* fix function can rce

2022-10-17 10:28:26 +08:00
parent ce56365e07
commit f01a04b242
1 changed files with 5 additions and 0 deletions
@@ -788,6 +788,11 @@ EOT;
    public function debug($filePath, $action)
    {
        $filePath = helper::safe64Decode($filePath);
+        $fileBasePath = realpath(dirname($filePath));
+        if(strpos($fileBasePath, $this->app->appRoot . 'module') !== 0 && strpos($fileBasePath, $this->app->appRoot . 'extension') !== 0)
+        {
+            return;
+        }
        if($action == 'extendModel')
        {
            $method = $this->api->getMethod($filePath, 'Model');