From 83fa4afc83a21afd8f07b9d68d5fa611dca3ef4f Mon Sep 17 00:00:00 2001
From: liyuchun <563917701@qq.com>
Date: Thu, 28 Apr 2022 09:02:44 +0000
Subject: [PATCH 1/2]  * Fix bug #17968.

---
 module/install/control.php         | 12 ++++++++++++
 module/install/css/common.css      |  1 +
 module/install/lang/en.php         |  3 +++
 module/install/lang/zh-cn.php      |  3 +++
 module/install/view/step1.html.php |  7 +++++--
 5 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/module/install/control.php b/module/install/control.php
index 6cff26c16d..8334068fc6 100644
--- a/module/install/control.php
+++ b/module/install/control.php
@@ -93,6 +93,18 @@ class install extends control
             $this->view->sessionInfo   = $sessionInfo;
         }
 
+        $notice = '';
+        if($this->config->framework->filterCSRF)
+        {
+            $httpType = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on') ? 'https' : 'http';
+            if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) and strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == 'https') $httpType = 'https';
+            if(isset($_SERVER['REQUEST_SCHEME']) and strtolower($_SERVER['REQUEST_SCHEME']) == 'https') $httpType = 'https';
+
+            $httpHost = zget($_SERVER, 'HTTP_HOST', '');
+            if(empty($httpHost) or strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $notice = $this->lang->install->CSRFNotice;
+        }
+
+        $this->view->notice = $notice;
         $this->display();
     }
 
diff --git a/module/install/css/common.css b/module/install/css/common.css
index 9d5cdec9ec..9d67a924d8 100644
--- a/module/install/css/common.css
+++ b/module/install/css/common.css
@@ -3,6 +3,7 @@ body {background: #f1f1f1;}
 .modal-dialog {width: 100%; margin-top: 20px;}
 .modal-footer {text-align: center; margin-top: 0;}
 .w-350px {width: 350px;}
+.text-notice {padding-left: 20px; padding-bottom: 20px;}
 
 .table,.alert {margin: 0;}
 .table+.alert {margin-top: 20px;}
diff --git a/module/install/lang/en.php b/module/install/lang/en.php
index bef83bd594..05fd01f835 100644
--- a/module/install/lang/en.php
+++ b/module/install/lang/en.php
@@ -153,6 +153,9 @@ $lang->install->save2File          = '<div class="alert alert-warning">Copy the
 $lang->install->saved2File         = 'The configuration file has been saved to " <strong>%s</strong> ". You can change this file later.';
 $lang->install->errorNotSaveConfig = 'The configuration file is not saved.';
 
+global $app;
+$lang->install->CSRFNotice = "CSRF defense has been enabled in the system. If you don't need it, contact the administrator to disable it manually in the {$app->moduleRoot}config/config.php file.";
+
 $lang->install->getPriv            = 'Set Admin';
 $lang->install->company            = 'Company Name';
 $lang->install->account            = 'Admin Account';
diff --git a/module/install/lang/zh-cn.php b/module/install/lang/zh-cn.php
index da1987dd8e..0830887beb 100644
--- a/module/install/lang/zh-cn.php
+++ b/module/install/lang/zh-cn.php
@@ -153,6 +153,9 @@ $lang->install->save2File          = '<div class="alert alert-warning">拷贝上
 $lang->install->saved2File         = '配置信息已经成功保存到" <strong>%s</strong> "中。您后面还可继续修改此文件。';
 $lang->install->errorNotSaveConfig = '还没有保存配置文件';
 
+global $app;
+$lang->install->CSRFNotice = "系统已开启了CSRF的防御，如需关闭，请联系管理员到{$app->moduleRoot}config/config.php文件中手动关闭。";
+
 $lang->install->getPriv            = '设置帐号';
 $lang->install->company            = '公司名称';
 $lang->install->account            = '管理员帐号';
diff --git a/module/install/view/step1.html.php b/module/install/view/step1.html.php
index 3d9e55e4cc..61233e3865 100644
--- a/module/install/view/step1.html.php
+++ b/module/install/view/step1.html.php
@@ -95,7 +95,7 @@
           </td>
           <td class='<?php echo $tmpRootResult;?>'><?php echo $lang->install->$tmpRootResult;?></td>
           <td class='text-left f-12px'>
-            <?php 
+            <?php
             if(!$tmpRootInfo['exists'])   printf($mkdir, $tmpRootInfo['path'], $tmpRootInfo['path']);
             if(!$tmpRootInfo['writable']) printf($chmod, $tmpRootInfo['path'], $tmpRootInfo['path']);
             ?>
@@ -111,7 +111,7 @@
           </td>
           <td class='<?php echo $dataRootResult;?>'><?php echo $lang->install->$dataRootResult;?></td>
           <td class='text-left f-12px'>
-            <?php 
+            <?php
             if(!$dataRootInfo['exists'])   printf($mkdir, $dataRootInfo['path'], $dataRootInfo['path']);
             if(!$dataRootInfo['writable']) printf($chmod, $dataRootInfo['path'], $dataRootInfo['path']);
             ?>
@@ -137,6 +137,9 @@
         <?php endif;?>
       </table>
     </div>
+    <?php if($notice):?>
+    <div class='text-danger text-notice'><?php echo $notice;?></div>
+    <?php endif;?>
     <div class='modal-footer'>
       <?php
       if($phpResult      == 'ok' and

From 5a6ea32f8efc58be776939a4bd5701667da1af74 Mon Sep 17 00:00:00 2001
From: liyuchun <563917701@qq.com>
Date: Thu, 28 Apr 2022 09:09:08 +0000
Subject: [PATCH 2/2]  * Fix error.

---
 lib/filter/filter.class.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/filter/filter.class.php b/lib/filter/filter.class.php
index f4e9980630..2f44b2df3a 100644
--- a/lib/filter/filter.class.php
+++ b/lib/filter/filter.class.php
@@ -101,6 +101,11 @@ class fixer extends baseFixer
      * @return object
      */
     public function filterEmoji($value){
+        if(is_object($value) or is_array($value))
+        {
+            foreach($value as $subValue) $this->filterEmoji($subValue);
+        }
+
         $value = preg_replace_callback('/./u', function (array $match)
         {
             return strlen($match[0]) >= 4 ? '' : $match[0];