From 4880972d77b9c0fc3b25349cb03902913d33e9c6 Mon Sep 17 00:00:00 2001 From: HFO4 <912394456@qq.com> Date: Mon, 11 Mar 2019 18:11:19 +0800 Subject: [PATCH] Feat: Referer check --- application/index/controller/Share.php | 46 +++++- application/index/model/Avatar.php | 2 +- application/index/view/home/album.html | 82 ----------- application/index/view/home/home.html | 6 +- application/index/view/share/share_dir.html | 9 +- application/index/view/share/share_lock.html | 131 +++++++++++------- .../index/view/share/share_lock_old.html | 53 +++++++ mysql.sql | 5 +- 8 files changed, 186 insertions(+), 148 deletions(-) delete mode 100644 application/index/view/home/album.html create mode 100644 application/index/view/share/share_lock_old.html diff --git a/application/index/controller/Share.php b/application/index/controller/Share.php index f373275f..f35f5534 100644 --- a/application/index/controller/Share.php +++ b/application/index/controller/Share.php @@ -16,7 +16,7 @@ class Share extends Controller{ public function _initialize(){ $this->userObj = new User(cookie('user_id'),cookie('login_key')); - $this->siteOptions = Option::getValues(["basic"]); + $this->siteOptions = Option::getValues(["basic","share"]); } public function index(){ @@ -54,12 +54,12 @@ class Share extends Controller{ } }else{ return view('share_lock', [ - 'options' => Option::getValues(['basic','share']), + 'options' => Option::getValues(['basic','share'],$this->userObj->userSQLData), 'userInfo' => $shareObj->shareOwner->userSQLData, 'fileData' => $shareObj->fileData, 'shareData' => $shareObj->shareData, 'loginStatus' => $this->userObj->loginStatus, - 'userData' => $this->userObj->userSQLData, + 'userData' => $this->userObj->getInfo(), 'pwd' => input("?get.pwd") ? input("get.pwd") : "", ]); } @@ -74,6 +74,12 @@ class Share extends Controller{ public function Download(){ $shareId = input('param.key'); $filePath = input('get.path'); + if($this->siteOptions["refererCheck"]=="true"){ + $check = $this->referCheck(); + if(!$check){ + $this->error("来源非法",403,$this->siteOptions); + } + } $shareObj = new ShareHandler($shareId,false); if(empty($filePath)){ $DownloadHandler = $shareObj->Download($this->userObj); @@ -90,6 +96,12 @@ class Share extends Controller{ public function Content(){ $shareId = input('param.key'); $filePath = input('get.path'); + if($this->siteOptions["refererCheck"]=="true"){ + $check = $this->referCheck(); + if(!$check){ + $this->error("来源非法",403,$this->siteOptions); + } + } $shareObj = new ShareHandler($shareId,false); if(empty($filePath)){ $contentHandller = $shareObj->getContent($this->userObj,$filePath,false); @@ -111,12 +123,26 @@ class Share extends Controller{ "msg" => "分享不存在" ); } - return $shareObj->checkPwd($inputPwd); + return json($shareObj->checkPwd($inputPwd)); + } + + private function referCheck(){ + $agent = Request::instance()->header('referer'); + if(substr($agent, 0, strlen($this->siteOptions["siteURL"])) !== $this->siteOptions["siteURL"]){ + return false; + } + return true; } public function Preview(){ $shareId = input('param.key'); $filePath = input('get.path'); + if($this->siteOptions["refererCheck"]=="true"){ + $check = $this->referCheck(); + if(!$check){ + $this->error("来源非法",403,$this->siteOptions); + } + } $shareObj = new ShareHandler($shareId,false); if(empty($filePath)){ $previewHandler = $shareObj->Preview($this->userObj); @@ -154,6 +180,12 @@ class Share extends Controller{ if(input("get.isImg") != "true"){ return ""; } + if($this->siteOptions["refererCheck"]=="true"){ + $check = $this->referCheck(); + if(!$check){ + $this->error("来源非法",403,$this->siteOptions); + } + } $shareObj = new ShareHandler($shareId,false); $Redirect = $shareObj->getThumb($this->userObj,$filePath); if($Redirect[0]){ @@ -166,6 +198,12 @@ class Share extends Controller{ public function DocPreview(){ $shareId = input('param.key'); $filePath = urldecode(input('get.path')); + if($this->siteOptions["refererCheck"]=="true"){ + $check = $this->referCheck(); + if(!$check){ + $this->error("来源非法",403,$this->siteOptions); + } + } $shareObj = new ShareHandler($shareId,false); if(empty($filePath)){ $Redirect = $shareObj->getDocPreview($this->userObj,$filePath,false); diff --git a/application/index/model/Avatar.php b/application/index/model/Avatar.php index 2eee3cbb..c889fb34 100644 --- a/application/index/model/Avatar.php +++ b/application/index/model/Avatar.php @@ -20,7 +20,7 @@ class Avatar extends Model{ if(!$new){ $userData = Db::name("users")->where('id',$obj)->find(); $this->userData = $userData; - if($userData["avatar"] == "default"){ + if(empty($userData)||$userData["avatar"] == "default"){ $this->avatarType = "default"; }else{ $avatarPrarm = explode(".",$userData["avatar"]); diff --git a/application/index/view/home/album.html b/application/index/view/home/album.html deleted file mode 100644 index d414ee4f..00000000 --- a/application/index/view/home/album.html +++ /dev/null @@ -1,82 +0,0 @@ - - - - - 图片集 - {$options.siteName} - - - - - - - - - - - - - -
- - -
- {volist name='list' id='pic'} -
- -

{$pic.orign_name}

- -
- {/volist} -
- - - - - - -
- - - - - - - - - -{$options.js_code} - - \ No newline at end of file diff --git a/application/index/view/home/home.html b/application/index/view/home/home.html index 5b44fc39..9e532817 100644 --- a/application/index/view/home/home.html +++ b/application/index/view/home/home.html @@ -79,10 +79,10 @@ - - - + + + diff --git a/application/index/view/share/share_dir.html b/application/index/view/share/share_dir.html index 251c4745..05f9714d 100644 --- a/application/index/view/share/share_dir.html +++ b/application/index/view/share/share_dir.html @@ -90,11 +90,12 @@ --> - - + + + + - - + diff --git a/application/index/view/share/share_lock.html b/application/index/view/share/share_lock.html index 1beafaa3..00006e09 100644 --- a/application/index/view/share/share_lock.html +++ b/application/index/view/share/share_lock.html @@ -1,53 +1,80 @@ -{extend name="header_public" /} -{block name="title"}私密分享 - {$options.siteName}{/block} -{block name="content"} - - - - - -