Merge branch release/21.7.8 of zentao/zentaopms (#13139)

module/ai/control.php

@@ -82,7 +82,7 @@ class ai extends control
             $program->canPublish     = empty($program->published) && $this->ai->canPublishMiniProgram($program);
             $program->createdByLabel = $program->createdBy === 'system' ? $this->lang->admin->system : $this->loadModel('user')->getById($program->createdBy, 'account')->realname;
             $program->categoryLabel  = $categoryList[$program->category];
-            $program->publishedLabel = $program->published === '1'
+            $program->publishedLabel = $program->published == '1'
                 ? $this->lang->ai->miniPrograms->statuses['active']
                 : $this->lang->ai->miniPrograms->statuses['draft'];
         }
@@ -180,14 +180,6 @@ class ai extends control
 
         $content = file_get_contents($fileName);
         unlink($fileName);
-        if(!empty($content) && strpos($content, '<?php') === 0)
-        {
-            $content = str_replace(['<?php', "\r", "\n"], '', $content);
-            $pos = strpos($content, "\$ztApp = '");
-            if($pos != 0) return $this->send($failResponse);
-
-            $content = rtrim(substr($content, $pos + strlen("\$ztApp = '")), "';");
-        }
         if(empty($content)) return $this->send($failResponse);
 
         $ztApp  = json_decode($content);

module/ai/model.php

@@ -72,8 +72,8 @@ class aiModel extends model
 
         if(in_array($this->app->rawMethod, array('miniprograms', 'miniprogramview')))
         {
-            $isPublished = $object->published === '1';
-            $isBuiltIn   = $object->builtIn === '1';
+            $isPublished = $object->published == '1';
+            $isBuiltIn   = $object->builtIn == '1';
 
             if($action == 'editminiprogram')      return common::hasPriv('ai', 'editMiniProgram') && !$isPublished && !$isBuiltIn;
             if($action == 'testminiprogram')      return common::hasPriv('ai', 'testMiniProgram') && !$isPublished && !$isBuiltIn;
@@ -1322,7 +1322,7 @@ class aiModel extends model
     {
         $data = new stdClass();
         $data->published = $published;
-        if($published === '1')
+        if($published == '1')
         {
             $data->publishedDate = helper::now();
             $miniProgram = $this->getMiniProgramByID($appID);
@@ -1337,7 +1337,7 @@ class aiModel extends model
             ->where('id')->eq($appID)
             ->exec();
 
-        $this->loadModel('action')->create('miniProgram', $appID, $published === '1' ? 'published' : 'unpublished');
+        $this->loadModel('action')->create('miniProgram', $appID, $published == '1' ? 'published' : 'unpublished');
 
         if($published !== '1') $this->collectMiniProgram(null, $appID, 'true');
         return !dao::isError();
@@ -1412,7 +1412,7 @@ class aiModel extends model
         if(!isset($data->createdBy))   $data->createdBy   = $this->app->user->account;
         if(!isset($data->createdDate)) $data->createdDate = helper::now();
         if(!isset($data->prompt))      $data->prompt      = $this->lang->ai->miniPrograms->field->default[3];
-        if($data->published === '1')   $data->publishedDate = helper::now();
+        if($data->published == '1')   $data->publishedDate = helper::now();
         $data->builtIn = '0';
 
         if(!empty($data->iconName) && !empty($data->iconTheme))
@@ -1468,11 +1468,24 @@ class aiModel extends model
         return $appID;
     }
 
+    /**
+     * Extract ZT app zip file, only extract ztapp.json file.
+     *
+     * @param string $file
+     * @access public
+     * @return bool
+     */
     public function extractZtAppZip($file)
     {
         $this->app->loadClass('pclzip', true);
-        $zip = new pclzip($file);
-        return $zip->extract(PCLZIP_OPT_PATH, $this->app->getAppRoot() . 'tmp/');
+
+        $zip      = new pclzip($file);
+        $filePath = $this->app->getAppRoot() . 'tmp/';
+
+        /* 限制解压的文件内容以阻止 ZIP 解压缩的目录穿越漏洞。*/
+        /* Limit the file content to prevent the directory traversal vulnerability of ZIP decompression. */
+        $extractFiles = array('ztapp.json');
+        return $zip->extract(PCLZIP_OPT_PATH, $filePath, PCLZIP_OPT_BY_NAME, $extractFiles, PCLZIP_OPT_REMOVE_PATH, '');
     }
 
     /**

module/aiapp/control.php

@@ -71,7 +71,7 @@ class aiapp extends control
 
         $miniProgram  = $this->ai->getMiniProgramByID($id);
         if(empty($miniProgram)) return $this->send(array('result' => 'fail', 'load' => array('alert' => $this->lang->aiapp->noMiniProgram, 'locate' => $this->createLink('aiapp', 'square'))));
-        if($miniProgram->published === '0' && $this->post->test !== '1') return $this->send(array('result' => 'fail', 'message' => $this->lang->aiapp->unpublishedTip, 'reason' => 'unpublished'));
+        if($miniProgram->published == '0' && $this->post->test !== '1') return $this->send(array('result' => 'fail', 'message' => $this->lang->aiapp->unpublishedTip, 'reason' => 'unpublished'));
 
         $history = $this->post->history;
         $message = $this->post->message;

module/aiapp/ui/browseminiprogram.html.php

@@ -13,7 +13,7 @@ jsVar('prompt', $miniProgram->prompt);
 jsVar('knowledgeLibs', $miniProgram->knowledgeLib);
 jsVar('postLink', createLink('aiapp', 'miniProgramChat', "id={$miniProgram->id}"));
 jsVar('messages', $messages);
-jsVar('isAppDisabled', $miniProgram->published === '0');
+jsVar('isAppDisabled', $miniProgram->published == '0');
 jsVar('pathname', $miniProgram->name);
 
 $app->loadLang('ai');