From 33c0688b012842e90d15c6b8cbd8d1c10ef94f76 Mon Sep 17 00:00:00 2001 From: sunhao Date: Tue, 6 Jan 2026 10:18:36 +0800 Subject: [PATCH 1/2] * [misc] fix compare miniprogram status not work. --- module/ai/control.php | 2 +- module/ai/model.php | 10 +++++----- module/aiapp/control.php | 2 +- module/aiapp/ui/browseminiprogram.html.php | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/module/ai/control.php b/module/ai/control.php index 8a6bdeb614..51147ea4cb 100644 --- a/module/ai/control.php +++ b/module/ai/control.php @@ -82,7 +82,7 @@ class ai extends control $program->canPublish = empty($program->published) && $this->ai->canPublishMiniProgram($program); $program->createdByLabel = $program->createdBy === 'system' ? $this->lang->admin->system : $this->loadModel('user')->getById($program->createdBy, 'account')->realname; $program->categoryLabel = $categoryList[$program->category]; - $program->publishedLabel = $program->published === '1' + $program->publishedLabel = $program->published == '1' ? $this->lang->ai->miniPrograms->statuses['active'] : $this->lang->ai->miniPrograms->statuses['draft']; } diff --git a/module/ai/model.php b/module/ai/model.php index 5c737d5c18..d04852a31f 100644 --- a/module/ai/model.php +++ b/module/ai/model.php @@ -72,8 +72,8 @@ class aiModel extends model if(in_array($this->app->rawMethod, array('miniprograms', 'miniprogramview'))) { - $isPublished = $object->published === '1'; - $isBuiltIn = $object->builtIn === '1'; + $isPublished = $object->published == '1'; + $isBuiltIn = $object->builtIn == '1'; if($action == 'editminiprogram') return common::hasPriv('ai', 'editMiniProgram') && !$isPublished && !$isBuiltIn; if($action == 'testminiprogram') return common::hasPriv('ai', 'testMiniProgram') && !$isPublished && !$isBuiltIn; @@ -1322,7 +1322,7 @@ class aiModel extends model { $data = new stdClass(); $data->published = $published; - if($published === '1') + if($published == '1') { $data->publishedDate = helper::now(); $miniProgram = $this->getMiniProgramByID($appID); @@ -1337,7 +1337,7 @@ class aiModel extends model ->where('id')->eq($appID) ->exec(); - $this->loadModel('action')->create('miniProgram', $appID, $published === '1' ? 'published' : 'unpublished'); + $this->loadModel('action')->create('miniProgram', $appID, $published == '1' ? 'published' : 'unpublished'); if($published !== '1') $this->collectMiniProgram(null, $appID, 'true'); return !dao::isError(); @@ -1412,7 +1412,7 @@ class aiModel extends model if(!isset($data->createdBy)) $data->createdBy = $this->app->user->account; if(!isset($data->createdDate)) $data->createdDate = helper::now(); if(!isset($data->prompt)) $data->prompt = $this->lang->ai->miniPrograms->field->default[3]; - if($data->published === '1') $data->publishedDate = helper::now(); + if($data->published == '1') $data->publishedDate = helper::now(); $data->builtIn = '0'; if(!empty($data->iconName) && !empty($data->iconTheme)) diff --git a/module/aiapp/control.php b/module/aiapp/control.php index c31c7ecdd5..5b0a4be857 100644 --- a/module/aiapp/control.php +++ b/module/aiapp/control.php @@ -71,7 +71,7 @@ class aiapp extends control $miniProgram = $this->ai->getMiniProgramByID($id); if(empty($miniProgram)) return $this->send(array('result' => 'fail', 'load' => array('alert' => $this->lang->aiapp->noMiniProgram, 'locate' => $this->createLink('aiapp', 'square')))); - if($miniProgram->published === '0' && $this->post->test !== '1') return $this->send(array('result' => 'fail', 'message' => $this->lang->aiapp->unpublishedTip, 'reason' => 'unpublished')); + if($miniProgram->published == '0' && $this->post->test !== '1') return $this->send(array('result' => 'fail', 'message' => $this->lang->aiapp->unpublishedTip, 'reason' => 'unpublished')); $history = $this->post->history; $message = $this->post->message; diff --git a/module/aiapp/ui/browseminiprogram.html.php b/module/aiapp/ui/browseminiprogram.html.php index 62cde17e87..ebba4406c5 100644 --- a/module/aiapp/ui/browseminiprogram.html.php +++ b/module/aiapp/ui/browseminiprogram.html.php @@ -13,7 +13,7 @@ jsVar('prompt', $miniProgram->prompt); jsVar('knowledgeLibs', $miniProgram->knowledgeLib); jsVar('postLink', createLink('aiapp', 'miniProgramChat', "id={$miniProgram->id}")); jsVar('messages', $messages); -jsVar('isAppDisabled', $miniProgram->published === '0'); +jsVar('isAppDisabled', $miniProgram->published == '0'); jsVar('pathname', $miniProgram->name); $app->loadLang('ai'); From 4f9b38c459e65b1aba11a4d1da84da3381d1554c Mon Sep 17 00:00:00 2001 From: sunhao Date: Tue, 6 Jan 2026 10:24:52 +0800 Subject: [PATCH 2/2] * [misc] enhance ZT app zip extraction to prevent directory traversal vulnerabilities. --- module/ai/control.php | 8 -------- module/ai/model.php | 17 +++++++++++++++-- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/module/ai/control.php b/module/ai/control.php index 51147ea4cb..a9b986b7a5 100644 --- a/module/ai/control.php +++ b/module/ai/control.php @@ -180,14 +180,6 @@ class ai extends control $content = file_get_contents($fileName); unlink($fileName); - if(!empty($content) && strpos($content, 'send($failResponse); - - $content = rtrim(substr($content, $pos + strlen("\$ztApp = '")), "';"); - } if(empty($content)) return $this->send($failResponse); $ztApp = json_decode($content); diff --git a/module/ai/model.php b/module/ai/model.php index d04852a31f..057d8f2f3b 100644 --- a/module/ai/model.php +++ b/module/ai/model.php @@ -1468,11 +1468,24 @@ class aiModel extends model return $appID; } + /** + * Extract ZT app zip file, only extract ztapp.json file. + * + * @param string $file + * @access public + * @return bool + */ public function extractZtAppZip($file) { $this->app->loadClass('pclzip', true); - $zip = new pclzip($file); - return $zip->extract(PCLZIP_OPT_PATH, $this->app->getAppRoot() . 'tmp/'); + + $zip = new pclzip($file); + $filePath = $this->app->getAppRoot() . 'tmp/'; + + /* 限制解压的文件内容以阻止 ZIP 解压缩的目录穿越漏洞。*/ + /* Limit the file content to prevent the directory traversal vulnerability of ZIP decompression. */ + $extractFiles = array('ztapp.json'); + return $zip->extract(PCLZIP_OPT_PATH, $filePath, PCLZIP_OPT_BY_NAME, $extractFiles, PCLZIP_OPT_REMOVE_PATH, ''); } /**