Merge branch 'master' of https://gitee.com/ZhongBangKeJi/CRMEB

README.md

@@ -1,6 +1,6 @@
 
 <div align="center" >
-    <img src="https://images.gitee.com/uploads/images/2021/1109/164354_0aafe3d2_892944.gif" />
+    <img src="https://www.crmeb.com/static/images/dark_logo.png" />
 </div>
 <div align="center">
 
@@ -13,7 +13,7 @@ CRMEB开源商城系统PHP版
         <img src="https://img.shields.io/badge/Licence-apache2.0-green.svg?style=flat" />
     </a>
     <a href="http://www.crmeb.com">
-        <img src="https://img.shields.io/badge/Edition-5.2-blue.svg" />
+        <img src="https://img.shields.io/badge/Edition-5.4-blue.svg" />
     </a>
      <a href="https://gitee.com/ZhongBangKeJi/CRMEB/repository/archive/master.zip">
         <img src="https://img.shields.io/badge/Download-240m-red.svg" />
@@ -45,7 +45,7 @@ CRMEB开源商城系统PHP版
 ### 📋 更新说明
 
 
-点击查看<a href="https://doc.crmeb.com/single/v53/12202" target="_blank">更新记录</a>
+点击查看<a href="https://doc.crmeb.com/single/v54/14013" target="_blank">更新记录</a>
 
 
 ### 用心做开源，我们也很需要你的鼓励！右上角Star🌟，等你点亮！

crmeb/app/Request.php

@@ -34,7 +34,7 @@ class Request extends \think\Request
      * @var array
      */
     protected $except = ['menu_path', 'api_url', 'unique_auth',
-                         'description', 'custom_form', 'content', 'tableField', 'url', 'customCode'];
+        'description', 'custom_form', 'content', 'tableField', 'url', 'customCode', 'value', 'refund_reason_wap_img'];
 
     /**
      * 获取请求的数据
@@ -83,8 +83,8 @@ class Request extends \think\Request
         $result = [];
         foreach ($array as $key => $value) {
             if (is_array($value)) {
-                // 如果值是数组，递归调用 filterArrayValues
-                $result[$key] = $this->filterArrayValues($value);
+                // 如果值是数组，并且不在不过滤变量名里面，递归调用 filterArrayValues，否则直接赋值
+                $result[$key] = in_array($key, $this->except) ? $value : $this->filterArrayValues($value);
             } else {
                 if (in_array($key, $this->except) || is_int($value) || is_null($value)) {
                     $result[$key] = $value;

crmeb/app/adminapi/controller/v1/setting/SystemConfig.php

@@ -376,6 +376,9 @@ class SystemConfig extends AuthController
         if (isset($post['refund_time_available'])) {
             if (!ctype_digit($post['refund_time_available'])) return app('json')->fail('售后期限必须为大于0的整数');
         }
+        if (isset($post['param_filter_data'])) {
+            $post['param_filter_data'] = base64_encode($post['param_filter_data']);
+        }
         if (isset($post['sms_save_type']) && sys_config('sms_account', '') != '') return app('json')->success(100001);
         foreach ($post as $k => $v) {
             $config_one = $this->services->getOne(['menu_name' => $k]);

crmeb/app/common.php

@@ -623,29 +623,7 @@ if (!function_exists('filter_str')) {
      */
     function filter_str($str)
     {
-        $rules = [
-            '/\.\./', // 禁用包含 ../ 的参数
-            '/\<\?/', // 禁止 php 脚本出现
-            '/\bor\b.*=.*/i', // 匹配 'or 1=1'，防止 SQL 注入（注意边界词 \b 和不区分大小写 i 修饰符）
-            '/(select[\s\S]*?)(from|limit)/i', // 防止 SQL 注入
-            '/(union[\s\S]*?select)/i', // 防止 SQL 注入
-            '/(having|updatexml|extractvalue)/i', // 防止 SQL 注入
-            '/sleep\((\s*)(\d*)(\s*)\)/i', // 防止 SQL 盲注
-            '/benchmark\((.*)\,(.*)\)/i', // 防止 SQL 盲注
-            '/base64_decode\(/i', // 防止 SQL 变种注入
-            '/(?:from\W+information_schema\W)/i', // 注意这里的 (?:...) 是不合法的，应该是 (?:...) 表示非捕获组，但通常我们不需要这个
-            '/(?:current_|user|database|schema|connection_id)\s*\(/i', // 防止 SQL 注入（注意去掉了不必要的 (?:...)）
-            '/(?:etc\/\W*passwd)/i', // 防止窥探 Linux 用户信息
-            '/into(\s+)(?:dump|out)file\s*/i', // 禁用 MySQL 导出函数
-            '/group\s+by.+\(/i', // 防止 SQL 注入
-            '/(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(/i', // 禁用 webshell 相关某些函数
-            '/(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/\//i', // 防止一些协议攻击（注意协议后的三个斜杠）
-            '/\$_(GET|POST|COOKIE|FILES|SESSION|ENV|GLOBALS|SERVER)\[/i', // 禁用一些内置变量，注意 PHP 变量名通常是大写的
-            '/<(iframe|script|body|img|layer|div|meta|style|base|object|input)/i', // 防止 XSS 标签植入
-            '/(onmouseover|onerror|onload|onclick)\=/i', // 防止 XSS 事件植入
-            '/\|\|.*?(?:ls|pwd|whoami|ll|ifconfig|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv)/i', // 防止执行 shell（注意去掉了不合适的 ifconfog）
-            '/\sand\s+.*=.*/i' // 匹配 and 1=1
-        ];
+        $rules = preg_split('/\r\n|\r|\n/', base64_decode(sys_config('param_filter_data')));
         if (filter_var($str, FILTER_VALIDATE_URL)) {
             $url = parse_url($str);
             if (!isset($url['scheme'])) return $str;

crmeb/app/services/system/config/SystemConfigServices.php

@@ -475,6 +475,9 @@ class SystemConfigServices extends BaseServices
     public function createTextareaForm(array $data)
     {
         $data['value'] = json_decode($data['value'], true) ?: '';
+        if ($data['menu_name'] == 'param_filter_data') {
+            $data['value'] = base64_decode($data['value']);
+        }
         $formbuider[] = $this->builder->textarea($data['menu_name'], $data['info'], $data['value'])->placeholder($data['desc'])->appendRule('suffix', [
             'type' => 'div',
             'class' => 'tips-info',

crmeb/public/admin/manifest.json

@@ -0,0 +1,13 @@
+{
+    "name":"CRMEB",
+    "display":"standalone",
+    "start_url":".",
+    "id": "index.html",
+    "background_color": "#999",
+    "theme_color":"#292d3e",
+    "icons":[{
+        "src":"./image/logo-small.png",
+        "sizes":"144x144",
+        "type":"image/png"
+    }]
+}

crmeb/public/admin/system_static/css/chunk-220d5f0c.7189a375.css

@@ -1 +1 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}.tabBox_img[data-v-24185938]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-24185938]{width:100%;height:100%}
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}.tabBox_img[data-v-24185938]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-24185938]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-058ebaa7.5e984949.css

@@ -1 +0,0 @@
-.tabBox_img[data-v-6fd5f7be]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-6fd5f7be]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-06c68f0e.89adb531.css

@@ -1 +0,0 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}

crmeb/public/admin/system_static/css/chunk-382f72c1.b527f323.css

@@ -1 +1 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}.tabBox_img[data-v-781431f4]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-781431f4]{width:100%;height:100%}
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}.tabBox_img[data-v-781431f4]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-781431f4]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-2fcc8f66.89adb531.css

@@ -1 +0,0 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}

crmeb/public/admin/system_static/css/chunk-5f6ae354.efbc7041.css

@@ -0,0 +1 @@
+.tabBox_img[data-v-7a609c5c]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-7a609c5c]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-692a19d0.d6f9eedf.css

@@ -0,0 +1 @@
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}

crmeb/public/admin/system_static/css/chunk-e27eaf76.6efb7d40.css

@@ -1 +1 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}.ivu-col:first-of-type .ivu-form-item .ivu-form-item-label[data-v-2c390a00]{width:80px!important}.ivu-col:first-of-type .ivu-form-item .ivu-form-item-content[data-v-2c390a00]{margin-left:80px!important}
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}.ivu-col:first-of-type .ivu-form-item .ivu-form-item-label[data-v-2c390a00]{width:80px!important}.ivu-col:first-of-type .ivu-form-item .ivu-form-item-content[data-v-2c390a00]{margin-left:80px!important}

crmeb/public/admin/system_static/css/chunk-7399ecb2.1343aed9.css

@@ -1 +0,0 @@
-.tabBox_img[data-v-6d97d57c]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-6d97d57c]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-a683c752.d6f9eedf.css

@@ -0,0 +1 @@
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}

crmeb/public/admin/system_static/css/chunk-b830c552.d0bb178d.css

@@ -0,0 +1 @@
+.tabBox_img[data-v-15383b5d]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-15383b5d]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-bda448c4.e6b04cac.css

@@ -1 +0,0 @@
-.tabBox_img[data-v-4c6dbf39]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-4c6dbf39]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-8342e1c8.51a850d6.css

@@ -1 +1 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}.treeSel[data-v-3c7d70bf] .ivu-select-dropdown-list{padding:0 10px!important;-webkit-box-sizing:border-box;box-sizing:border-box}.tabBox_img[data-v-3c7d70bf]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-3c7d70bf]{width:100%;height:100%}
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}.treeSel[data-v-3c7d70bf] .ivu-select-dropdown-list{padding:0 10px!important;-webkit-box-sizing:border-box;box-sizing:border-box}.tabBox_img[data-v-3c7d70bf]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-3c7d70bf]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-d7f8e48a.6990582a.css

@@ -0,0 +1 @@
+.tabBox_img[data-v-03e30d93]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-03e30d93]{width:100%;height:100%}

crmeb/public/admin/system_static/css/chunk-99578034.2ada99d5.css

@@ -1 +1 @@
-.radio[data-v-35556d70]{margin-bottom:14px}.radio[data-v-35556d70] .name{width:125px;text-align:right;padding-right:12px}.tabBox_img[data-v-4cb04f9c]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-4cb04f9c]{width:100%;height:100%}
+.radio[data-v-a5730e36]{margin-bottom:14px}.radio[data-v-a5730e36] .name{width:125px;text-align:right;padding-right:12px}.tabBox_img[data-v-4cb04f9c]{width:36px;height:36px;border-radius:4px;cursor:pointer}.tabBox_img img[data-v-4cb04f9c]{width:100%;height:100%}