Merge pull request #104 from Tinywan/main

fix:优化检测是否是合法URL Path 支持http图片链接地址

Author: walkor

.gitignore

@@ -7,3 +7,4 @@ src/plugin/admin/public/upload
 src/plugin/admin/config/database.php
 src/plugin/admin/config/thinkorm.php
 src/plugin/admin.zip
+composer.lock

composer.json

@@ -12,7 +12,8 @@
     "webman/event": "^1.0",
     "webman/captcha": "^1.0.0",
     "guzzlehttp/guzzle": "^7.5",
-    "laravel/serializable-closure": "^1.0"
+    "laravel/serializable-closure": "^1.0",
+    "ext-json": "*"
   },
   "autoload": {
     "psr-4": {

src/plugin/admin/api/Menu.php

@@ -1,10 +1,7 @@
 <?php
 namespace plugin\admin\api;
 
-use plugin\admin\app\model\Role;
 use plugin\admin\app\model\Rule;
-use support\exception\BusinessException;
-use function admin;
 
 /**
  * 对外提供的菜单接口

src/plugin/admin/app/common/Auth.php

@@ -2,17 +2,16 @@
 namespace plugin\admin\app\common;
 
 
-use plugin\admin\app\model\Admin;
 use plugin\admin\app\model\AdminRole;
 use plugin\admin\app\model\Role;
-use plugin\admin\app\model\Rule;
 
 class Auth
 {
     /**
      * 获取权限范围内的所有角色id
      * @param bool $with_self
      * @return array
+     * @throws \Exception
      */
     public static function getScopeRoleIds(bool $with_self = false): array
     {
@@ -35,6 +34,7 @@ public static function getScopeRoleIds(bool $with_self = false): array
      * 获取权限范围内的所有管理员id
      * @param bool $with_self
      * @return array
+     * @throws \Exception
      */
     public static function getScopeAdminIds(bool $with_self = false): array
     {
@@ -62,6 +62,7 @@ public static function isSupperAdmin(int $admin_id = 0): bool
      * 是否是超级管理员
      * @param int $admin_id
      * @return bool
+     * @throws \Exception
      */
     public static function isSuperAdmin(int $admin_id = 0): bool
     {

src/plugin/admin/app/common/Layui.php

@@ -1,7 +1,6 @@
 <?php
 namespace plugin\admin\app\common;
 
-use plugin\admin\app\common\Util;
 use support\exception\BusinessException;
 
 class Layui

src/plugin/admin/app/common/Util.php

@@ -27,8 +27,8 @@ public static function passwordHash($password, string $algo = PASSWORD_DEFAULT)
 
     /**
      * 验证密码哈希
-     * @param $password
-     * @param $hash
+     * @param string $password
+     * @param string $hash
      * @return bool
      */
     public static function passwordVerify(string $password, string $hash): bool
@@ -109,7 +109,7 @@ public static function formatBytes($file_size): string
      */
     public static function pdoQuote($var)
     {
-        return Util::db()->getPdo()->quote($var, \PDO::PARAM_STR);
+        return Util::db()->getPdo()->quote($var);
     }
 
     /**
@@ -161,15 +161,23 @@ public static function filterNum($var)
     }
 
     /**
-     * 检测是否是合法URL Path
+     * @desc 检测是否是合法URL Path
      * @param $var
      * @return string
      * @throws BusinessException
      */
     public static function filterUrlPath($var): string
     {
-        if (!is_string($var) || !preg_match('/^[a-zA-Z0-9_\-\/&?.]+$/', $var)) {
-            throw new BusinessException('参数不合法');
+        if (!is_string($var)) {
+            throw new BusinessException('参数不合法，地址必须是一个字符串！');
+        }
+
+        if (strpos($var, 'https://') === 0 || strpos($var, 'http://') === 0) {
+            if (!filter_var($var, FILTER_VALIDATE_URL)) {
+                throw new BusinessException('参数不合法，不是合法的URL地址！');
+            }
+        } elseif (!preg_match('/^[a-zA-Z0-9_\-\/&?.]+$/', $var)) {
+            throw new BusinessException('参数不合法，不是合法的Path！');
         }
         return $var;
     }

src/plugin/admin/app/controller/DevController.php

@@ -2,7 +2,6 @@
 
 namespace plugin\admin\app\controller;
 
-use support\Request;
 use support\Response;
 use Throwable;
 

src/plugin/admin/app/controller/InstallController.php

@@ -4,7 +4,6 @@
 
 use Illuminate\Database\Capsule\Manager;
 use plugin\admin\app\common\Util;
-use plugin\admin\app\model\Admin;
 use support\exception\BusinessException;
 use support\Request;
 use support\Response;

src/plugin/admin/app/controller/PluginController.php

@@ -5,7 +5,6 @@
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\GuzzleException;
 use plugin\admin\app\common\Util;
-use plugin\admin\app\controller\Base;
 use process\Monitor;
 use support\exception\BusinessException;
 use support\Log;

src/plugin/admin/app/controller/RoleController.php

@@ -188,6 +188,7 @@ public function delete(Request $request): Response
      * 获取角色权限
      * @param Request $request
      * @return Response
+     * @throws \Exception
      */
     public function rules(Request $request): Response
     {