From b23b6f9acfc7fc18997287c5c2f58961ddc85b9f Mon Sep 17 00:00:00 2001
From: evoxwht <442384644@qq.com>
Date: Thu, 12 Oct 2023 16:02:05 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90=E7=A8=8B=E5=BA=8F=E7=9B=AE=E5=BD=95?=
 =?UTF-8?q?=E3=80=91=E6=9B=B4=E6=96=B0=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crmeb/app/api/controller/v1/PublicController.php     | 12 ++++++++----
 crmeb/app/services/system/log/SystemFileServices.php |  7 +++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/crmeb/app/api/controller/v1/PublicController.php b/crmeb/app/api/controller/v1/PublicController.php
index b4ef35c4c..739d9f679 100644
--- a/crmeb/app/api/controller/v1/PublicController.php
+++ b/crmeb/app/api/controller/v1/PublicController.php
@@ -307,10 +307,10 @@ class PublicController
             ['image', ''],
             ['code', ''],
         ], true);
-        if ($imageUrl !== '' && !preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $imageUrl) && strpos($imageUrl, "phar://") !== false) {
+        if ($imageUrl !== '' && !preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $imageUrl) && strpos(strtolower($imageUrl), "phar://") !== false) {
             return app('json')->success(['code' => false, 'image' => false]);
         }
-        if ($codeUrl !== '' && !(preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $codeUrl) || strpos($codeUrl, 'https://mp.weixin.qq.com/cgi-bin/showqrcode') !== false) && strpos($codeUrl, "phar://") !== false) {
+        if ($codeUrl !== '' && !(preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $codeUrl) || strpos($codeUrl, 'https://mp.weixin.qq.com/cgi-bin/showqrcode') !== false) && strpos(strtolower($codeUrl), "phar://") !== false) {
             return app('json')->success(['code' => false, 'image' => false]);
         }
         try {
@@ -319,7 +319,9 @@ class PublicController
                 if (!$codeTmp) {
                     $putCodeUrl = put_image($codeUrl);
                     $code = $putCodeUrl ? image_to_base64(app()->request->domain(true) . '/' . $putCodeUrl) : false;
-                    $code ?? unlink($_SERVER["DOCUMENT_ROOT"] . '/' . $putCodeUrl);
+                    if ($putCodeUrl) {
+                        unlink($_SERVER["DOCUMENT_ROOT"] . '/' . $putCodeUrl);
+                    }
                 }
                 return $code;
             });
@@ -328,7 +330,9 @@ class PublicController
                 if (!$imageTmp) {
                     $putImageUrl = put_image($imageUrl);
                     $image = $putImageUrl ? image_to_base64(app()->request->domain(true) . '/' . $putImageUrl) : false;
-                    $image ?? unlink($_SERVER["DOCUMENT_ROOT"] . '/' . $putImageUrl);
+                    if ($putImageUrl) {
+                        unlink($_SERVER["DOCUMENT_ROOT"] . '/' . $putImageUrl);
+                    }
                 }
                 return $image;
             });
diff --git a/crmeb/app/services/system/log/SystemFileServices.php b/crmeb/app/services/system/log/SystemFileServices.php
index cdf2755a1..2283e5816 100644
--- a/crmeb/app/services/system/log/SystemFileServices.php
+++ b/crmeb/app/services/system/log/SystemFileServices.php
@@ -310,6 +310,13 @@ class SystemFileServices extends BaseServices
     //读取文件
     public function openfile($filepath)
     {
+        //根目录
+        $rootDir = $this->formatPath(app()->getRootPath());
+        //防止查看站点以外的文件
+        if (strpos($filepath, $rootDir) === false || $filepath == '') {
+            throw new AdminException('无法打开站点以外的文件');
+        }
+
         $filepath = $this->formatPath($filepath);
         $content = FileClass::readFile($filepath);//防止页面内嵌textarea标签
         $ext = FileClass::getExt($filepath);