From 55a7c2e51abf08c4f2238cf7247891c4cccc5b31 Mon Sep 17 00:00:00 2001
From: icret <thetopuser@gmail.com>
Date: Wed, 12 Apr 2023 15:30:49 +0800
Subject: [PATCH] v2.8.1

---
 admin/chart.php            |  2 +-
 admin/zui.chart.php        |  2 +-
 app/check.php              |  4 ++++
 app/check_admin.inc.php    |  4 ++++
 app/footer.php             |  1 +
 app/function.php           |  2 +-
 app/total_files.php        |  3 +++
 app/upload.php             |  7 ++++---
 docs/update.md             |  6 ++++++
 index.php                  |  2 +-
 public/static/EasyImage.js | 26 +++++++++++++++++++++++++-
 11 files changed, 51 insertions(+), 8 deletions(-)

diff --git a/admin/chart.php b/admin/chart.php
index 80e6b85..9aaffa4 100755
--- a/admin/chart.php
+++ b/admin/chart.php
@@ -6,7 +6,7 @@ require_once '../app/header.php';
 require_once APP_ROOT . '/app/chart.php';
 
 // 检测登录和是否开启统计
-if (!$config['chart_on'] && !is_who_login('admin')) exit(header('Location: ' . $config['domain'] . '?hart#closed'));
+if (!$config['chart_on'] || !is_who_login('admin')) exit(header('Location: ' . $config['domain'] . '?hart#closed'));
 
 // 删除统计文件
 if (isset($_POST['del_total'])) {
diff --git a/admin/zui.chart.php b/admin/zui.chart.php
index 5c28227..38f68dc 100755
--- a/admin/zui.chart.php
+++ b/admin/zui.chart.php
@@ -6,7 +6,7 @@ require_once '../app/header.php';
 require_once APP_ROOT . '/app/chart.php';
 
 // 检测是否开启统计
-if (!$config['chart_on']) exit(header('Location: ' . $config['domain'] . '?chart#closed'));
+if (!$config['chart_on'] || !is_who_login('admin')) exit(header('Location: ' . $config['domain'] . '?hart#closed'));
 
 // 检测登录
 if (!is_who_login('admin')) {
diff --git a/app/check.php b/app/check.php
index 9af5a44..8f4bb81 100644
--- a/app/check.php
+++ b/app/check.php
@@ -1,4 +1,8 @@
 <?php
+
+/** 禁止直接访问 */
+defined('APP_ROOT') ?: exit;
+
 // 跳转安装
 if (!is_file(APP_ROOT . '/config/install.lock') and is_file(APP_ROOT . '/install/install.php')) {
     exit('<script type="text/javascript">window.location.href="' . get_whole_url('/') . '/install/index.php"</script>');
diff --git a/app/check_admin.inc.php b/app/check_admin.inc.php
index 536fc0e..7620d79 100644
--- a/app/check_admin.inc.php
+++ b/app/check_admin.inc.php
@@ -1,4 +1,8 @@
 <?php
+
+/** 禁止直接访问 */
+defined('APP_ROOT') ?: exit;
+
 /*
 // 检查当前PHP版本是否大于7.0
 if (PHP_VERSION < 7) {
diff --git a/app/footer.php b/app/footer.php
index 24ac336..a0aeb1b 100644
--- a/app/footer.php
+++ b/app/footer.php
@@ -2,6 +2,7 @@
 
 /** 禁止直接访问 */
 defined('APP_ROOT') ?: exit;
+
 /** 弹窗公告 */
 if ($config['notice_status'] > 0) : ?>
   <div class="modal fade" id="notice">
diff --git a/app/function.php b/app/function.php
index 9376115..974585f 100644
--- a/app/function.php
+++ b/app/function.php
@@ -32,7 +32,7 @@ define('APP_ROOT', str_replace('\\', '/', realpath(dirname(__FILE__) . '/../')))
 // 判断当前的系统类型是否为windows
 define('IS_WIN', strstr(PHP_OS, 'WIN') ? 1 : 0);
 // 定义当前版本
-define('APP_VERSION', '2.8.0');
+define('APP_VERSION', '2.8.1');
 
 /*---------------基础配置结束-------------------*/
 
diff --git a/app/total_files.php b/app/total_files.php
index fcde723..c427268 100644
--- a/app/total_files.php
+++ b/app/total_files.php
@@ -1,5 +1,8 @@
 <?php
 
+/** 禁止直接访问 */
+defined('APP_ROOT') ?: exit;
+
 /**
  * 统计文件
  *
diff --git a/app/upload.php b/app/upload.php
index 269865b..1d4f3fc 100644
--- a/app/upload.php
+++ b/app/upload.php
@@ -27,11 +27,12 @@ if (empty($_FILES['file'])) {
     ));
 }
 
-// sign
-if (empty($_POST['sign']) || $_POST['sign'] !== date('YmdH')) {
+// sign : 前端生成的时间戳 time() - $_POST['sign'] = 从选择文件到上传完毕的耗费时间
+if (empty($_POST['sign']) || time() - $_POST['sign'] > 12306) {
     exit(json_encode(array(
         "result"  => "failed",
-        "code"    => 403,
+		"code"    => 403,
+        "systime" => time(),
         "message" => "上传签名错误,请刷新重试",
     )));
 }
diff --git a/docs/update.md b/docs/update.md
index 409fc3a..908c9ec 100644
--- a/docs/update.md
+++ b/docs/update.md
@@ -1,3 +1,9 @@
+* 2023-04-12 v2.8.1
+- 修改上传签名生成方式
+- 修复一处绕过代码
+- 修复部分会曝露网站路径的代码
+- 增加检测cookie|Local storage
+
 * 2023-04-05 v2.8.0
 - 修复定时删除最小值不能为0
 - 修复上传完毕后多次点击复制失效
diff --git a/index.php b/index.php
index a90c046..d70e9b5 100755
--- a/index.php
+++ b/index.php
@@ -130,7 +130,7 @@ mustLogin();
     flash_swf_url: '<?php static_cdn(); ?>/public/static/zui/lib/uploader/Moxie.xap',
     // sign
     multipart_params: {
-      'sign': new Date().format("YYYYMMddhh"),
+      'sign': Date.now() / 1000,
     },
     // 预览图尺寸
     previewImageSize: {
diff --git a/public/static/EasyImage.js b/public/static/EasyImage.js
index db58f7e..0b8cf69 100755
--- a/public/static/EasyImage.js
+++ b/public/static/EasyImage.js
@@ -229,7 +229,7 @@ $('#btnLinks, #btnBbscode, #btnMarkDown, #btnHtml, #btnThumb, #btnDel').on('clic
 
         var formData = new FormData();
         formData.append('file', file);
-        formData.append('sign', new Date().format("YYYYMMddhh"));
+        formData.append('sign', Date.now());
         var xhr = new XMLHttpRequest();
         xhr.onreadystatechange = function () {
             if (xhr.readyState == 1) {
@@ -299,6 +299,30 @@ $('#btnLinks, #btnBbscode, #btnMarkDown, #btnHtml, #btnThumb, #btnDel').on('clic
     });
 })();
 
+// 检测浏览器是否支持cookie
+if (navigator.cookieEnabled === false) {
+    new $.zui.Messager('浏览器不支持cookie, 无法保存登录信息', {
+        type: 'black',
+        icon: 'bell',
+        time: 4500,
+        placement: 'top'
+    }).show();
+
+    console.log('浏览器不支持cookie');
+}
+
+// 检测浏览器是否支持本地存储
+if ($.zui.store.enable === false) {
+    new $.zui.Messager('浏览器不支持本地存储, 无法保存上传历史记录', {
+        icon: 'bell',
+        time: 4000,
+        type: 'primary',
+        placement: 'top'
+    }).show();
+
+    console.log('浏览器不支持本地存储');
+}
+
 /** 
  * javascript parseUrl函数解析url获取网址url参数 
  * https://www.cnblogs.com/lazb/p/10144471.html