From f01a04b2426b1cb444dde36112f7050b86df7c99 Mon Sep 17 00:00:00 2001
From: chaideqing <chaideqing@easycorp.ltd>
Date: Mon, 17 Oct 2022 10:28:26 +0800
Subject: [PATCH] * fix function can rce

---
 module/api/control.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/module/api/control.php b/module/api/control.php
index df74573805..aa07920b29 100755
--- a/module/api/control.php
+++ b/module/api/control.php
@@ -788,6 +788,11 @@ EOT;
     public function debug($filePath, $action)
     {
         $filePath = helper::safe64Decode($filePath);
+        $fileBasePath = realpath(dirname($filePath));
+        if(strpos($fileBasePath, $this->app->appRoot . 'module') !== 0 && strpos($fileBasePath, $this->app->appRoot . 'extension') !== 0)
+        {
+            return;
+        }
         if($action == 'extendModel')
         {
             $method = $this->api->getMethod($filePath, 'Model');