From fa635ba3ac3da159147f2a0cb0e83149712b088b Mon Sep 17 00:00:00 2001
From: augushong <augushong@ulthon.com>
Date: Sat, 29 Oct 2022 11:12:22 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96=E4=B8=8A=E4=BC=A0=E6=89=A9?=
 =?UTF-8?q?=E5=B1=95=E5=90=8D=E7=9A=84=E9=85=8D=E7=BD=AE=EF=BC=9B=E5=A2=9E?=
 =?UTF-8?q?=E5=8A=A0=E4=B8=8A=E4=BC=A0=E6=96=87=E4=BB=B6=E4=BB=A3=E7=A0=81?=
 =?UTF-8?q?=E6=B3=A8=E5=85=A5=E6=A3=80=E6=B5=8B=EF=BC=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/admin/view/system/uploadfile/add.html    |  2 +-
 app/common/service/UploadService.php         | 23 ++++++++++++++++++--
 public/static/plugs/easy-admin/easy-admin.js | 16 ++++++++------
 3 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/app/admin/view/system/uploadfile/add.html b/app/admin/view/system/uploadfile/add.html
index ebc96a6..302a515 100644
--- a/app/admin/view/system/uploadfile/add.html
+++ b/app/admin/view/system/uploadfile/add.html
@@ -6,7 +6,7 @@
             <div class="layui-input-block layuimini-upload">
                 <input name="head_img" class="layui-input layui-col-xs6" lay-verify="required" lay-reqtext="请上传文件" placeholder="请上传文件" value="">
                 <div class="layuimini-upload-btn">
-                    <span><a class="layui-btn" data-upload="head_img" data-upload-number="*" data-upload-exts="*"><i class="fa fa-upload"></i> 上传文件</a></span>
+                    <span><a class="layui-btn" data-upload="head_img" data-upload-number="*" data-upload-exts=""><i class="fa fa-upload"></i> 上传文件</a></span>
                 </div>
             </div>
         </div>
diff --git a/app/common/service/UploadService.php b/app/common/service/UploadService.php
index 049b1da..8641ded 100644
--- a/app/common/service/UploadService.php
+++ b/app/common/service/UploadService.php
@@ -4,6 +4,7 @@ namespace app\common\service;
 
 use app\admin\model\SystemUploadfile;
 use app\common\tools\PathTools;
+use think\exception\ValidateException;
 use think\facade\App;
 use think\facade\Filesystem;
 use think\facade\Validate;
@@ -24,7 +25,7 @@ class UploadService
         $this->uploadType = $upload_type;
     }
 
-    public function validate($file, $allow_ext = null, $allow_size = null, $fail_exception = false)
+    public function validate(File $file, $allow_ext = null, $allow_size = null, $fail_exception = false)
     {
         $uploadConfig = sysconfig('upload');
 
@@ -41,10 +42,28 @@ class UploadService
             'file|文件'              => "require|file|fileExt:{$uploadConfig['upload_allow_ext']}|fileSize:{$uploadConfig['upload_allow_size']}",
         ];
 
-        return Validate::failException($fail_exception)->check([
+        $validat_result = Validate::failException($fail_exception)->check([
             'upload_type' => $this->uploadType,
             'file' => $file
         ], $rule);
+
+        if (!$validat_result) {
+            return $validat_result;
+        }
+
+
+        // 出于性能原因，您可以注释掉下面的代码
+        $file_path = $file->getRealPath();
+
+        if (strpos(file_get_contents($file_path), '<?php') !== false) {
+            if ($fail_exception) {
+                throw new ValidateException("文件含有PHP注入代码");
+            } else {
+                return '文件含有PHP注入代码';
+            }
+        }
+
+        return true;
     }
 
     public function validateException($file, $allow_ext = null, $allow_size = null)
diff --git a/public/static/plugs/easy-admin/easy-admin.js b/public/static/plugs/easy-admin/easy-admin.js
index 4dedd9b..cac1f26 100644
--- a/public/static/plugs/easy-admin/easy-admin.js
+++ b/public/static/plugs/easy-admin/easy-admin.js
@@ -63,15 +63,17 @@ define(["jquery", "tableSelect", "ckeditor", 'miniTheme', 'tableData', 'citypick
         'file': []
     }
 
+    var allExtGroup = [];
+
     for (const extGroupName in extGroup) {
         if (Object.hasOwnProperty.call(extGroup, extGroupName)) {
             const extGroupList = extGroup[extGroupName];
-            if (init.upload_exts.length > 0) {
-                init.upload_exts += '|';
-            }
-            init.upload_exts += extGroupList.join('|')
+
+            allExtGroup = allExtGroup.concat(extGroupList)
+
         }
     }
+    init.upload_exts += allExtGroup.join('|')
 
     var admin = {
         config: {
@@ -1963,7 +1965,7 @@ define(["jquery", "tableSelect", "ckeditor", 'miniTheme', 'tableData', 'citypick
 
                 if (uploadList.length > 0) {
                     $.each(uploadList, function (i, v) {
-                        var uploadExts = $(this).attr('data-upload-exts') || init.upload_exts,
+                        var uploadExts = $(this).attr('data-upload-exts'),
                             uploadName = $(this).attr('data-upload'),
                             uploadNumber = $(this).attr('data-upload-number') || 'one',
                             uploadSign = $(this).attr('data-upload-sign') || '|',
@@ -1975,9 +1977,9 @@ define(["jquery", "tableSelect", "ckeditor", 'miniTheme', 'tableData', 'citypick
 
                         if (uploadExts == '*') {
                             uploadExts = init.upload_exts;
-                        }else if(uploadExts.charAt(0) == '*'){
+                        } else if (uploadExts.charAt(0) == '*') {
                             var extGroupName = uploadExts.slice(1);
-                            if(extGroup[extGroupName]){
+                            if (extGroup[extGroupName]) {
                                 uploadExts = extGroup[extGroupName].join('|');
                             }
                         }