCol.searchable && vObjCol.operate !== false) {
+            if (!vObjCol.checkbox && !vObjCol.radio && vObjCol.field && vObjCol.field !== 'operate' && vObjCol.searchable && vObjCol.operate !== false) {
                 var query = Fast.api.query(vObjCol.field);
                 var operate = Fast.api.query(vObjCol.field + "-operate");
 

public/assets/js/fast.js

@@ -118,6 +118,8 @@ define(['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, undefine
                 if (!url) {
                     url = window.location.href;
                 }
+                if (!name)
+                    return '';
                 name = name.replace(/[\[\]]/g, "\\$&");
                 var regex = new RegExp("[?&/]" + name + "([=/]([^&#/?]*)|&|#|$)"),
                     results = regex.exec(url);
@@ -133,6 +135,10 @@ define(['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, undefine
                 url = Fast.api.fixurl(url);
                 url = url + (url.indexOf("?") > -1 ? "&" : "?") + "dialog=1";
                 var area = Fast.config.openArea != undefined ? Fast.config.openArea : [$(window).width() > 800 ? '800px' : '95%', $(window).height() > 600 ? '600px' : '95%'];
+                var success = options && typeof options.success === 'function' ? options.success : $.noop;
+                if (options && typeof options.success === 'function') {
+                    delete options.success;
+                }
                 options = $.extend({
                     type: 2,
                     title: title,
@@ -186,6 +192,7 @@ define(['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, undefine
                                 height: $(window).height()
                             });
                         }
+                        success.call(this, layero, index);
                     }
                 }, options ? options : {});
                 if ($(window).width() < 480 || (/iPad|iPhone|iPod/.test(navigator.userAgent) && !window.MSStream && top.$(".tab-pane.active").length > 0)) {
@@ -271,6 +278,18 @@ define(['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, undefine
                     time: 2000
                 }, callback);
             },
+            escape: function (text) {
+                if (typeof text === 'string') {
+                    return text
+                        .replace(/&/g, '&amp;')
+                        .replace(/</g, '&lt;')
+                        .replace(/>/g, '&gt;')
+                        .replace(/"/g, '&quot;')
+                        .replace(/'/g, '&#039;')
+                        .replace(/`/g, '&#x60;');
+                }
+                return text;
+            },
             toastr: Toastr,
             layer: Layer
         },

public/assets/js/require-backend.js

@@ -130,7 +130,7 @@ require(['jquery', 'bootstrap'], function ($, undefined) {
     window.Config = Config;
     // 配置语言包的路径
     var paths = {};
-    paths['lang'] = Config.moduleurl + '/ajax/lang?callback=define&controllername=' + Config.controllername + '&lang=' + Config.language + '&v=' + Config.site.version;
+    paths['lang'] = Config.moduleurl + '/ajax/lang?callback=define&controllername=' + Config.controllername + '&lang=' + Config.language;
     // 避免目录冲突
     paths['backend/'] = 'backend/';
     require.config({paths: paths});

public/assets/js/require-form.js

@@ -91,8 +91,10 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                 $(".layer-footer [type=submit],.fixed-footer [type=submit],.normal-footer [type=submit]", form).removeClass("disabled");
                 //自定义关闭按钮事件
                 form.on("click", ".layer-close", function () {
-                    var index = parent.Layer.getFrameIndex(window.name);
+                    if (window.name) {
-                    parent.Layer.close(index);
+                        var index = parent.Layer.getFrameIndex(window.name);
+                        parent.Layer.close(index);
+                    }
                     return false;
                 });
             },
@@ -216,7 +218,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         };
                         var origincallback = function (start, end) {
                             $(this.element).val(start.format(this.locale.format) + " - " + end.format(this.locale.format));
-                            $(this.element).trigger('blur');
+                            $(this.element).trigger('change');
                         };
                         $(".datetimerange", form).each(function () {
                             var callback = typeof $(this).data('callback') == 'function' ? $(this).data('callback') : origincallback;
@@ -224,9 +226,9 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                 callback.call(picker, picker.startDate, picker.endDate);
                             });
                             $(this).on('cancel.daterangepicker', function (ev, picker) {
-                                $(this).val('').trigger('blur');
+                                $(this).val('').trigger('change');
                             });
-                            $(this).daterangepicker($.extend(true, options, $(this).data() || {}, $(this).data("daterangepicker-options") || {}));
+                            $(this).daterangepicker($.extend(true, {}, options, $(this).data() || {}, $(this).data("daterangepicker-options") || {}));
                         });
                     });
                 }
@@ -262,7 +264,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         var url = $(this).data("url") ? $(this).data("url") : (typeof Backend !== 'undefined' ? "general/attachment/select" : "user/attachment");
                         parent.Fast.api.open(url + "?element_id=" + $(this).attr("id") + "&multiple=" + multiple + "&mimetype=" + mimetype + "&admin_id=" + admin_id + "&user_id=" + user_id, __('Choose'), {
                             callback: function (data) {
-                                var button = $("#" + $(that).attr("id"));
+                                var button = $(that);
                                 var maxcount = $(button).data("maxcount");
                                 var input_id = $(button).data("input-id") ? $(button).data("input-id") : "";
                                 maxcount = typeof maxcount !== "undefined" ? maxcount : 0;
@@ -288,7 +290,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                     }
                                     var result = urlArr.join(",");
                                     inputObj.val(result).trigger("change").trigger("validate");
-                                } else {
+                                } else if (input_id) {
                                     var url = Config.upload.fullmode ? Fast.api.cdnurl(data.url) : data.url;
                                     $("#" + input_id).val(url).trigger("change").trigger("validate");
                                 }
@@ -319,19 +321,36 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                                 }
                                 data[match[1]][match[2]] = j.value;
                             });
-                            var result = template ? [] : {};
+                            //使用数组保存
+                            var usearray = container.data("usearray") || false;
+                            //保留空数据
+                            var keepempty = container.data("keepempty") || false;
+
+                            var result = template || usearray ? [] : {};
+                            var keys = Object.keys(Object.values(data)[0] || {});
+
+                            var isassociative = !usearray && keys.indexOf("value") > -1 && (keys.length === 1 || (keys.length === 2 && keys.indexOf("key") > -1));
+                            if(isassociative && keys.length ===2){
+                                result = {};
+                            }
+
                             $.each(data, function (i, j) {
                                 if (j) {
-                                    if (!template) {
+                                    if (isassociative) {
-                                        if (j.key != '') {
+                                        if (keys.length === 2) {
-                                            result[j.key] = j.value;
+                                            if (j.key != '' || keepempty) {
+                                                result['__PLACEHOLDKEY__' + j.key] = j.value;
+                                            }
+                                        } else {
+                                            //一维数组
+                                            result.push(j.value);
                                         }
                                     } else {
                                         result.push(j);
                                     }
                                 }
                             });
-                            textarea.val(JSON.stringify(result));
+                            textarea.val(JSON.stringify(result).replace(/__PLACEHOLDKEY__/g, ''));
                         };
                         //追加一行数据
                         var append = function (container, row, initial) {
@@ -382,7 +401,7 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                         fieldlist.on("click", ".btn-append,.append", function (e, row) {
                             var container = $(this).closest(".fieldlist");
                             append(container, row);
-                            // refresh(container);
+                            refresh(container);
                         });
                         //移除控制(点击按钮)
                         fieldlist.on("click", ".btn-remove", function () {
@@ -405,11 +424,12 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                             $("[fieldlist-item]", container).remove();
                             var json = {};
                             try {
-                                json = JSON.parse(textarea.val());
+                                var val = textarea.val().replace(/"(\d+)"\:/g, "\"__PLACEHOLDERKEY__$1\":");
+                                json = JSON.parse(val);
                             } catch (e) {
                             }
                             $.each(json, function (i, j) {
-                                append(container, {key: i, value: j}, true);
+                                append(container, {key: i.toString().replace("__PLACEHOLDERKEY__", ""), value: j}, true);
                             });
                         });
                         //拖拽排序
@@ -473,9 +493,9 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
 
             },
             slider: function (form) {
-                if ($(".slider", form).length > 0) {
+                if ($("[data-role='slider'],input.slider", form).length > 0) {
                     require(['bootstrap-slider'], function () {
-                        $('.slider').removeClass('hidden').css('width', function (index, value) {
+                        $("[data-role='slider'],input.slider").removeClass('hidden').css('width', function (index, value) {
                             return $(this).parents('.form-control').width();
                         }).slider().on('slide', function (ev) {
                             var data = $(this).data();
@@ -501,7 +521,11 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
             autocomplete: function (form) {
                 if ($("[data-role='autocomplete']", form).length > 0) {
                     require(['autocomplete'], function () {
-                        $("[data-role='autocomplete']").autocomplete();
+                        $("[data-role='autocomplete']").autocomplete({
+                            onSelect: function () {
+                                $(this).trigger('change').trigger('validate');
+                            }
+                        });
                     });
                 }
             },
@@ -583,10 +607,10 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
                     });
                     return success === conditionArr.length;
                 };
-                form.on("keyup change click configchange", "input,select", function () {
+                form.on("keyup change click configchange", "input,textarea,select", function () {
                     $("[data-favisible][data-favisible!='']", form).each(function () {
                         var visible = $(this).data("favisible");
-                        var groupArr = visible.split(/\|\|/);
+                        var groupArr = visible ? visible.toString().split(/\|\|/) : [];
                         var success = 0;
                         $.each(groupArr, function (i, j) {
                             if (checkCondition(j)) {
@@ -603,10 +627,13 @@ define(['jquery', 'bootstrap', 'upload', 'validator', 'validator-lang'], functio
 
                 //追加上忽略元素
                 setTimeout(function () {
-                    form.data('validator').options.ignore += ((form.data('validator').options.ignore ? ',' : '') + '[data-favisible] :hidden,[data-favisible]:hidden');
+                    var validator = form.data('validator');
+                    if (validator) {
+                        validator.options.ignore += ((validator.options.ignore ? ',' : '') + '.hidden[data-favisible] :hidden,.hidden[data-favisible]:hidden');
+                    }
                 }, 0);
 
-                $("input,select", form).trigger("configchange");
+                $("input,textarea,select", form).trigger("configchange");
             }
         },
         api: {

public/assets/js/require-frontend.js

@@ -129,7 +129,7 @@ require(['jquery', 'bootstrap'], function ($, undefined) {
     window.Config = Config;
     // 配置语言包的路径
     var paths = {};
-    paths['lang'] = Config.moduleurl + '/ajax/lang?callback=define&controllername=' + Config.controllername + '&lang=' + Config.language + '&v=' + Config.site.version;
+    paths['lang'] = Config.moduleurl + '/ajax/lang?callback=define&controllername=' + Config.controllername + '&lang=' + Config.language;
     // 避免目录冲突
     paths['frontend/'] = 'frontend/';
     require.config({paths: paths});

public/assets/js/require-table.js

@@ -14,7 +14,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
             titleForm: '', //为空则不显示标题，不定义默认显示：普通搜索
             idTable: 'commonTable',
             showExport: true,
-            exportDataType: "auto",
+            exportDataType: "auto", //支持auto,selected,all 当设定为auto时自动时有选中则导出选中，没有选中则导出全部
             exportTypes: ['json', 'xml', 'csv', 'txt', 'doc', 'excel'],
             exportOptions: {
                 fileName: 'export_' + Moment().format("YYYY-MM-DD"),
@@ -34,7 +34,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
             singleSelect: false, //是否启用单选
             showRefresh: false,
             showJumpto: true,
-            locale: Config.language == 'zh-cn' ? 'zh-CN' : 'en-US',
+            locale: Config.language === 'zh-cn' ? 'zh-CN' : 'en-US',
             showToggle: true,
             showColumns: true,
             pk: 'id',
@@ -326,9 +326,15 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         options.selectedIds = selectedIds;
                         options.selectedData = selectedData;
                     }
+
                     //如果导出类型为auto时则自动判断
                     if (exportDataType === 'auto') {
                         options.exportDataType = selectedIds.length > 0 ? 'selected' : 'all';
+                        if ($(".export .exporttips").length === 0) {
+                            $(".export .dropdown-menu").prepend("<li class='exporttips alert alert-warning-light mb-0 no-border p-2'></li>")
+                        }
+                        $(".export .exporttips").html("导出记录：" + (selectedIds.length > 0 ? "选中" : "全部"));
+
                     }
                     $(Table.config.disabledbtn, toolbar).toggleClass('disabled', !options.selectedIds.length);
                 });
@@ -347,12 +353,13 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     var field = $(this).closest("[data-field]").data("field");
                     var value = $(this).data("value");
                     var object = $("[name='" + field + "']", table.closest(".bootstrap-table").find(".commonsearch-table"));
-                    if (object.prop('tagName') == "SELECT") {
+                    if (object.prop('tagName') === "SELECT") {
                         $("option[value='" + value + "']", object).prop("selected", true);
                     } else {
                         object.val(value);
                     }
                     table.trigger("uncheckbox");
+                    table.bootstrapTable('getOptions').totalRows = 0;
                     table.bootstrapTable('refresh', {pageNumber: 1});
                     return false;
                 });
@@ -441,7 +448,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                 $(document).on('click', Table.config.restoreonebtn + ',' + Table.config.destroyonebtn, function () {
                     var that = this;
                     var url = $(that).data("url") ? $(that).data("url") : $(that).attr("href");
-                    var row = Fast.api.getrowbyindex(table, $(that).data("row-index"));
+                    var row = Table.api.getrowbyindex(table, $(that).data("row-index"));
                     Fast.api.ajax({
                         url: url,
                         data: {ids: row[options.pk]}
@@ -562,7 +569,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     var target = $(".autocontent-item", this).get(0);
                     if (!target) return;
                     if (e.type === 'mouseenter') {
-                        if (target.scrollWidth > target.offsetWidth) {
+                        if (target.scrollWidth > target.offsetWidth && $(".autocontent-caret", this).length === 0) {
                             $(this).append("<div class='autocontent-caret'><i class='fa fa-chevron-down'></div>");
                         }
                     } else {
@@ -726,40 +733,30 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     return '<i class="' + value + '"></i> ' + value;
                 },
                 image: function (value, row, index) {
-                    value = value == null || value.length === 0 ? '' : value.toString();
+                    return Table.api.formatter.images.call(this, value, row, index);
-                    value = value ? value : '/assets/img/blank.gif';
-                    var classname = typeof this.classname !== 'undefined' ? this.classname : 'img-sm img-center';
-                    var url = Fast.api.cdnurl(value, true);
-                    url = url.match(/^(\/|data:image\\)/) ? url : url + Config.upload.thumbstyle;
-                    return '<a href="javascript:"><img class="' + classname + '" src="' + url + '" /></a>';
                 },
                 images: function (value, row, index) {
                     value = value == null || value.length === 0 ? '' : value.toString();
                     var classname = typeof this.classname !== 'undefined' ? this.classname : 'img-sm img-center';
-                    var arr = value != '' ? value.split(',') : [];
+                    var arr = value !== '' ? (value.indexOf('data:image/') === -1 ? value.split(',') : [value]) : [];
                     var html = [];
                     var url;
                     $.each(arr, function (i, value) {
                         value = value ? value : '/assets/img/blank.gif';
                         url = Fast.api.cdnurl(value, true);
-                        url = url.match(/^(\/|data:image\\)/) ? url : url + Config.upload.thumbstyle;
+                        //匹配本地、data:image、或已包含标识符首字符
+                        url = !Config.upload.thumbstyle || url.match(/^(\/|data:image\/)/) || url.indexOf(Config.upload.thumbstyle.substring(0, 1)) > -1 ? url : url + Config.upload.thumbstyle;
                         html.push('<a href="javascript:"><img class="' + classname + '" src="' + url + '" /></a>');
                     });
                     return html.join(' ');
                 },
                 file: function (value, row, index) {
-                    value = value == null || value.length === 0 ? '' : value.toString();
+                    return Table.api.formatter.files.call(this, value, row, index);
-                    value = Fast.api.cdnurl(value, true);
-                    var classname = typeof this.classname !== 'undefined' ? this.classname : 'img-sm img-center';
-                    var suffix = /[\.]?([a-zA-Z0-9]+)$/.exec(value);
-                    suffix = suffix ? suffix[1] : 'file';
-                    var url = Fast.api.fixurl("ajax/icon?suffix=" + suffix);
-                    return '<a href="' + value + '" target="_blank"><img src="' + url + '" class="' + classname + '"></a>';
                 },
                 files: function (value, row, index) {
                     value = value == null || value.length === 0 ? '' : value.toString();
                     var classname = typeof this.classname !== 'undefined' ? this.classname : 'img-sm img-center';
-                    var arr = value != '' ? value.split(',') : [];
+                    var arr = value !== '' ? (value.indexOf('data:image/') === -1 ? value.split(',') : [value]) : [];
                     var html = [];
                     var suffix, url;
                     $.each(arr, function (i, value) {
@@ -834,8 +831,11 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                 },
                 search: function (value, row, index) {
                     var field = this.field;
-                    if (typeof this.customField !== 'undefined' && typeof row[this.customField] !== 'undefined') {
+                    if (typeof this.customField !== 'undefined') {
-                        value = row[this.customField];
+                        var customValue = this.customField.split('.').reduce(function (obj, key) {
+                            return obj === null || obj === undefined ? '' : obj[key];
+                        }, row);
+                        value = Fast.api.escape(customValue);
                         field = this.customField;
                     }
                     return '<a href="javascript:;" class="searchit" data-toggle="tooltip" title="' + __('Click to search %s', value) + '" data-field="' + field + '" data-value="' + value + '">' + value + '</a>';
@@ -859,8 +859,11 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                         colorArr = $.extend(colorArr, this.custom);
                     }
                     var field = this.field;
-                    if (typeof this.customField !== 'undefined' && typeof row[this.customField] !== 'undefined') {
+                    if (typeof this.customField !== 'undefined') {
-                        value = row[this.customField];
+                        var customValue = this.customField.split('.').reduce(function (obj, key) {
+                            return obj === null || obj === undefined ? '' : obj[key];
+                        }, row);
+                        value = Fast.api.escape(customValue);
                         field = this.customField;
                     }
                     if (typeof that.searchList === 'object' && typeof that.custom === 'undefined') {
@@ -995,7 +998,7 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     $.each(dropdowns, function (i, j) {
                         dropdownHtml.push('<div class="btn-group"><button type="button" class="btn btn-primary dropdown-toggle btn-xs" data-toggle="dropdown">' + i + '</button><button type="button" class="btn btn-primary dropdown-toggle btn-xs" data-toggle="dropdown"><span class="caret"></span></button><ul class="dropdown-menu dropdown-menu-right"><li>' + j.join('</li><li>') + '</li></ul></div>');
                     });
-                    html.unshift(dropdownHtml);
+                    html.unshift(dropdownHtml.join(' '));
                 }
                 return html.join(' ');
             },
@@ -1010,17 +1013,11 @@ define(['jquery', 'bootstrap', 'moment', 'moment/locale/zh-cn', 'bootstrap-table
                     url + (url.match(/(\?|&)+/) ? "&ids=" : "/ids/") + '{ids}' : url;
                 url = url.replace(/\{(.*?)\}/gi, function (matched) {
                     matched = matched.substring(1, matched.length - 1);
-                    if (matched.indexOf(".") !== -1) {
+                    var temp = matched.split('.').reduce(function (obj, key) {
-                        var temp = row;
+                        return obj === null || obj === undefined ? '' : obj[key];
-                        var arr = matched.split(/\./);
+                    }, row);
-                        for (var i = 0; i < arr.length; i++) {
+                    temp = Fast.api.escape(temp);
-                            if (typeof temp[arr[i]] !== 'undefined') {
+                    return temp;
-                                temp = temp[arr[i]];
-                            }
-                        }
-                        return typeof temp === 'object' ? '' : temp;
-                    }
-                    return row[matched];
                 });
                 return url;
             },

public/assets/js/require-upload.js

@@ -27,7 +27,7 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                             if ($(button).data("multiple") && inputObj.val() !== "") {
                                 urlArr.push(inputObj.val());
                             }
-                            var url = Config.upload.fullmode ? Fast.api.cdnurl(data.url) : data.url;
+                            var url = Config.upload.fullmode ? (data.fullurl ? data.fullurl : Fast.api.cdnurl(data.url)) : data.url;
                             urlArr.push(url);
                             inputObj.val(urlArr.join(",")).trigger("change").trigger("validate");
                         }
@@ -38,7 +38,7 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                                 onDomUploadSuccess = Upload.api.custom[onDomUploadSuccess];
                             }
                             if (typeof onDomUploadSuccess === 'function') {
-                                var result = onDomUploadSuccess.call(button, data, ret);
+                                var result = onDomUploadSuccess.call(button, data, ret, up, file);
                                 if (result === false)
                                     return;
                             }
@@ -46,7 +46,7 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                     }
 
                     if (typeof onUploadSuccess === 'function') {
-                        var result = onUploadSuccess.call(button, data, ret);
+                        var result = onUploadSuccess.call(button, data, ret, up, file);
                         if (result === false)
                             return;
                     }
@@ -63,7 +63,7 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                                 onDomUploadError = Upload.api.custom[onDomUploadError];
                             }
                             if (typeof onDomUploadError === 'function') {
-                                var result = onDomUploadError.call(button, data, ret);
+                                var result = onDomUploadError.call(button, data, ret, up, file);
                                 if (result === false)
                                     return;
                             }
@@ -71,7 +71,7 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                     }
 
                     if (typeof onUploadError === 'function') {
-                        var result = onUploadError.call(button, data, ret);
+                        var result = onUploadError.call(button, data, ret, up, file);
                         if (result === false) {
                             return;
                         }
@@ -351,9 +351,10 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                             $(document.body).on("keyup change", "#" + input_id, function (e) {
                                 var inputStr = $("#" + input_id).val();
                                 var inputArr = inputStr.split(/\,/);
-                                $("#" + preview_id).empty();
+                                var previewObj = $("#" + preview_id);
-                                var tpl = $("#" + preview_id).data("template") ? $("#" + preview_id).data("template") : "";
+                                previewObj.empty();
-                                var extend = $("#" + preview_id).next().is("textarea") ? $("#" + preview_id).next("textarea").val() : "{}";
+                                var tpl = previewObj.data("template") ? previewObj.data("template") : "";
+                                var extend = previewObj.next().is("textarea") ? previewObj.next("textarea").val() : "{}";
                                 var json = {};
                                 try {
                                     json = JSON.parse(extend);
@@ -365,13 +366,15 @@ define(['jquery', 'bootstrap', 'dropzone', 'template'], function ($, undefined,
                                     }
                                     var suffix = /[\.]?([a-zA-Z0-9]+)$/.exec(j);
                                     suffix = suffix ? suffix[1] : 'file';
-                                    j = Config.upload.fullmode ? Fast.api.cdnurl(j) : j;
+                                    var btnData = $(that).data();
+                                    var fullurl = typeof btnData.cdnurl!=='undefined' ? Fast.api.cdnurl(j, btnData.cdnurl) : Fast.api.cdnurl(j);
+                                    j = Config.upload.fullmode ? fullurl : j;
                                     var value = (json && typeof json[i] !== 'undefined' ? json[i] : null);
-                                    var data = {url: j, fullurl: Fast.api.cdnurl(j), data: $(that).data(), key: i, index: i, value: value, row: value, suffix: suffix};
+                                    var data = {url: j, fullurl: fullurl, data: btnData, key: i, index: i, value: value, row: value, suffix: suffix};
                                     var html = tpl ? Template(tpl, data) : Template.render(Upload.config.previewtpl, data);
-                                    $("#" + preview_id).append(html);
+                                    previewObj.append(html);
                                 });
-                                refresh($("#" + preview_id).data("name"));
+                                refresh(previewObj.data("name"));
                             });
                             $("#" + input_id).trigger("change");
                         }

public/assets/less/frontend.less

@@ -87,6 +87,12 @@ a {
         }
     }
 
+    .navbar-white {
+        .navbar-brand {
+            height: 60px;
+            line-height: 27px;
+        }
+    }
     .navbar-white .navbar-nav {
         > li > a {
             height: 60px;