新增后台IP变动控制开关

优化后台插件管理显示
优化Fast.api.ajax方法返回
优化管理员日志显示

application/admin/command/Crud/stubs/controllerindex.stub

@@ -7,7 +7,7 @@
         //当前是否为关联查询
         $this->relationSearch = {%relationSearch%};
         //设置过滤方法
-        $this->request->filter(['strip_tags']);
+        $this->request->filter(['strip_tags', 'trim']);
         if ($this->request->isAjax())
         {
             //如果发送的来源是Selectpage，则转发到Selectpage

application/admin/controller/Index.php

@@ -22,6 +22,8 @@ class Index extends Backend
     public function _initialize()
     {
         parent::_initialize();
+        //移除HTML标签
+        $this->request->filter('trim,strip_tags,htmlspecialchars');
     }
 
     /**

application/admin/library/Auth.php

@@ -59,7 +59,7 @@ class Auth extends \fast\Auth
         }
         $admin->loginfailure = 0;
         $admin->logintime = time();
-        $admin->loginip = request()->ip(0, false);
+        $admin->loginip = request()->ip();
         $admin->token = Random::uuid();
         $admin->save();
         Session::set("admin", $admin->toArray());
@@ -103,7 +103,7 @@ class Auth extends \fast\Auth
             if ($key != md5(md5($id) . md5($keeptime) . md5($expiretime) . $admin->token)) {
                 return false;
             }
-            $ip = request()->ip(0, false);
+            $ip = request()->ip();
             //IP有变动
             if ($admin->loginip != $ip) {
                 return false;
@@ -183,12 +183,17 @@ class Auth extends \fast\Auth
         if (Config::get('fastadmin.login_unique')) {
             $my = Admin::get($admin['id']);
             if (!$my || $my['token'] != $admin['token']) {
+                $this->logout();
                 return false;
             }
         }
-        if (!isset($admin['loginip']) || $admin['loginip'] != request()->ip(0, false)) {
+        //判断管理员IP是否变动
+        if (Config::get('fastadmin.loginip_check')) {
+            if (!isset($admin['loginip']) || $admin['loginip'] != request()->ip()) {
+                $this->logout();
                 return false;
             }
+        }
         $this->logined = true;
         return true;
     }

application/admin/model/AdminLog.php

@@ -35,7 +35,7 @@ class AdminLog extends Model
         $username = $auth->isLogin() ? $auth->username : __('Unknown');
         $content = self::$content;
         if (!$content) {
-            $content = request()->param();
+            $content = request()->param('', null, 'trim,strip_tags,htmlspecialchars');
             foreach ($content as $k => $v) {
                 if (is_string($v) && strlen($v) > 200 || stripos($k, 'password') !== false) {
                     unset($content[$k]);

application/admin/view/addon/index.html

@@ -233,6 +233,7 @@
         </tbody>
     </table>
 </script>
+<!--@formatter:off-->
 <script id="operatetpl" type="text/html">
     <% var labelarr = ['primary', 'success', 'info', 'danger', 'warning']; %>
     <% var label = labelarr[item.id % 5]; %>
@@ -296,7 +297,6 @@
             <a href="javascript:;" class="btn btn-xs btn-danger btn-uninstall" title="{:__('Uninstall')}"><i class="fa fa-times"></i>
                 {:__('Uninstall')}</a>
         <% } %>
-
-
     </div>
 </script>
+<!--@formatter:on-->

application/admin/view/auth/adminlog/detail.html

@@ -9,7 +9,7 @@
         {volist name="row" id="vo"  }
             <tr>
                 <td>{:__($key)}</td>
-                <td>{$vo}</td>
+                <td>{$vo|htmlentities}</td>
             </tr>
         {/volist}
     </tbody>

application/common/library/Auth.php

@@ -256,7 +256,7 @@ class Auth
             try {
                 $salt = Random::alnum();
                 $newpassword = $this->getEncryptPassword($newpassword, $salt);
-                $this->_user->save(['password' => $newpassword, 'salt' => $salt]);
+                $this->_user->save(['loginfailure' => 0, 'password' => $newpassword, 'salt' => $salt]);
 
                 Token::delete($this->_token);
                 //修改密码成功的事件
@@ -298,6 +298,8 @@ class Auth
                 //记录本次登录的IP和时间
                 $user->loginip = $ip;
                 $user->logintime = $time;
+                //重置登录失败次数
+                $user->loginfailure = 0;
 
                 $user->save();
 

application/config.php

@@ -265,6 +265,8 @@ return [
         'login_failure_retry' => true,
         //是否同一账号同一时间只能在一个地方登录
         'login_unique'        => false,
+        //是否开启IP变动检测
+        'loginip_check'      => true,
         //登录页默认背景图
         'login_background'    => "/assets/img/loginbg.jpg",
         //是否启用多级菜单导航
@@ -272,7 +274,7 @@ return [
         //自动检测更新
         'checkupdate'         => false,
         //版本号
-        'version'             => '1.0.0.20190930_beta',
+        'version'             => '1.0.0.20191101_beta',
         //API接口地址
         'api_url'             => 'https://api.fastadmin.net',
     ],

public/assets/js/backend/addon.js

@@ -441,11 +441,10 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
                 var userinfo = Controller.api.userinfo.get();
                 var uid = userinfo ? userinfo.id : 0;
 
-                if ($(that).data("type") !== 'free') {
                 if (parseInt(uid) === 0) {
                     return Layer.alert(__('Not login tips'), {
                         title: __('Warning'),
-                            btn: [__('Login now'), __('Continue install')],
+                        btn: [__('Login now')],
                         yes: function (index, layero) {
                             $(".btn-userinfo").trigger("click");
                         },
@@ -454,7 +453,6 @@ define(['jquery', 'bootstrap', 'backend', 'table', 'form', 'template'], function
                         }
                     });
                 }
-                }
                 install(name, version, false);
             });
 

public/assets/js/fast.js

@@ -83,7 +83,7 @@ define(['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, undefine
                         Fast.events.onAjaxError(ret, error);
                     }
                 }, options);
-                $.ajax(options);
+                return $.ajax(options);
             },
             //修复URL
             fixurl: function (url) {

public/assets/js/require-backend.min.js

@@ -743,7 +743,7 @@ define('fast',['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, u
                         Fast.events.onAjaxError(ret, error);
                     }
                 }, options);
-                $.ajax(options);
+                return $.ajax(options);
             },
             //修复URL
             fixurl: function (url) {

public/assets/js/require-frontend.min.js

@@ -736,7 +736,7 @@ define('fast',['jquery', 'bootstrap', 'toastr', 'layer', 'lang'], function ($, u
                         Fast.events.onAjaxError(ret, error);
                     }
                 }, options);
-                $.ajax(options);
+                return $.ajax(options);
             },
             //修复URL
             fixurl: function (url) {