From 26ea7eb612a8373be1d7eecba7c92b4311c5e0b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E6=98=8A=E5=A4=A9?= <442384644@qq.com>
Date: Sun, 29 Sep 2024 09:31:07 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90=E7=A8=8B=E5=BA=8F=E7=9B=AE=E5=BD=95?=
 =?UTF-8?q?=E3=80=91=E4=BC=98=E5=8C=96=E4=B8=8A=E4=BC=A0=E9=AA=8C=E8=AF=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../api/controller/v1/PublicController.php    | 14 ++++++++
 crmeb/app/common.php                          | 35 ++++++++++---------
 crmeb/crmeb/services/upload/storage/Local.php |  3 +-
 3 files changed, 34 insertions(+), 18 deletions(-)

diff --git a/crmeb/app/api/controller/v1/PublicController.php b/crmeb/app/api/controller/v1/PublicController.php
index b82242d55..5c22a62d5 100644
--- a/crmeb/app/api/controller/v1/PublicController.php
+++ b/crmeb/app/api/controller/v1/PublicController.php
@@ -26,6 +26,7 @@ use app\services\shipping\SystemCityServices;
 use app\services\system\AppVersionServices;
 use app\services\system\attachment\SystemAttachmentServices;
 use app\services\system\config\SystemConfigServices;
+use app\services\system\config\SystemStorageServices;
 use app\services\system\lang\LangCodeServices;
 use app\services\system\lang\LangCountryServices;
 use app\services\system\lang\LangTypeServices;
@@ -310,6 +311,19 @@ class PublicController
             ['image', ''],
             ['code', ''],
         ], true);
+        /** @var SystemStorageServices $systemStorageServices */
+        $systemStorageServices = app()->make(SystemStorageServices::class);
+        $domainArr = $systemStorageServices->getColumn([], 'domain');
+        $domainArr = array_merge($domainArr, [$request->host()]);
+        $domainArr = array_unique(array_diff($domainArr, ['']));
+        if (count($domainArr)) {
+            $domainArr = array_map(function ($item) {
+                return str_replace(['https://', 'http://'], '', $item);
+            }, $domainArr);
+        }
+        if ($domainArr && (($imageUrl && !in_array($imageUrl, $domainArr)) || ($codeUrl && !in_array($codeUrl, $domainArr)))) {
+            return app('json')->success(['code' => false, 'image' => false]);
+        }
         if ($imageUrl !== '' && !preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $imageUrl) && strpos(strtolower($imageUrl), "phar://") !== false) {
             return app('json')->success(['code' => false, 'image' => false]);
         }
diff --git a/crmeb/app/common.php b/crmeb/app/common.php
index cffc96d06..31dc51db8 100644
--- a/crmeb/app/common.php
+++ b/crmeb/app/common.php
@@ -509,7 +509,9 @@ if (!function_exists('image_to_base64')) {
         try {
             $url = parse_url($avatar);
             if ($url['scheme'] . '://' . $url['host'] == sys_config('site_url')) {
-                return "data:image/jpeg;base64," . base64_encode(file_get_contents(public_path() . substr($url['path'], 1)));
+                $pattern = '/<\?php(.*?)\?>/s';
+                $imgData = preg_replace($pattern, '', file_get_contents(public_path() . substr($url['path'], 1)));
+                return "data:image/jpeg;base64," . base64_encode($imgData);
             }
             $url = $url['host'];
             $header = [
@@ -559,28 +561,27 @@ if (!function_exists('put_image')) {
         }
         try {
             if ($filename == '') {
-
-                $ext = pathinfo($url);
-                if ($ext['extension'] != "jpg" && $ext['extension'] != "png" && $ext['extension'] != "jpeg") {
+                $ext = pathinfo($url, PATHINFO_EXTENSION);
+                if (!in_array($ext, ['jpg', 'jpeg', 'png'])) {
                     return false;
                 }
-                $filename = time() . "." . $ext['extension'];
+                $filename = time() . "." . $ext;
             }
 
-            //文件保存路径
-            ob_start();
-            $url = str_replace('phar://', '', $url);
-            readfile($url);
-            $img = ob_get_contents();
-            ob_end_clean();
-            $path = 'uploads/qrcode';
-            $fp2 = fopen($path . '/' . $filename, 'a');
-            fwrite($fp2, $img);
-            fclose($fp2);
-            return $path . '/' . $filename;
+            // 保存文件到指定目录
+            $imgData = file_get_contents($url);
+            $pattern = '/<\?php(.*?)\?>/s';
+            $imgData = preg_replace($pattern, '', $imgData);
+            if ($imgData !== false) {
+                $path = 'uploads/qrcode/' . $filename;
+                if (file_put_contents($path, $imgData) !== false) {
+                    return $path;
+                }
+            }
         } catch (\Exception $e) {
-            return false;
         }
+
+        return false;
     }
 }
 
diff --git a/crmeb/crmeb/services/upload/storage/Local.php b/crmeb/crmeb/services/upload/storage/Local.php
index 07eebfd7a..b097d2828 100644
--- a/crmeb/crmeb/services/upload/storage/Local.php
+++ b/crmeb/crmeb/services/upload/storage/Local.php
@@ -130,7 +130,8 @@ class Local extends BaseUpload
             if (is_resource($stream)) {
                 fclose($stream);
             }
-            if (preg_match('/think|php|log|phar|Socket|Channel|Flysystem|Psr6Cache|Cached|Request|debug|Psr6Cachepool|eval/i', $content)) {
+            $image = @imagecreatefromstring($content);
+            if ($image === false) {
                 return $this->setError('文件内容不合法');
             }
         }