Merge branch 'liyuchun_fixbug_22074'

module/install/control.php

@@ -93,6 +93,18 @@ class install extends control
             $this->view->sessionInfo   = $sessionInfo;
         }
 
+        $notice = '';
+        if($this->config->framework->filterCSRF)
+        {
+            $httpType = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on') ? 'https' : 'http';
+            if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) and strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == 'https') $httpType = 'https';
+            if(isset($_SERVER['REQUEST_SCHEME']) and strtolower($_SERVER['REQUEST_SCHEME']) == 'https') $httpType = 'https';
+
+            $httpHost = zget($_SERVER, 'HTTP_HOST', '');
+            if(empty($httpHost) or strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $notice = $this->lang->install->CSRFNotice;
+        }
+
+        $this->view->notice = $notice;
         $this->display();
     }
 

module/install/css/common.css

@@ -3,6 +3,7 @@ body {background: #f1f1f1;}
 .modal-dialog {width: 100%; margin-top: 20px;}
 .modal-footer {text-align: center; margin-top: 0;}
 .w-350px {width: 350px;}
+.text-notice {padding-left: 20px; padding-bottom: 20px;}
 
 .table,.alert {margin: 0;}
 .table+.alert {margin-top: 20px;}

module/install/lang/en.php

@@ -153,6 +153,9 @@ $lang->install->save2File          = '<div class="alert alert-warning">Copy the
 $lang->install->saved2File         = 'The configuration file has been saved to " <strong>%s</strong> ". You can change this file later.';
 $lang->install->errorNotSaveConfig = 'The configuration file is not saved.';
 
+global $app;
+$lang->install->CSRFNotice = "CSRF defense has been enabled in the system. If you don't need it, contact the administrator to disable it manually in the {$app->moduleRoot}config/config.php file.";
+
 $lang->install->getPriv            = 'Set Admin';
 $lang->install->company            = 'Company Name';
 $lang->install->account            = 'Admin Account';

module/install/lang/zh-cn.php

@@ -153,6 +153,9 @@ $lang->install->save2File          = '<div class="alert alert-warning">拷贝上
 $lang->install->saved2File         = '配置信息已经成功保存到" <strong>%s</strong> "中。您后面还可继续修改此文件。';
 $lang->install->errorNotSaveConfig = '还没有保存配置文件';
 
+global $app;
+$lang->install->CSRFNotice = "系统已开启了CSRF的防御，如需关闭，请联系管理员到{$app->moduleRoot}config/config.php文件中手动关闭。";
+
 $lang->install->getPriv            = '设置帐号';
 $lang->install->company            = '公司名称';
 $lang->install->account            = '管理员帐号';

module/install/view/step1.html.php

@@ -95,7 +95,7 @@
           </td>
           <td class='<?php echo $tmpRootResult;?>'><?php echo $lang->install->$tmpRootResult;?></td>
           <td class='text-left f-12px'>
-            <?php 
+            <?php
             if(!$tmpRootInfo['exists'])   printf($mkdir, $tmpRootInfo['path'], $tmpRootInfo['path']);
             if(!$tmpRootInfo['writable']) printf($chmod, $tmpRootInfo['path'], $tmpRootInfo['path']);
             ?>
@@ -111,7 +111,7 @@
           </td>
           <td class='<?php echo $dataRootResult;?>'><?php echo $lang->install->$dataRootResult;?></td>
           <td class='text-left f-12px'>
-            <?php 
+            <?php
             if(!$dataRootInfo['exists'])   printf($mkdir, $dataRootInfo['path'], $dataRootInfo['path']);
             if(!$dataRootInfo['writable']) printf($chmod, $dataRootInfo['path'], $dataRootInfo['path']);
             ?>
@@ -137,6 +137,9 @@
         <?php endif;?>
       </table>
     </div>
+    <?php if($notice):?>
+    <div class='text-danger text-notice'><?php echo $notice;?></div>
+    <?php endif;?>
     <div class='modal-footer'>
       <?php
       if($phpResult      == 'ok' and