From db2116f3d35267454e0af2fdc7a999af8cc5c6a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E6=98=8A=E5=A4=A9?= <442384644@qq.com>
Date: Fri, 26 Aug 2022 09:55:29 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90=E7=A8=8B=E5=BA=8F=E7=9B=AE=E5=BD=95?=
 =?UTF-8?q?=E3=80=91image=5Fbase64=E5=A2=9E=E5=8A=A0=E6=95=B0=E6=8D=AE?=
 =?UTF-8?q?=E9=AA=8C=E8=AF=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crmeb/app/api/controller/v1/PublicController.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crmeb/app/api/controller/v1/PublicController.php b/crmeb/app/api/controller/v1/PublicController.php
index 5b3a6bb68..f635b277e 100644
--- a/crmeb/app/api/controller/v1/PublicController.php
+++ b/crmeb/app/api/controller/v1/PublicController.php
@@ -300,6 +300,9 @@ class PublicController
             ['image', ''],
             ['code', ''],
         ], true);
+        if (!preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $imageUrl) || !preg_match('/.*(\.png|\.jpg|\.jpeg|\.gif)$/', $codeUrl)) {
+            return app('json')->fail(100100);
+        }
         try {
             $code = CacheService::get($codeUrl, function () use ($codeUrl) {
                 $codeTmp = $code = $codeUrl ? image_to_base64($codeUrl) : false;