From cb40696190d69efd95df055abbd330ab2cb72008 Mon Sep 17 00:00:00 2001
From: zhujinyong <vimrus.com@gmail.com>
Date: Tue, 10 Aug 2021 14:02:41 +0800
Subject: [PATCH] * Enable CSRF protection by default.

---
 config/config.php               | 2 +-
 framework/base/router.class.php | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/config.php b/config/config.php
index c40431462b..a22a58ecc6 100644
--- a/config/config.php
+++ b/config/config.php
@@ -109,7 +109,7 @@ $config->framework->purifier        = true;  // 是否对数据做purifier处理
 $config->framework->logDays         = 14;    // 日志文件保存的天数。              The days to save log files.
 $config->framework->autoRepairTable = true;
 $config->framework->autoLang        = false;
-$config->framework->filterCSRF      = false;
+$config->framework->filterCSRF      = true;
 $config->framework->setCookieSecure = true;
 $config->framework->sendXCTO        = true;   // Send X-Content-Type-Options header.
 $config->framework->sendXXP         = true;   // Send X-XSS-Protection header.
diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index 9bfa2a08c4..0ee006df6f 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -610,7 +610,8 @@ class baseRouter
         {
             $httpType = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on') ? 'https' : 'http';
             $httpHost = $_SERVER['HTTP_HOST'];
-            if((!defined('RUN_MODE') or RUN_MODE != 'api') and strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $_FILES = $_POST = array();
+            $isAPI    = (defined('RUN_MODE') && RUN_MODE == 'api') || isset($_GET[$this->config->sessionVar]);
+            if(!$isAPI && strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $_FILES = $_POST = array();
         }
 
         $_FILES  = validater::filterFiles();