From ee1afb43ed382c53a6d2e0b149589257e3bb382c Mon Sep 17 00:00:00 2001 From: wangyidong Date: Mon, 14 Oct 2019 17:33:52 +0800 Subject: [PATCH 01/26] * code for task #6411. --- module/editor/control.php | 9 +++++++++ module/editor/model.php | 5 +++++ 2 files changed, 14 insertions(+) diff --git a/module/editor/control.php b/module/editor/control.php index b391fbb5db..1f8623d650 100644 --- a/module/editor/control.php +++ b/module/editor/control.php @@ -11,6 +11,15 @@ */ class editor extends control { + /** + * Construct + * + * @param string $moduleName + * @param string $methodName + * @param string $appName + * @access public + * @return void + */ public function __construct($moduleName = '', $methodName = '', $appName = '') { parent::__construct($moduleName, $methodName, $appName); diff --git a/module/editor/model.php b/module/editor/model.php index dc1b2621d1..56f8f4ab00 100644 --- a/module/editor/model.php +++ b/module/editor/model.php @@ -365,6 +365,11 @@ class editorModel extends model */ public function save($filePath) { + $statusFile = $this->loadModel('upgrade')->checkSafeFile(); + if($statusFile) die(js::alert(sprintf($this->lang->editor->noticeOkFile, str_replace('\\', '/', $statusFile)))); + + if(strpos(strtolower($filePath), strtolower($this->app->getBasePath())) !== 0) die(js::alert($this->lang->editor->editFileError)); + $fileContent = $this->post->fileContent; $evils = array('eval', 'exec', 'passthru', 'proc_open', 'shell_exec', 'system', '$$', 'include', 'require', 'assert'); $gibbedEvils = array('e v a l', 'e x e c', ' p a s s t h r u', ' p r o c _ o p e n', 's h e l l _ e x e c', 's y s t e m', '$ $', 'i n c l u d e', 'r e q u i r e', 'a s s e r t'); From 7bb1662f9ef45ab4836c132670f49e65db423986 Mon Sep 17 00:00:00 2001 From: Yagami <976204163@qq.com> Date: Tue, 15 Oct 2019 10:52:57 +0800 Subject: [PATCH 02/26] * Code for task #6424. --- module/install/lang/zh-cn.php | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/module/install/lang/zh-cn.php b/module/install/lang/zh-cn.php index 233ca7007d..c9468ce9f6 100644 --- a/module/install/lang/zh-cn.php +++ b/module/install/lang/zh-cn.php @@ -223,10 +223,10 @@ $lang->install->ydisk->logo = 'images/main/ydisk.ico'; $lang->install->ydisk->url = 'http://www.ydisk.cn'; $lang->install->ydisk->desc = << -
  • 绝对私有,只部署在自己的机器上。
  • -
  • 海量存储,只取决于您的硬盘大小。
  • -
  • 极限传输,只取决于您的网络带宽。
  • -
  • 极度安全,十二种权限组合。
  • +
  • 绝对私有:只部署在自己的机器上
  • +
  • 海量存储:只取决于您的硬盘大小
  • +
  • 极限传输:只取决于您的网络带宽
  • +
  • 极度安全:十二种权限组合
  • EOD; @@ -236,9 +236,9 @@ $lang->install->meshiot->logo = 'images/main/meshiot.ico'; $lang->install->meshiot->url = 'https://www.meshiot.com'; $lang->install->meshiot->desc = << -
  • 超性能网关,一个就可管65536个设备。
  • -
  • 独创无线电通讯协议,2500米穿墙无障碍。
  • -
  • 200余款传感器控制器,独创调光系统。
  • -
  • 可配电池,对既有场地设备无任何要求。
  • +
  • 超性能网关,一个就可管65536个设备
  • +
  • 独创无线电通讯协议,2500米穿墙无障碍
  • +
  • 200余款传感器控制器,独创调光系统
  • +
  • 可配电池,对既有场地设备无任何要求
  • EOD; From ad14136ea76c601b6c573523e7776db0c783b9cc Mon Sep 17 00:00:00 2001 From: Yagami <976204163@qq.com> Date: Tue, 15 Oct 2019 11:09:43 +0800 Subject: [PATCH 03/26] * Finish task #6424. --- module/install/lang/zh-cn.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/module/install/lang/zh-cn.php b/module/install/lang/zh-cn.php index c9468ce9f6..e43cb88927 100644 --- a/module/install/lang/zh-cn.php +++ b/module/install/lang/zh-cn.php @@ -236,9 +236,9 @@ $lang->install->meshiot->logo = 'images/main/meshiot.ico'; $lang->install->meshiot->url = 'https://www.meshiot.com'; $lang->install->meshiot->desc = << -
  • 超性能网关,一个就可管65536个设备
  • -
  • 独创无线电通讯协议,2500米穿墙无障碍
  • -
  • 200余款传感器控制器,独创调光系统
  • -
  • 可配电池,对既有场地设备无任何要求
  • +
  • 超性能网关,一个可管6万个设备
  • +
  • 自研通讯协议,2.5公里穿墙无障碍
  • +
  • 上百款传感器控制器,独创调光系统
  • +
  • 可配电池,对既有场地无任何要求
  • EOD; From f522a796334867ec54c45c853a6af1a52ac27e07 Mon Sep 17 00:00:00 2001 From: wangyidong Date: Tue, 15 Oct 2019 11:23:31 +0800 Subject: [PATCH 04/26] * change for CSRF. --- framework/base/router.class.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/framework/base/router.class.php b/framework/base/router.class.php index 1ee6b029c6..c1354dd920 100644 --- a/framework/base/router.class.php +++ b/framework/base/router.class.php @@ -594,6 +594,11 @@ class baseRouter unset($GLOBALS); unset($_REQUEST); + /* Change for CSRF. */ + $httpType = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on') ? 'https' : 'http'; + $httpHost = $_SERVER['HTTP_HOST']; + if(strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $_FILES = $_POST = array(); + $_FILES = validater::filterFiles(); $_POST = validater::filterSuper($_POST); $_GET = validater::filterSuper($_GET); From 1e3564a250ed68b7e49a267668a41a03258050fa Mon Sep 17 00:00:00 2001 From: wangyidong Date: Tue, 15 Oct 2019 11:24:50 +0800 Subject: [PATCH 05/26] * finish task #6409. --- module/my/control.php | 1 + module/my/js/changepassword.js | 25 +++++++++++++++++++++++++ module/my/js/editprofile.js | 18 +++++++++++++++++- module/my/view/changepassword.html.php | 2 ++ module/user/css/batchcreate.zh-cn.css | 2 +- module/user/css/batchcreate.zh-tw.css | 2 +- module/user/js/common.js | 5 ++++- module/user/js/create.js | 18 ++++++++++++++++++ module/user/js/edit.js | 17 +++++++++++++++++ module/user/model.php | 9 +++++---- 10 files changed, 91 insertions(+), 8 deletions(-) create mode 100644 module/my/js/changepassword.js create mode 100644 module/user/js/edit.js diff --git a/module/my/control.php b/module/my/control.php index a9559267ec..9bd379a8b0 100644 --- a/module/my/control.php +++ b/module/my/control.php @@ -399,6 +399,7 @@ class my extends control $this->view->title = $this->lang->my->common . $this->lang->colon . $this->lang->my->changePassword; $this->view->position[] = $this->lang->my->changePassword; $this->view->user = $this->user->getById($this->app->user->account); + $this->view->rand = $this->user->updateSessionRandom(); $this->display(); } diff --git a/module/my/js/changepassword.js b/module/my/js/changepassword.js new file mode 100644 index 0000000000..46546c5ecf --- /dev/null +++ b/module/my/js/changepassword.js @@ -0,0 +1,25 @@ +$(document).ready(function() +{ + var originalEncrypted = false; + $('#originalPassword').change(function(){originalEncrypted = false}); + + var password1Encrypted = false + var password2Encrypted = false + $('#password1').change(function(){password1Encrypted = false}); + $('#password2').change(function(){password2Encrypted = false}); + + $('#submit').click(function() + { + var password = $('input#originalPassword').val(); + var rand = $('input#verifyRand').val(); + if(!originalEncrypted && password) $('input#originalPassword').val(md5(md5(password) + rand)); + originalEncrypted = true; + + var password1 = $('#password1').val(); + var password2 = $('#password2').val(); + if(password1 && !password1Encrypted) $('#password1').val(md5(password1) + rand); + if(password2 && !password2Encrypted) $('#password2').val(md5(password2) + rand); + password1Encrypted = true; + password2Encrypted = true; + }); +}); diff --git a/module/my/js/editprofile.js b/module/my/js/editprofile.js index e585d83bcd..6a25980c4f 100644 --- a/module/my/js/editprofile.js +++ b/module/my/js/editprofile.js @@ -1,9 +1,25 @@ $(document).ready(function() { + var verifyEncrypted = false; + $('#verifyPassword').change(function(){verifyEncrypted = false}); + + var password1Encrypted = false + var password2Encrypted = false + $('#password1').change(function(){password1Encrypted = false}); + $('#password2').change(function(){password2Encrypted = false}); + $('#dataform').submit(function() { var password = $('input#verifyPassword').val(); var rand = $('input#verifyRand').val(); - $('input#verifyPassword').val(md5(md5(password) + rand)); + if(!verifyEncrypted && password) $('input#verifyPassword').val(md5(md5(password) + rand)); + verifyEncrypted = true; + + var password1 = $('#password1').val(); + var password2 = $('#password2').val(); + if(password1 && !password1Encrypted) $('#password1').val(md5(password1) + rand); + if(password2 && !password2Encrypted) $('#password2').val(md5(password2) + rand); + password1Encrypted = true; + password2Encrypted = true; }); }); diff --git a/module/my/view/changepassword.html.php b/module/my/view/changepassword.html.php index 610357e045..62cd33577c 100755 --- a/module/my/view/changepassword.html.php +++ b/module/my/view/changepassword.html.php @@ -11,6 +11,7 @@ */ ?> +