xiaoz
/
onenav
mirror of https://github.com/helloxz/onenav.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Merge pull request #244 from helloxz/dev 

support php 8.x
main
xiaoz 2 days ago committed by GitHub
parent
4b2a27b835 d232089b02
commit
b1636a93dd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
23 changed files with 401 additions and 258 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 2
      auto_install.json
  2. 132
      class/Api.php
  3. 59
      controller/admin.php
  4. 260
      controller/api.php
  5. 4
      controller/bing.php
  6. 19
      controller/click.php
  7. 6
      controller/ico.php
  8. 31
      controller/index.php
  9. 24
      controller/init.php
  10. 14
      controller/login.php
  11. 3
      controller/universal.php
  12. 43
      functions/helper.php
  13. 2
      index.php
  14. 33
      templates/admin/click.php
  15. 2
      templates/admin/edit_category.php
  16. 2
      templates/admin/edit_category_new.php
  17. 1
      templates/admin/setting/api.php
  18. 1
      templates/admin/setting/backup.php
  19. 1
      templates/admin/setting/share.php
  20. 6
      templates/admin/setting/site.php
  21. 2
      templates/admin/setting/subscribe.php
  22. 7
      templates/default/index.php
  23. 5
      templates/minima/index.php

2
auto_install.json
Unescape View File

@ -2,7 +2,7 @@
"php_ext":"opcache", "php_ext":"opcache",
"chmod":[], "chmod":[],
"success_url":"/index.php", "success_url":"/index.php",
"php_versions":"56,70,71,72,73,74", "php_versions":"72,73,74,80,81,82,83",
"db_config":"", "db_config":"",
"admin_username":"", "admin_username":"",
"admin_password":"", "admin_password":"",

132
class/Api.php
Unescape View File

@ -213,13 +213,22 @@ class Api {
protected function auth($token){ protected function auth($token){
// 当方法没有传递token的时候，则先尝试通过POST/GET获取token // 当方法没有传递token的时候，则先尝试通过POST/GET获取token
if( empty($token) ) { if( empty($token) ) {
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; if ( !empty($_POST['token']) ) {
$token = $_POST['token'];
}
else if ( isset($_GET['token']) ) {
$token = $_GET['token'];
}
else {
$token = '';
}
} }
//计算正确的token：用户名 + TOKEN //计算正确的token：用户名 + TOKEN
$SecretKey = @$this->db->get('on_options','*',[ 'key' => 'SecretKey' ])['value']; $secret_row = $this->db->get('on_options','*',[ 'key' => 'SecretKey' ]);
$SecretKey = $secret_row['value'] ?? '';
$token_yes = md5(USER.$SecretKey); $token_yes = md5(USER.$SecretKey);
//获取header中的X-token //获取header中的X-token
$xtoken = $_SERVER['HTTP_X_TOKEN']; $xtoken = $_SERVER['HTTP_X_TOKEN'] ?? '';
//如果通过header传递token，且验证通过 //如果通过header传递token，且验证通过
if( !empty($xtoken) && ($xtoken === $token_yes) ) { if( !empty($xtoken) && ($xtoken === $token_yes) ) {
@ -300,7 +309,7 @@ class Api {
* 批量修改链接分类 * 批量修改链接分类
*/ */
public function batch_modify_category($data) { public function batch_modify_category($data) {
$this->auth($token); $this->auth(null);
//获取链接ID，是一个数组 //获取链接ID，是一个数组
$id = implode(',',$data['id']); $id = implode(',',$data['id']);
//获取分类ID //获取分类ID
@ -331,7 +340,7 @@ class Api {
* 批量修改链接属性为公有或私有 * 批量修改链接属性为公有或私有
*/ */
public function set_link_attribute($data) { public function set_link_attribute($data) {
$this->auth($token); $this->auth(null);
//获取链接ID，是一个数组 //获取链接ID，是一个数组
$ids = implode(',',$data['ids']); $ids = implode(',',$data['ids']);
$property = intval($data['property']); $property = intval($data['property']);
@ -352,7 +361,7 @@ class Api {
* *
*/ */
public function set_cat_batch($data) { public function set_cat_batch($data) {
$this->auth($token); $this->auth(null);
//获取链接ID，是一个数组 //获取链接ID，是一个数组
$ids = implode(',',$data['ids']); $ids = implode(',',$data['ids']);
$property = intval($data['property']); $property = intval($data['property']);
@ -466,7 +475,7 @@ class Api {
//过滤$filename //过滤$filename
$filename = str_replace('../','',$filename); $filename = str_replace('../','',$filename);
$filename = str_replace('./','',$filename); $filename = str_replace('./','',$filename);
$this->auth($token); $this->auth(null);
//检查文件是否存在 //检查文件是否存在
if ( !file_exists($filename) ) { if ( !file_exists($filename) ) {
$this->err_msg(-1016,'File does not exist!'); $this->err_msg(-1016,'File does not exist!');
@ -623,7 +632,7 @@ class Api {
*/ */
public function general_upload($path,$suffixs){ public function general_upload($path,$suffixs){
// 验证权限 // 验证权限
$this->auth($token); $this->auth(null);
// 存在错误，上传失败 // 存在错误，上传失败
if ($_FILES["file"]["error"] > 0) if ($_FILES["file"]["error"] > 0)
{ {
@ -1043,7 +1052,7 @@ class Api {
*/ */
public function edit_link_row(){ public function edit_link_row(){
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
// 获取POST请求中的JSON数据 // 获取POST请求中的JSON数据
$json_data = file_get_contents('php://input'); $json_data = file_get_contents('php://input');
@ -1164,11 +1173,11 @@ class Api {
$offset = ($page - 1) * $limit; $offset = ($page - 1) * $limit;
// 验证登录或 token // 验证登录或 token
if ($this->is_login() || (!empty($token) && $this->auth($token))) { if ($this->is_login() || (!empty($token) && $this->auth(null))) {
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC"; $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC";
$count = $this->db->count('on_categorys', '*'); $count = $this->db->count('on_categorys', '*');
} elseif (!empty($token)) { } elseif (!empty($token)) {
$this->auth($token); $this->auth(null);
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC"; $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC";
$count = $this->db->count('on_categorys', '*'); $count = $this->db->count('on_categorys', '*');
} else { } else {
@ -1253,12 +1262,12 @@ class Api {
$count = $this->db->count('on_links','*'); $count = $this->db->count('on_links','*');
//如果成功登录，但token为空，获取所有 //如果成功登录，但token为空，获取所有
if( $this->is_login() || ( !empty($token) && $this->auth($token) ) ){ if( $this->is_login() || ( !empty($token) && $this->auth(null) ) ){
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}"; $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
} }
//如果token验证通过 //如果token验证通过
elseif( (!empty($token)) && ($this->auth($token)) ) { elseif( (!empty($token)) && ($this->auth(null)) ) {
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}"; $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
} }
//如果通过header传递的token验证成功，则获取所有 //如果通过header传递的token验证成功，则获取所有
@ -1320,7 +1329,7 @@ class Api {
// } // }
//如果token验证通过 //如果token验证通过
elseif( (!empty($token)) && ($this->auth($token)) ) { elseif( (!empty($token)) && ($this->auth(null)) ) {
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links WHERE fid = $fid ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}"; $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links WHERE fid = $fid ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
} }
//如果即没有登录成功，又没有token，则默认为游客,游客查询链接属性为公有，分类为公有，不查询私有 //如果即没有登录成功，又没有token，则默认为游客,游客查询链接属性为公有，分类为公有，不查询私有
@ -1365,7 +1374,7 @@ class Api {
//分类属性为1，则说明是私有链接，则未认证用户不允许查询 //分类属性为1，则说明是私有链接，则未认证用户不允许查询
if( $category_property === 1 ){ if( $category_property === 1 ){
//进行认证 //进行认证
$this->auth($token); $this->auth(null);
} }
$datas = [ $datas = [
'code' => 0, 'code' => 0,
@ -1375,7 +1384,7 @@ class Api {
} }
//如果是私有链接，并且认证通过 //如果是私有链接，并且认证通过
elseif( $link_info['property'] == "1" ) { elseif( $link_info['property'] == "1" ) {
if ( ( $this->auth($token) ) || ( $this->is_login() ) ) { if ( ( $this->auth(null) ) || ( $this->is_login() ) ) {
$datas = [ $datas = [
'code' => 0, 'code' => 0,
'data' => $link_info 'data' => $link_info
@ -1418,7 +1427,7 @@ class Api {
} }
//如果是私有链接，并且认证通过 //如果是私有链接，并且认证通过
elseif( $category_info['property'] == "1" ) { elseif( $category_info['property'] == "1" ) {
if ( ( $this->auth($token) ) || ( $this->is_login() ) ) { if ( ( $this->auth(null) ) || ( $this->is_login() ) ) {
$datas = [ $datas = [
'code' => 0, 'code' => 0,
'data' => $category_info 'data' => $category_info
@ -1441,9 +1450,9 @@ class Api {
* 验证是否登录 * 验证是否登录
*/ */
protected function is_login(){ protected function is_login(){
$key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.$_SERVER['HTTP_USER_AGENT']); $key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//获取session //获取session
$session = $_COOKIE['key']; $session = $_COOKIE['key'] ?? '';
//如果已经成功登录 //如果已经成功登录
if($session == $key) { if($session == $key) {
return true; return true;
@ -1675,7 +1684,7 @@ class Api {
public function check_weak_password($token){ public function check_weak_password($token){
$this->auth($token); $this->auth($token);
//如果用户名、密码为初始密码，则提示修改 //如果用户名、密码为初始密码，则提示修改
if ( ( USER == 'xiaoz' ) && ( PASSWORD == 'xiaoz.me' ) ) { if ( defined('PASSWORD') && USER == 'xiaoz' && PASSWORD == 'xiaoz.me' ) {
$this->err_msg(-1,'Weak password!'); $this->err_msg(-1,'Weak password!');
} }
} }
@ -1806,7 +1815,7 @@ class Api {
if( $insert_re ) { if( $insert_re ) {
$data = [ $data = [
"code" => 0, "code" => 0,
"data" => $name."更新完成！总数${num}，成功：${init_num}" "data" => $name."更新完成！总数{$num}，成功：{$init_num}"
]; ];
exit(json_encode($data)); exit(json_encode($data));
} }
@ -1822,7 +1831,7 @@ class Api {
* 保存主题参数 * 保存主题参数
*/ */
public function save_theme_config($data) { public function save_theme_config($data) {
$this->auth($token); $this->auth(null);
//获取主题名称 //获取主题名称
$name = $data['name']; $name = $data['name'];
//获取config参数,是一个对象 //获取config参数,是一个对象
@ -1850,7 +1859,7 @@ class Api {
*/ */
public function delete_theme($name) { public function delete_theme($name) {
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
//正则判断主题名称是否合法 //正则判断主题名称是否合法
$pattern = "/^[a-zA-Z0-9][a-zA-Z0-9-_]+[a-zA-Z0-9]$/"; $pattern = "/^[a-zA-Z0-9][a-zA-Z0-9-_]+[a-zA-Z0-9]$/";
if ( !preg_match($pattern,$name) ) { if ( !preg_match($pattern,$name) ) {
@ -1973,7 +1982,7 @@ class Api {
*/ */
public function set_option($key,$value = '') { public function set_option($key,$value = '') {
// 验证授权 // 验证授权
$this->auth($token); $this->auth(null);
$key = htmlspecialchars(trim($key)); $key = htmlspecialchars(trim($key));
//如果key是空的 //如果key是空的
if( empty($key) ) { if( empty($key) ) {
@ -2025,7 +2034,7 @@ class Api {
*/ */
public function new_set_option(){ public function new_set_option(){
// 验证授权 // 验证授权
$this->auth($token); $this->auth(null);
// 获取key // 获取key
$key = trim(@$_POST['key']); $key = trim(@$_POST['key']);
// 获取value // 获取value
@ -2132,7 +2141,7 @@ class Api {
*/ */
public function check_subscribe() { public function check_subscribe() {
//验证token是否合法 //验证token是否合法
$this->auth($token); $this->auth(null);
//获取订阅信息 //获取订阅信息
//获取当前站点信息 //获取当前站点信息
$subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]); $subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]);
@ -2191,9 +2200,9 @@ class Api {
$key = $data['key']; $key = $data['key'];
$value = $data['value']; $value = $data['value'];
//拼接主题URL //拼接主题URL
$url = API_URL."/v1/down_theme.php?name=${name}&key=${key}&value=${value}"; $url = API_URL."/v1/down_theme.php?name={$name}&key={$key}&value={$value}";
//验证token是否合法 //验证token是否合法
$this->auth($token); $this->auth(null);
//检查主题是否已经存在 //检查主题是否已经存在
if ( $data['type'] == 'download' ) { if ( $data['type'] == 'download' ) {
$theme1 = "templates/".$name; $theme1 = "templates/".$name;
@ -2223,7 +2232,7 @@ class Api {
$theme_dir = "templates"; $theme_dir = "templates";
} }
//主题完整压缩包路径 //主题完整压缩包路径
$file_name = $theme_dir."/${name}.tar.gz"; $file_name = $theme_dir."/{$name}.tar.gz";
if( !is_dir($theme_dir) ) { if( !is_dir($theme_dir) ) {
mkdir($theme_dir,0755); mkdir($theme_dir,0755);
} }
@ -2233,7 +2242,7 @@ class Api {
//下载主题，并设置超时时间为120s //下载主题，并设置超时时间为120s
$content = $this->curl_get($url,120); $content = $this->curl_get($url,120);
//写入主题 //写入主题
$re = file_put_contents($theme_dir."/${name}.tar.gz",$content); $re = file_put_contents($theme_dir."/{$name}.tar.gz",$content);
//如果写入主题失败了，说明权限不粗糙 //如果写入主题失败了，说明权限不粗糙
if( !$re ) { if( !$re ) {
$this->return_json(-2000,'','主题写入失败，请检查目录权限！'); $this->return_json(-2000,'','主题写入失败，请检查目录权限！');
@ -2242,7 +2251,7 @@ class Api {
//解压文件 //解压文件
$phar = new PharData($file_name); $phar = new PharData($file_name);
//路径 要解压的文件 是否覆盖 //路径 要解压的文件 是否覆盖
$phar->extractTo($theme_dir."/${name}", null, true); $phar->extractTo($theme_dir."/{$name}", null, true);
//删除主题 //删除主题
unlink($file_name); unlink($file_name);
$this->return_json(200,'','主题下载成功！'); $this->return_json(200,'','主题下载成功！');
@ -2263,16 +2272,19 @@ class Api {
//获取订阅SESSION状态 //获取订阅SESSION状态
session_start(); session_start();
//获取session订阅状态 //获取session订阅状态
$is_subscribe = $_SESSION['subscribe']; $is_subscribe = $_SESSION['subscribe'] ?? null;
//如果订阅是空的，则请求接口获取订阅状态 //如果订阅是空的，则请求接口获取订阅状态
if ( !isset($is_subscribe) ) { if ( !isset($is_subscribe) ) {
//获取当前站点信息 //获取当前站点信息
$subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]); $subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]);
$domain = $_SERVER['HTTP_HOST']; $domain = $_SERVER['HTTP_HOST'] ?? '';
$subscribe = unserialize($subscribe); $subscribe = is_string($subscribe) ? unserialize($subscribe) : [];
if ( !is_array($subscribe) ) {
$subscribe = [];
}
//api请求地址 //api请求地址
$api_url = API_URL."/v1/check_subscribe.php?order_id=".$subscribe['order_id']."&email=".$subscribe['email']."&domain=".$domain; $api_url = API_URL."/v1/check_subscribe.php?order_id=".($subscribe['order_id'] ?? '')."&email=".($subscribe['email'] ?? '')."&domain=".$domain;
// echo $api_url; // echo $api_url;
try { try {
#GET HTTPS #GET HTTPS
@ -2466,7 +2478,7 @@ class Api {
*/ */
public function backup_db(){ public function backup_db(){
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
//验证订阅 //验证订阅
$this->check_is_subscribe(); $this->check_is_subscribe();
@ -2500,15 +2512,25 @@ class Api {
*/ */
public function backup_db_list() { public function backup_db_list() {
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
//验证订阅 //验证订阅
$this->check_is_subscribe(); $this->check_is_subscribe();
//备份目录 //备份目录
$backup_dir = 'data/backup/'; $backup_dir = 'data/backup/';
//目录不存在时先创建，避免 scandir 返回 false 后 count() 在 PHP 8 下抛 TypeError
if ( !is_dir($backup_dir) ) {
if ( !mkdir($backup_dir, 0755, true) ) {
$this->return_json(-2000, '', '备份目录创建失败，请检查目录权限！');
}
}
//遍历备份列表 //遍历备份列表
$dbs = scandir($backup_dir); $dbs = scandir($backup_dir);
if ( !is_array($dbs) ) {
$dbs = [];
}
$newdbs = $dbs; $newdbs = $dbs;
//去除.和.. //去除.和..
@ -2567,7 +2589,7 @@ class Api {
*/ */
public function del_backup_db($name) { public function del_backup_db($name) {
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
//验证订阅 //验证订阅
$this->check_is_subscribe(); $this->check_is_subscribe();
@ -2597,7 +2619,7 @@ class Api {
*/ */
public function restore_db($name) { public function restore_db($name) {
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
//验证订阅 //验证订阅
$this->check_is_subscribe(); $this->check_is_subscribe();
@ -2649,7 +2671,7 @@ class Api {
*/ */
public function down_db($name) { public function down_db($name) {
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
//使用正则表达式判断数据库名称是否合法 //使用正则表达式判断数据库名称是否合法
$pattern = '/^onenav_[0-9\-]+_[0-9.]+(db3)$/'; $pattern = '/^onenav_[0-9\-]+_[0-9.]+(db3)$/';
@ -2694,7 +2716,7 @@ class Api {
*/ */
public function create_share($data) { public function create_share($data) {
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
//如果订阅不存在 //如果订阅不存在
if ( $this->is_subscribe() === FALSE ) { if ( $this->is_subscribe() === FALSE ) {
@ -2743,7 +2765,7 @@ class Api {
*/ */
public function share_list($data){ public function share_list($data){
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
$limit = $data['limit']; $limit = $data['limit'];
$offset = ($data['page'] - 1) * $data['limit']; $offset = ($data['page'] - 1) * $data['limit'];
@ -2846,7 +2868,7 @@ class Api {
*/ */
public function del_share($data) { public function del_share($data) {
//验证请求 //验证请求
$this->auth($token); $this->auth(null);
$id = $data['id']; $id = $data['id'];
@ -2884,7 +2906,7 @@ class Api {
*/ */
public function del_link_icon(){ public function del_link_icon(){
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
//获取图标路径 //获取图标路径
$icon_path = trim($_POST['icon_path']); $icon_path = trim($_POST['icon_path']);
@ -2919,7 +2941,7 @@ class Api {
} elseif(isset($_GET[$param])) { } elseif(isset($_GET[$param])) {
return $_GET[$param]; return $_GET[$param];
} else { } else {
return null; return '';
} }
} }
@ -2928,7 +2950,7 @@ class Api {
*/ */
public function global_search() { public function global_search() {
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
// 获取关键词 // 获取关键词
$keyword = htmlspecialchars( $this->getData("keyword") ); $keyword = htmlspecialchars( $this->getData("keyword") );
@ -2989,7 +3011,7 @@ class Api {
*/ */
public function update_link_order(){ public function update_link_order(){
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
// 获取分类ID // 获取分类ID
$cid = intval($this->getData("category_id")); $cid = intval($this->getData("category_id"));
// 获取json对象数据 // 获取json对象数据
@ -3021,7 +3043,7 @@ class Api {
*/ */
public function get_subscribe() { public function get_subscribe() {
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
//获取当前站点信息 //获取当前站点信息
$subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]); $subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]);
$subscribe = unserialize($subscribe); $subscribe = unserialize($subscribe);
@ -3035,7 +3057,7 @@ class Api {
public function get_subscribe_status(){ public function get_subscribe_status(){
// var_dump($_SERVER['HTTP_HOST']); // var_dump($_SERVER['HTTP_HOST']);
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
// 获取订阅结果 // 获取订阅结果
$result = $this->is_subscribe(); $result = $this->is_subscribe();
@ -3054,7 +3076,7 @@ class Api {
public function batch_check_links(){ public function batch_check_links(){
set_time_limit(1200); // 设置执行最大时间为20分钟 set_time_limit(1200); // 设置执行最大时间为20分钟
// 验证授权 // 验证授权
$this->auth($token); $this->auth(null);
// 验证订阅 // 验证订阅
$this->check_is_subscribe(); $this->check_is_subscribe();
@ -3216,7 +3238,7 @@ class Api {
// 设置超时时间为120s // 设置超时时间为120s
set_time_limit(120); set_time_limit(120);
// 验证授权 // 验证授权
$this->auth($token); $this->auth(null);
// 验证订阅 // 验证订阅
$this->check_is_subscribe(); $this->check_is_subscribe();
@ -3396,7 +3418,7 @@ class Api {
*/ */
private function get_options($key) { private function get_options($key) {
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
//获取当前站点信息 //获取当前站点信息
$options = $this->db->get('on_options','value',[ 'key' => $key ]); $options = $this->db->get('on_options','value',[ 'key' => $key ]);
// 判断查询结果是否为空 // 判断查询结果是否为空
@ -3414,7 +3436,7 @@ class Api {
*/ */
public function get_option_base(){ public function get_option_base(){
//验证授权 //验证授权
$this->auth($token); $this->auth(null);
// 获取key // 获取key
$key = htmlspecialchars( trim( $_GET['key'] )); $key = htmlspecialchars( trim( $_GET['key'] ));
$options = $this->db->get('on_options','value',[ 'key' => $key ]); $options = $this->db->get('on_options','value',[ 'key' => $key ]);
@ -3432,7 +3454,7 @@ class Api {
*/ */
public function forward_order(){ public function forward_order(){
//验证token是否合法 //验证token是否合法
$this->auth($token); $this->auth(null);
// 声明一个空数组，作为请求体 // 声明一个空数组，作为请求体
$data = []; $data = [];
if (!empty($_GET)) { if (!empty($_GET)) {
@ -3523,7 +3545,7 @@ class Api {
// 获取相临的版本 // 获取相临的版本
public function getNextVersion(){ public function getNextVersion(){
$this->auth($token); $this->auth(null);
// 获取当前版本 // 获取当前版本
$version = trim($_GET['version']); $version = trim($_GET['version']);
// 正则判断版本是否合法，只能是数组或.组成 // 正则判断版本是否合法，只能是数组或.组成

59
controller/admin.php
Unescape View File

@ -41,10 +41,11 @@ if( $page == 'index' ) {
//如果页面是修改edit_category //如果页面是修改edit_category
if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == 'add_category_new') ) { if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == 'add_category_new') ) {
//获取id //获取id
$id = intval($_GET['id']); $id = intval($_GET['id'] ?? 0);
//查询单条分类信息 //查询单条分类信息
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname FROM on_categorys AS a WHERE id = $id"; $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname FROM on_categorys AS a WHERE id = $id";
$category_one = $db->query($sql)->fetchAll()[0]; $category_rows = $db->query($sql)->fetchAll();
$category_one = $category_rows[0] ?? [];
//$category_one = $db->get('on_categorys','*',[ 'id' => $id ]); //$category_one = $db->get('on_categorys','*',[ 'id' => $id ]);
//查询父级分类 //查询父级分类
$categorys = $db->select('on_categorys','*',[ $categorys = $db->select('on_categorys','*',[
@ -52,7 +53,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == '
'ORDER' => ['weight' => 'DESC'] 'ORDER' => ['weight' => 'DESC']
]); ]);
//checked按钮 //checked按钮
if( $category_one['property'] == 1 ) { if( !empty($category_one['property']) ) {
$category_one['checked'] = 'checked'; $category_one['checked'] = 'checked';
} }
else{ else{
@ -63,7 +64,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == '
//如果是主题设置页面 //如果是主题设置页面
if ( $page == "setting/theme_config" ){ if ( $page == "setting/theme_config" ){
//获取主题名称 //获取主题名称
$name = trim($_GET['name']); $name = trim($_GET['name'] ?? '');
//获取主题目录 //获取主题目录
if ( is_dir("templates/".$name) ) { if ( is_dir("templates/".$name) ) {
$theme_dir = "templates/".$name; $theme_dir = "templates/".$name;
@ -77,11 +78,14 @@ if ( $page == "setting/theme_config" ){
$config_content = @file_get_contents("data/templates/".$name."/info.json"); $config_content = @file_get_contents("data/templates/".$name."/info.json");
} }
$configs = json_decode($config_content); $configs = json_decode($config_content);
$configs = $configs->config; $configs = ( is_object($configs) && isset($configs->config) ) ? $configs->config : (object) [];
//获取当前的配置参数 //获取当前的配置参数
$current_configs = file_get_contents($theme_dir."/config.json"); $current_configs = @file_get_contents($theme_dir."/config.json");
$current_configs = json_decode($current_configs); $current_configs = json_decode($current_configs);
if ( !is_object($current_configs) ) {
$current_configs = (object) [];
}
//var_dump($current_configs); //var_dump($current_configs);
@ -99,7 +103,8 @@ if ( $page == 'add_category' ) {
//API设置页面 //API设置页面
if( $page == 'setting/api' ) { if( $page == 'setting/api' ) {
//查询SecretKey //查询SecretKey
$SecretKey = $db->get('on_options','*',[ 'key' => 'SecretKey' ])['value']; $secret_row = $db->get('on_options','*',[ 'key' => 'SecretKey' ]);
$SecretKey = $secret_row['value'] ?? '';
} }
@ -114,15 +119,16 @@ if ( ( $page == 'edit_link' ) || ( $page === 'edit_link_new' ) ) {
//查询所有分类信息，用于分类框选择 //查询所有分类信息，用于分类框选择
$categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weigth' => 'DESC'] ]); $categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weigth' => 'DESC'] ]);
//获取id //获取id
$id = intval($_GET['id']); $id = intval($_GET['id'] ?? 0);
//查询单条链接信息 //查询单条链接信息
$link = $db->get('on_links','*',[ 'id' => $id ]); $link = $db->get('on_links','*',[ 'id' => $id ]);
$link = $link ?: [];
//查询单个分类信息 //查询单个分类信息
$cat_name = $db->get('on_categorys',['name'],[ 'id' => $link['fid'] ]); $cat_name = $db->get('on_categorys',['name'],[ 'id' => $link['fid'] ?? 0 ]);
$cat_name = $cat_name['name']; $cat_name = $cat_name['name'] ?? '';
//checked按钮 //checked按钮
if( $link['property'] == 1 ) { if( !empty($link['property']) ) {
$link['checked'] = 'checked'; $link['checked'] = 'checked';
} }
else{ else{
@ -141,7 +147,7 @@ if ( ($page == 'add_link') || ($page == 'add_link_tpl') || ($page == 'add_quick_
//查询所有分类信息 //查询所有分类信息
$categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weight' => 'DESC'] ]); $categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weight' => 'DESC'] ]);
//checked按钮 //checked按钮
if( $category['property'] == 1 ) { if( !empty($category['property']) ) {
$category['checked'] = 'checked'; $category['checked'] = 'checked';
} }
else{ else{
@ -154,7 +160,7 @@ if ( $page == 'imp_link' ) {
//查询所有分类信息 //查询所有分类信息
$categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weight' => 'DESC'] ]); $categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weight' => 'DESC'] ]);
//checked按钮 //checked按钮
if( $category['property'] == 1 ) { if( !empty($category['property']) ) {
$category['checked'] = 'checked'; $category['checked'] = 'checked';
} }
else{ else{
@ -176,6 +182,16 @@ if ( $page == 'setting/theme_detail' ) {
$info = file_get_contents($tpl_dir2.'/info.json'); $info = file_get_contents($tpl_dir2.'/info.json');
} }
$theme = json_decode($info); $theme = json_decode($info);
$theme_defaults = [
'name' => '',
'screenshot' => '',
'description' => '',
'author' => '',
'update' => '',
'help_url' => '',
'homepage' => ''
];
$theme = (object) array_merge($theme_defaults, is_object($theme) ? (array) $theme : []);
//var_dump($theme); //var_dump($theme);
} }
@ -201,7 +217,7 @@ if( $page == 'setting/theme' ) {
case 'admin': case 'admin':
case 'mobile': case 'mobile':
case 'universal': case 'universal':
continue; continue 2;
break; break;
default: default:
array_push($tpl_one,$value); array_push($tpl_one,$value);
@ -224,7 +240,7 @@ if( $page == 'setting/theme' ) {
case '.': case '.':
case '..': case '..':
case 'admin': case 'admin':
continue; continue 2;
break; break;
default: default:
array_push($tpl_two,$value); array_push($tpl_two,$value);
@ -272,8 +288,7 @@ if( $page == 'setting/theme' ) {
//站点设置页面 //站点设置页面
if( $page == 'setting/site' ) { if( $page == 'setting/site' ) {
//获取当前站点信息 //获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]); $site = get_site_setting();
$site = unserialize($site);
} }
//站点订阅页面 //站点订阅页面
@ -281,7 +296,15 @@ if( $page == 'setting/subscribe' ) {
//获取当前站点信息 //获取当前站点信息
$subscribe = $db->get('on_options','value',[ 'key' => "s_subscribe" ]); $subscribe = $db->get('on_options','value',[ 'key' => "s_subscribe" ]);
$subscribe = unserialize($subscribe); $subscribe = is_string($subscribe) ? unserialize($subscribe) : [];
if ( !is_array($subscribe) ) {
$subscribe = [];
}
$subscribe = array_merge([
'order_id' => '',
'email' => '',
'end_time' => ''
], $subscribe);
//获取当前版本信息 //获取当前版本信息
$current_version = explode("-",file_get_contents("version.txt")); $current_version = explode("-",file_get_contents("version.txt"));

260
controller/api.php
Unescape View File

@ -11,10 +11,42 @@ header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: Access-Control-Allow-Private-Network,Content-Type, AccessToken, X-CSRF-Token, Authorization, Token,X-Token,X-Cid"); header("Access-Control-Allow-Headers: Access-Control-Allow-Private-Network,Content-Type, AccessToken, X-CSRF-Token, Authorization, Token,X-Token,X-Cid");
require('./class/Api.php'); require('./class/Api.php');
/**
* 读取请求参数，缺失时返回默认值
* 避免 PHP 8 下未定义索引和 null 传入字符串函数的弃用警告
*/
function req_param($key, $default = '')
{
if ( array_key_exists($key, $_POST) ) {
return $_POST[$key];
}
if ( array_key_exists($key, $_GET) ) {
return $_GET[$key];
}
if ( array_key_exists($key, $_REQUEST) ) {
return $_REQUEST[$key];
}
return $default;
}
/**
* 获取 API token，POST 优先，其次 GET
*/
function req_token()
{
if ( !empty($_POST['token']) ) {
return $_POST['token'];
}
if ( isset($_GET['token']) ) {
return $_GET['token'];
}
return '';
}
$api = new Api($db); $api = new Api($db);
//获取请求方法 //获取请求方法
$method = $_GET['method']; $method = $_GET['method'] ?? '';
//可变函数变量 //可变函数变量
$var_func = htmlspecialchars(trim($method),ENT_QUOTES); $var_func = htmlspecialchars(trim($method),ENT_QUOTES);
// 屏蔽的方法，让其不调用class/Api.php 中的方法 // 屏蔽的方法，让其不调用class/Api.php 中的方法
@ -37,7 +69,9 @@ $deny_func = [
'set_option', 'set_option',
'set_option_bool', 'set_option_bool',
'update_link_status', 'update_link_status',
'get_options' 'get_options',
'req_param',
'req_token'
]; ];
// 判断是否在屏蔽列表中 // 判断是否在屏蔽列表中
if( in_array($var_func,$deny_func) ) { if( in_array($var_func,$deny_func) ) {
@ -66,21 +100,21 @@ if ( function_exists($var_func) ) {
*/ */
function add_category($api){ function add_category($api){
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取分类名称 //获取分类名称
$name = $_POST['name']; $name = req_param('name', '');
//获取私有属性 //获取私有属性
$property = empty($_POST['property']) ? 0 : 1; $property = empty($_POST['property']) ? 0 : 1;
//获取分级ID //获取分级ID
$fid = intval($_POST['fid']); $fid = intval(req_param('fid', ''));
//获取权重 //获取权重
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']); $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
//获取描述 //获取描述
$description = empty($_POST['description']) ? '' : $_POST['description']; $description = empty($_POST['description']) ? '' : req_param('description', '');
//描述过滤 //描述过滤
$description = htmlspecialchars($description); $description = htmlspecialchars($description);
//获取字体图标 //获取字体图标
$font_icon = htmlspecialchars($_POST['font_icon'],ENT_QUOTES); $font_icon = htmlspecialchars(req_param('font_icon', ''),ENT_QUOTES);
//搜索字体图标是否包含'fa '，如果不包含则自动加上 //搜索字体图标是否包含'fa '，如果不包含则自动加上
if( !strstr($font_icon,'fa ') ) { if( !strstr($font_icon,'fa ') ) {
$font_icon = 'fa '.$font_icon; $font_icon = 'fa '.$font_icon;
@ -92,23 +126,23 @@ function add_category($api){
*/ */
function edit_category($api){ function edit_category($api){
//获取ID //获取ID
$id = intval($_POST['id']); $id = intval(req_param('id', ''));
//获取父级ID //获取父级ID
$fid = intval($_POST['fid']); $fid = intval(req_param('fid', ''));
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取分类名称 //获取分类名称
$name = $_POST['name']; $name = req_param('name', '');
//获取私有属性 //获取私有属性
$property = empty($_POST['property']) ? 0 : 1; $property = empty($_POST['property']) ? 0 : 1;
//获取权重 //获取权重
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']); $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
//获取描述 //获取描述
$description = empty($_POST['description']) ? '' : $_POST['description']; $description = empty($_POST['description']) ? '' : req_param('description', '');
//描述过滤 //描述过滤
$description = htmlspecialchars($description); $description = htmlspecialchars($description);
//字体图标 //字体图标
$font_icon = htmlspecialchars($_POST['font_icon'],ENT_QUOTES); $font_icon = htmlspecialchars(req_param('font_icon', ''),ENT_QUOTES);
//搜索字体图标是否包含'fa '，如果不包含则自动加上 //搜索字体图标是否包含'fa '，如果不包含则自动加上
if( !strstr($font_icon,'fa ') ) { if( !strstr($font_icon,'fa ') ) {
$font_icon = 'fa '.$font_icon; $font_icon = 'fa '.$font_icon;
@ -120,9 +154,9 @@ function edit_category($api){
*/ */
function del_category($api){ function del_category($api){
//获取ID //获取ID
$id = intval($_POST['id']); $id = intval(req_param('id', ''));
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
$api->del_category($token,$id); $api->del_category($token,$id);
} }
/** /**
@ -131,17 +165,17 @@ function del_category($api){
function add_link($api){ function add_link($api){
//add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0) //add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0)
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取fid //获取fid
$fid = intval(@$_POST['fid']); $fid = intval(req_param('fid', ''));
$title = $_POST['title']; $title = req_param('title', '');
$url = $_POST['url']; $url = req_param('url', '');
$url_standby = $_POST['url_standby']; $url_standby = req_param('url_standby', '');
$description = empty($_POST['description']) ? '' : $_POST['description']; $description = empty($_POST['description']) ? '' : req_param('description', '');
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']); $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
$property = empty($_POST['property']) ? 0 : 1; $property = empty($_POST['property']) ? 0 : 1;
$font_icon = empty($_POST['font_icon']) ? '' : $_POST['font_icon']; $font_icon = empty($_POST['font_icon']) ? '' : req_param('font_icon', '');
$api->add_link($token,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon); $api->add_link($token,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon);
@ -152,18 +186,18 @@ function add_link($api){
function edit_link($api){ function edit_link($api){
//add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0) //add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0)
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
$id = intval(@$_POST['id']); $id = intval(req_param('id', ''));
//获取fid //获取fid
$fid = intval(@$_POST['fid']); $fid = intval(req_param('fid', ''));
$title = $_POST['title']; $title = req_param('title', '');
$url = $_POST['url']; $url = req_param('url', '');
$url_standby = $_POST['url_standby']; $url_standby = req_param('url_standby', '');
$description = empty($_POST['description']) ? '' : $_POST['description']; $description = empty($_POST['description']) ? '' : req_param('description', '');
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']); $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
$property = empty($_POST['property']) ? 0 : 1; $property = empty($_POST['property']) ? 0 : 1;
$font_icon = empty($_POST['font_icon']) ? '' : $_POST['font_icon']; $font_icon = empty($_POST['font_icon']) ? '' : req_param('font_icon', '');
$api->edit_link($token,$id,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon); $api->edit_link($token,$id,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon);
@ -173,16 +207,16 @@ function edit_link($api){
* 删除链接 * 删除链接
*/ */
function del_link($api){ function del_link($api){
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
$id = intval(@$_POST['id']); $id = intval(req_param('id', ''));
$api->del_link($token,$id); $api->del_link($token,$id);
} }
/** /**
* 查询分类目录列表 * 查询分类目录列表
*/ */
function category_list($api){ function category_list($api){
$page = empty(intval($_GET['page'])) ? 1 : intval($_GET['page']); $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval($_GET['limit'])) ? 10 : intval($_GET['limit']); $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
$api->category_list($page,$limit); $api->category_list($page,$limit);
} }
@ -190,12 +224,12 @@ function category_list($api){
* 查询链接列表 * 查询链接列表
*/ */
function link_list($api){ function link_list($api){
$page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']); $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']); $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取分类ID //获取分类ID
$category_id = empty($_POST['category_id']) ? null : intval($_POST['category_id']); $category_id = empty($_POST['category_id']) ? null : intval(req_param('category_id', ''));
$data = [ $data = [
'page' => $page, 'page' => $page,
'limit' => $limit, 'limit' => $limit,
@ -209,12 +243,12 @@ function link_list($api){
* 查询分类下的链接 * 查询分类下的链接
*/ */
function q_category_link($api){ function q_category_link($api){
$page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']); $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']); $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取分类ID //获取分类ID
$category_id = empty($_REQUEST['category_id']) ? null : intval($_REQUEST['category_id']); $category_id = empty($_REQUEST['category_id']) ? null : intval(req_param('category_id', ''));
$data = [ $data = [
'page' => $page, 'page' => $page,
'limit' => $limit, 'limit' => $limit,
@ -229,9 +263,9 @@ function q_category_link($api){
*/ */
function get_link_info($api) { function get_link_info($api) {
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取URL //获取URL
$url = @$_POST['url']; $url = req_param('url', '');
$api->get_link_info($token,$url); $api->get_link_info($token,$url);
} }
@ -240,9 +274,9 @@ function get_link_info($api) {
*/ */
function get_a_category($api) { function get_a_category($api) {
//获取token //获取token
$data['token'] = @empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $data['token'] = req_token();
//获取分类ID //获取分类ID
$data['id'] = intval(trim($_POST['id'])); $data['id'] = intval(trim(req_param('id', '')));
//var_dump($data); //var_dump($data);
$api->get_a_category($data); $api->get_a_category($data);
} }
@ -252,9 +286,9 @@ function get_a_category($api) {
*/ */
function get_a_link($api) { function get_a_link($api) {
//获取token //获取token
$data['token'] = htmlspecialchars(empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']); $data['token'] = htmlspecialchars(req_token());
//获取链接的ID //获取链接的ID
$data['id'] = intval(htmlspecialchars($_GET['id'])); $data['id'] = intval(htmlspecialchars(req_param('id', '')));
$api->get_a_link($data); $api->get_a_link($data);
} }
@ -263,50 +297,50 @@ function get_a_link($api) {
*/ */
function add_js($api) { function add_js($api) {
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
$content = @$_POST['content']; $content = req_param('content', '');
$api->add_js($token,$content); $api->add_js($token,$content);
} }
// 上传书签 // 上传书签
function upload($api){ function upload($api){
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取上传类型 //获取上传类型
$type = $_GET['type']; $type = req_param('type', '');
$api->upload($token,$type); $api->upload($token,$type);
} }
// 上传图标 // 上传图标
function uploadImages(){ function uploadImages(){
global $api; global $api;
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取上传类型 //获取上传类型
$api->uploadImages($token); $api->uploadImages($token);
} }
//书签导入 //书签导入
function imp_link($api) { function imp_link($api) {
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取书签路径 //获取书签路径
$filename = trim($_POST['filename']); $filename = trim(req_param('filename', ''));
$fid = intval($_POST['fid']); $fid = intval(req_param('fid', ''));
$property = intval(@$_POST['property']); $property = intval(req_param('property', ''));
$api->imp_link($token,$filename,$fid,$property); $api->imp_link($token,$filename,$fid,$property);
} }
//新版书签批量导入并自动创建分类 //新版书签批量导入并自动创建分类
function import_link($api) { function import_link($api) {
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
//获取书签路径 //获取书签路径
$filename = trim($_POST['filename']); $filename = trim(req_param('filename', ''));
$fid = intval($_POST['fid']); $fid = intval(req_param('fid', ''));
$property = intval(@$_POST['property']); $property = intval(req_param('property', ''));
$api->import_link($filename,$property); $api->import_link($filename,$property);
} }
//检查弱密码 //检查弱密码
function check_weak_password($api) { function check_weak_password($api) {
//获取token //获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
$api->check_weak_password($token); $api->check_weak_password($token);
} }
@ -318,14 +352,14 @@ function get_sql_update_list($api){
//执行SQL更新 //执行SQL更新
function exe_sql($api) { function exe_sql($api) {
$data['name'] = htmlspecialchars(trim($_GET['name'])); $data['name'] = htmlspecialchars(trim(req_param('name', '')));
$api->exe_sql($data); $api->exe_sql($data);
} }
//设置options表 //设置options表
function set_theme($api) { function set_theme($api) {
$key = 's_themes'; $key = 's_themes';
$value = $_POST['value']; $value = req_param('value', '');
$api->set_option($key,$value); $api->set_option($key,$value);
} }
@ -333,23 +367,23 @@ function set_theme($api) {
function set_site($api) { function set_site($api) {
//获取传递过来的参数 //获取传递过来的参数
//获取网站标题 //获取网站标题
$data['title'] = htmlspecialchars($_POST['title']); $data['title'] = htmlspecialchars(req_param('title', ''));
//获取网站logo //获取网站logo
$data['logo'] = htmlspecialchars($_POST['logo']); $data['logo'] = htmlspecialchars(req_param('logo', ''));
//获取副标题 //获取副标题
$data['subtitle'] = htmlspecialchars($_POST['subtitle']); $data['subtitle'] = htmlspecialchars(req_param('subtitle', ''));
//获取关键词 //获取关键词
$data['keywords'] = htmlspecialchars($_POST['keywords']); $data['keywords'] = htmlspecialchars(req_param('keywords', ''));
//获取描述 //获取描述
$data['description'] = htmlspecialchars($_POST['description']); $data['description'] = htmlspecialchars(req_param('description', ''));
//获取自定义header //获取自定义header
$data['custom_header'] = $_POST['custom_header']; $data['custom_header'] = req_param('custom_header', '');
//获取自定义footer //获取自定义footer
$data['custom_footer'] = $_POST['custom_footer']; $data['custom_footer'] = req_param('custom_footer', '');
//获取链接模式 //获取链接模式
$data['link_model'] = $_POST['link_model']; $data['link_model'] = req_param('link_model', '');
// 获取链接数量 // 获取链接数量
$data['link_num'] = $_POST['link_num']; $data['link_num'] = req_param('link_num', '');
//序列化存储 //序列化存储
$value = serialize($data); $value = serialize($data);
@ -390,11 +424,11 @@ function _deny_set($content,$err_msg) {
//设置订阅信息 //设置订阅信息
function set_subscribe($api) { function set_subscribe($api) {
//获取订单ID //获取订单ID
$data['order_id'] = htmlspecialchars( trim($_POST['order_id']) ); $data['order_id'] = htmlspecialchars( trim(req_param('order_id', '')) );
//获取邮箱 //获取邮箱
$data['email'] = htmlspecialchars( trim($_POST['email']) ); $data['email'] = htmlspecialchars( trim(req_param('email', '')) );
//到期时间 //到期时间
$data['end_time'] = htmlspecialchars( trim($_POST['end_time']) ); $data['end_time'] = htmlspecialchars( trim(req_param('end_time', '')) );
//重置订阅状态 //重置订阅状态
session_start(); session_start();
$_SESSION['subscribe'] = NULL; $_SESSION['subscribe'] = NULL;
@ -415,7 +449,7 @@ function up_updater($api) {
} }
//验证当前版本是否匹配 //验证当前版本是否匹配
function check_version($api) { function check_version($api) {
$version = $_REQUEST['version']; $version = req_param('version', '');
$api->check_version($version); $api->check_version($version);
} }
@ -423,18 +457,18 @@ function check_version($api) {
function set_transition_page($api) { function set_transition_page($api) {
//获取传递过来的参数 //获取传递过来的参数
//获取开关 //获取开关
$data['control'] = htmlspecialchars(trim($_POST['control'])); $data['control'] = htmlspecialchars(trim(req_param('control', '')));
//获取游客停留时间 //获取游客停留时间
$data['visitor_stay_time'] = intval($_POST['visitor_stay_time']); $data['visitor_stay_time'] = intval(req_param('visitor_stay_time', ''));
//获取管理员停留时间 //获取管理员停留时间
$data['admin_stay_time'] = intval($_POST['admin_stay_time']); $data['admin_stay_time'] = intval(req_param('admin_stay_time', ''));
//获取菜单 //获取菜单
$data['menu'] = $_POST['menu']; $data['menu'] = req_param('menu', '');
//获取footer //获取footer
$data['footer'] = $_POST['footer']; $data['footer'] = req_param('footer', '');
//获取广告 //获取广告
$data['a_d_1'] = $_POST['a_d_1']; $data['a_d_1'] = req_param('a_d_1', '');
$data['a_d_2'] = $_POST['a_d_2']; $data['a_d_2'] = req_param('a_d_2', '');
//验证订阅 //验证订阅
@ -490,9 +524,9 @@ function get_latest_version() {
//批量修改链接分类 //批量修改链接分类
function batch_modify_category($api) { function batch_modify_category($api) {
//获取id列表 //获取id列表
$id = $_POST['id']; $id = req_param('id', '');
//获取分类ID //获取分类ID
$fid = intval($_POST['fid']); $fid = intval(req_param('fid', ''));
$data = [ $data = [
'id' => $id, 'id' => $id,
@ -616,8 +650,8 @@ function export_json($api) {
// 批量设置链接私有属性 // 批量设置链接私有属性
function set_link_attribute($api) { function set_link_attribute($api) {
$ids = $_POST['ids']; $ids = req_param('ids', []);
$property = intval( $_POST['property'] ); $property = intval( req_param('property', '') );
$data = [ $data = [
"ids" => $ids, "ids" => $ids,
"property" => $property "property" => $property
@ -627,23 +661,23 @@ function set_link_attribute($api) {
//获取用户登录状态 //获取用户登录状态
function check_login($api) { function check_login($api) {
$token = trim($_REQUEST['token']); $token = trim(req_param('token'));
$api->check_login($token); $api->check_login($token);
} }
//删除主题 //删除主题
function delete_theme($api) { function delete_theme($api) {
$name = $_REQUEST['name']; $name = req_param('name', '');
$api->delete_theme($name); $api->delete_theme($name);
} }
//下载主题 //下载主题
function down_theme() { function down_theme() {
global $api; global $api;
$data['name'] = trim($_GET['name']); $data['name'] = trim(req_param('name', ''));
$data['key'] = trim( $_GET['key'] ); $data['key'] = trim( req_param('key', '') );
$data['value'] = trim( $_GET['value'] ); $data['value'] = trim( req_param('value', '') );
$data['type'] = trim( $_GET['type'] ); $data['type'] = trim( req_param('type', '') );
$api->down_theme($data); $api->down_theme($data);
} }
@ -663,20 +697,20 @@ function backup_db_list() {
//删除单个数据库备份 //删除单个数据库备份
function del_backup_db() { function del_backup_db() {
global $api; global $api;
$name = @$_GET['name']; $name = req_param('name', '');
$api->del_backup_db($name); $api->del_backup_db($name);
} }
//回滚数据库 //回滚数据库
function restore_db() { function restore_db() {
global $api; global $api;
$name = @$_REQUEST['name']; $name = req_param('name', '');
$api->restore_db($name); $api->restore_db($name);
} }
//获取APPINFO //获取APPINFO
function app_info() { function app_info() {
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']; $token = req_token();
global $api; global $api;
$api->app_info($token); $api->app_info($token);
@ -685,7 +719,7 @@ function app_info() {
//下载数据库 //下载数据库
function down_db() { function down_db() {
global $api; global $api;
$name = $_GET['name']; $name = req_param('name', '');
$api->down_db($name); $api->down_db($name);
} }
@ -694,10 +728,10 @@ function create_share() {
global $api; global $api;
$data['add_time'] = date("Y-m-d H:i:s",time()); $data['add_time'] = date("Y-m-d H:i:s",time());
$data['expire_time'] = $_POST['expire_time']; $data['expire_time'] = req_param('expire_time', '');
$data['password'] = trim($_POST['password']); $data['password'] = trim(req_param('password', ''));
$data['cid'] = intval($_POST['cid']); $data['cid'] = intval(req_param('cid', ''));
$data['note'] = $_POST['note']; $data['note'] = req_param('note', '');
$api->create_share($data); $api->create_share($data);
} }
@ -705,8 +739,8 @@ function create_share() {
//分享列表 //分享列表
function share_list() { function share_list() {
global $api; global $api;
$page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']); $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']); $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
$data = [ $data = [
'page' => $page, 'page' => $page,
@ -719,15 +753,15 @@ function share_list() {
//获取SID下的链接 //获取SID下的链接
function get_sid_links() { function get_sid_links() {
global $api; global $api;
$data['sid'] = trim($_POST['sid']); $data['sid'] = trim(req_param('sid', ''));
$data['password'] = trim($_POST['password']); $data['password'] = trim(req_param('password', ''));
$api->get_sid_links($data); $api->get_sid_links($data);
} }
//删除分享 //删除分享
function del_share() { function del_share() {
global $api; global $api;
$data['id'] = intval($_GET['id']); $data['id'] = intval(req_param('id', ''));
//var_dump($data['id']); //var_dump($data['id']);
$api->del_share($data); $api->del_share($data);
@ -753,8 +787,8 @@ function edit_link_row(){
// 批量修改分类属性 // 批量修改分类属性
function set_cat_batch() { function set_cat_batch() {
$data['ids'] = $_POST['ids']; $data['ids'] = req_param('ids', []);
$data['property'] = $_POST['property']; $data['property'] = req_param('property', '');
global $api; global $api;
$api->set_cat_batch($data); $api->set_cat_batch($data);
} }

4
controller/bing.php
Unescape View File

@ -6,9 +6,9 @@ header('Content-Type:application/json; charset=utf-8');
// 载入辅助函数 // 载入辅助函数
require('functions/helper.php'); require('functions/helper.php');
//获取当前主机名 //获取当前主机名
$host = $_SERVER['HTTP_HOST']; $host = $_SERVER['HTTP_HOST'] ?? '';
//获取reffrer //获取reffrer
$referer = $_SERVER['HTTP_REFERER']; $referer = $_SERVER['HTTP_REFERER'] ?? '';
//如果referer和主机名不匹配，则禁止调用 //如果referer和主机名不匹配，则禁止调用
if ( ( !empty($referer) ) && ( !strstr($referer,$host) ) ) { if ( ( !empty($referer) ) && ( !strstr($referer,$host) ) ) {

19
controller/click.php
Unescape View File

@ -3,7 +3,7 @@
require('functions/helper.php'); require('functions/helper.php');
//获取link.id //获取link.id
$id = intval($_GET['id']); $id = intval($_GET['id'] ?? 0);
//如果链接为空 //如果链接为空
if(empty($id)) { if(empty($id)) {
@ -28,8 +28,10 @@ if( !$link ){
$category = $db->get('on_categorys',['id','property'],[ $category = $db->get('on_categorys',['id','property'],[
'id' => $link['fid'] 'id' => $link['fid']
]); ]);
$category = $category ?: [];
//判断用户是否登录 //判断用户是否登录
$is_login = FALSE;
if( is_login() ) { if( is_login() ) {
$is_login = TRUE; $is_login = TRUE;
} }
@ -37,13 +39,22 @@ if( is_login() ) {
//查询过渡页设置 //查询过渡页设置
$transition_page = $db->get('on_options','value',[ 'key' => "s_transition_page" ]); $transition_page = $db->get('on_options','value',[ 'key' => "s_transition_page" ]);
$transition_page = unserialize($transition_page); $transition_page = unserialize($transition_page);
if ( !is_array($transition_page) ) {
$transition_page = [];
}
$transition_page = array_merge([
'control' => 'on',
'visitor_stay_time' => 5,
'admin_stay_time' => 1,
'a_d_1' => '',
'a_d_2' => ''
], $transition_page);
//获取当前站点信息 //获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]); $site = get_site_setting();
$site = unserialize($site);
//link.id为公有，且category.id为公有 //link.id为公有，且category.id为公有
if( ( $link['property'] == 0 ) && ($category['property'] == 0) ){ if( ( $link['property'] == 0 ) && ( ($category['property'] ?? 0) == 0) ){
//增加link.id的点击次数 //增加link.id的点击次数
$click = $link['click'] + 1; $click = $link['click'] + 1;
//更新数据库 //更新数据库

6
controller/ico.php
Unescape View File

@ -77,13 +77,13 @@ function hsv2rgb($h, $s, $v)
*/ */
function output_ico() { function output_ico() {
//获取文字 //获取文字
$text = @trim($_GET['text']); $text = trim($_GET['text'] ?? '');
$text = empty($text) ? '空' : $text; $text = empty($text) ? '空' : $text;
//获取当前主机名 //获取当前主机名
$host = $_SERVER['HTTP_HOST']; $host = $_SERVER['HTTP_HOST'] ?? '';
//获取reffrer //获取reffrer
$referer = $_SERVER['HTTP_REFERER']; $referer = $_SERVER['HTTP_REFERER'] ?? '';
//如果referer和主机名不匹配，则禁止调用 //如果referer和主机名不匹配，则禁止调用
if ( ( !empty($referer) ) && ( !strstr($referer,$host) ) ) { if ( ( !empty($referer) ) && ( !strstr($referer,$host) ) ) {

31
controller/index.php
Unescape View File

@ -3,17 +3,17 @@
* 首页模板入口 * 首页模板入口
*/ */
// 载入辅助函数
require('functions/helper.php');
//获取当前站点信息 //获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]); $site = get_site_setting();
$site = unserialize($site);
// 获取链接数量,默认为30 // 获取链接数量,默认为30
$link_num = empty( $site['link_num'] ) ? 30 : intval($site['link_num']); $link_num = empty( $site['link_num'] ) ? 30 : intval($site['link_num']);
// var_dump($link_num); // var_dump($link_num);
//如果已经登录，获取所有分类和链接 //如果已经登录，获取所有分类和链接
// 载入辅助函数
require('functions/helper.php');
// 明文密码检查 // 明文密码检查
unSafe(); unSafe();
@ -211,7 +211,7 @@ $templates = $db->get("on_options","value",[
"key" => "s_themes" "key" => "s_themes"
]); ]);
// 获取UA // 获取UA
$userAgent = $_SERVER['HTTP_USER_AGENT']; $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$mobileKeywords = [ $mobileKeywords = [
'mobile', 'android', 'iphone' 'mobile', 'android', 'iphone'
]; ];
@ -237,7 +237,7 @@ if (empty($templates)) {
//获取用户传递的主题参数 //获取用户传递的主题参数
$theme = trim( @$_GET['theme'] ); $theme = trim( $_GET['theme'] ?? '' );
//如果用户传递了主题参数 //如果用户传递了主题参数
if( !empty($theme) ) { if( !empty($theme) ) {
//获取所有主题 //获取所有主题
@ -274,12 +274,16 @@ $config_content = @file_get_contents($config_file);
//如果是info.json,则特殊处理下 //如果是info.json,则特殊处理下
if ( strstr($config_file,"info.json") ) { if ( strstr($config_file,"info.json") ) {
$config_content = json_decode($config_content); $config_content = json_decode($config_content);
$theme_config = $config_content->config; $theme_config = ( is_object($config_content) && isset($config_content->config) )
? $config_content->config
: (object) [];
} }
else{ else{
$config_content = $config_content;
$theme_config = json_decode($config_content); $theme_config = json_decode($config_content);
} }
if ( !is_object($theme_config) ) {
$theme_config = (object) [];
}
@ -327,8 +331,14 @@ $search_engines = [
//获取主题的最低版本要求 //获取主题的最低版本要求
$info_json = @file_get_contents($tpl_dir.$template."/info.json"); $info_json = @file_get_contents($tpl_dir.$template."/info.json");
$info = (object) [
'version' => ''
];
if( $info_json ) { if( $info_json ) {
$info = json_decode($info_json); $decoded_info = json_decode($info_json);
if ( is_object($decoded_info) ) {
$info = (object) array_merge( (array) $info, (array) $decoded_info );
}
$min_version = @$info->require->min; $min_version = @$info->require->min;
//获取到了最低版本 //获取到了最低版本
@ -343,7 +353,8 @@ if( $info_json ) {
// 该分类下可见的链接数量 // 该分类下可见的链接数量
function get_links_number($fid){ function get_links_number($fid){
$number = count(get_links($fid)); $links = get_links($fid);
$number = is_array($links) ? count($links) : 0;
// var_dump($number); // var_dump($number);
return $number; return $number;
} }

24
controller/init.php
Unescape View File

@ -10,32 +10,32 @@
function check_env() { function check_env() {
//获取组件信息 //获取组件信息
$ext = get_loaded_extensions(); $ext = get_loaded_extensions();
//检查PHP版本，需要大于7.0小于8.0 //检查PHP版本，最低要求7.2，兼容8.x
$php_version = floatval(PHP_VERSION); $php_version = PHP_VERSION;
$uri = $_SERVER["REQUEST_URI"]; $uri = $_SERVER["REQUEST_URI"] ?? '';
// var_dump($uri); // var_dump($uri);
if( ( $php_version < 7 ) || ( $php_version > 8 ) ) { if ( version_compare($php_version, '7.2.0', '<') ) {
exit("当前PHP版本{$php_version}不满足要求，需要7.0 <= PHP <= 7.4"); exit("当前PHP版本{$php_version}不满足要求，需要PHP >= 7.2");
} }
//检查是否支持pdo_sqlite //检查是否支持pdo_sqlite
if ( !array_search('pdo_sqlite',$ext) ) { if ( !in_array('pdo_sqlite', $ext, true) ) {
exit("不支持PDO_SQLITE组件，请先开启!"); exit("不支持PDO_SQLITE组件，请先开启!");
} }
if ( !array_search('openssl', $ext) ) { if ( !in_array('openssl', $ext, true) ) {
exit("不支持OPENSSL组件，请先开启!"); exit("不支持OPENSSL组件，请先开启!");
} }
//检查是否支持zlib //检查是否支持zlib
if ( !array_search('zlib', $ext) ) { if ( !in_array('zlib', $ext, true) ) {
exit("不支持ZLIB组件，请先开启!"); exit("不支持ZLIB组件，请先开启!");
} }
//检查是否支持curl //检查是否支持curl
if ( !array_search('curl', $ext) ) { if ( !in_array('curl', $ext, true) ) {
exit("不支持CURL组件，请先开启!"); exit("不支持CURL组件，请先开启!");
} }
@ -138,9 +138,9 @@ check_env();
if ( $c == 'init' ) { if ( $c == 'init' ) {
//接收POST参数 //接收POST参数
$email = htmlspecialchars(trim($_POST['email'])); $email = htmlspecialchars(trim($_POST['email'] ?? ''));
$username = htmlspecialchars(trim($_POST['username'])); $username = htmlspecialchars(trim($_POST['username'] ?? ''));
$password = htmlspecialchars(trim($_POST['password'])); $password = htmlspecialchars(trim($_POST['password'] ?? ''));
$data = [ $data = [
"email" => $email, "email" => $email,
"username" => $username, "username" => $username,

14
controller/login.php
Unescape View File

@ -13,9 +13,9 @@ $username = $site_setting['user'];
$password = ENCRYPTED_PASSWORD; $password = ENCRYPTED_PASSWORD;
$ip = getIP(); $ip = getIP();
//如果认证通过，直接跳转到后台管理 //如果认证通过，直接跳转到后台管理
$key = md5($username.$password.'onenav'.$_SERVER['HTTP_USER_AGENT']); $key = md5($username.$password.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//获取cookie //获取cookie
$cookie = $_COOKIE['key']; $cookie = $_COOKIE['key'] ?? '';
//获取版本号 //获取版本号
$version = new_get_version(); $version = new_get_version();
@ -27,16 +27,16 @@ if( is_login() ){
} }
//登录检查 //登录检查
if( $_GET['check'] == 'login' ) { if( ($_GET['check'] ?? '') == 'login' ) {
$user = trim($_POST['user']); $user = trim($_POST['user'] ?? '');
$pass = trim($_POST['password']); $pass = trim($_POST['password'] ?? '');
// 用户密码进行加密处理，加密算法为用户名 + 密码，再进行MD5加密 // 用户密码进行加密处理，加密算法为用户名 + 密码，再进行MD5加密
$pass = md5($user.$pass); $pass = md5($user.$pass);
header('Content-Type:application/json; charset=utf-8'); header('Content-Type:application/json; charset=utf-8');
if( ($user === $username) && ($pass === $password) ) { if( ($user === $username) && ($pass === $password) ) {
$key = md5($username.$password.'onenav'.$_SERVER['HTTP_USER_AGENT']); $key = md5($username.$password.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//开启httponly支持 //开启httponly支持
setcookie("key", $key, time()+30 * 24 * 60 * 60,"/",NULL,false,TRUE); setcookie("key", $key, time()+30 * 24 * 60 * 60,"/","",false,TRUE);
$data = [ $data = [
'code' => 0, 'code' => 0,
'msg' => 'successful' 'msg' => 'successful'

3
controller/universal.php
Unescape View File

@ -9,8 +9,7 @@ require('functions/helper.php');
$version = new_get_version(); $version = new_get_version();
//获取当前站点信息 //获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]); $site = get_site_setting();
$site = unserialize($site);
//载入视图 //载入视图

43
functions/helper.php
Unescape View File

@ -17,16 +17,16 @@ function getIP() {
$ip = getenv('HTTP_FORWARDED'); $ip = getenv('HTTP_FORWARDED');
} }
else { else {
$ip = $_SERVER['REMOTE_ADDR']; $ip = $_SERVER['REMOTE_ADDR'] ?? '';
} }
return $ip; return $ip;
} }
function is_login(){ function is_login(){
$key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.$_SERVER['HTTP_USER_AGENT']); $key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//获取session //获取session
$session = $_COOKIE['key']; $session = $_COOKIE['key'] ?? '';
//如果已经成功登录 //如果已经成功登录
if($session === $key) { if($session === $key) {
return true; return true;
@ -37,6 +37,29 @@ function is_login(){
} }
//后续全局函数全部以g_命名开头 //后续全局函数全部以g_命名开头
/**
* 获取站点设置，并补齐旧版本/种子库缺失的字段
*/
function get_site_setting() {
global $db;
$site = $db->get('on_options','value',[ 'key' => 's_site' ]);
$site = is_string($site) ? @unserialize($site) : $site;
if ( !is_array($site) ) {
$site = [];
}
return array_merge([
'title' => 'OneNav',
'logo' => 'OneNav',
'subtitle' => '',
'keywords' => '',
'description' => '',
'custom_header' => '',
'custom_footer' => '',
'link_model' => 'jump',
'link_num' => 30
], $site);
}
function g_extend_js() { function g_extend_js() {
//载入js扩展 //载入js扩展
if( file_exists('data/extend.js') ) { if( file_exists('data/extend.js') ) {
@ -102,7 +125,7 @@ function GetRandStr($len)
//跳转到手机版页面 //跳转到手机版页面
function jump_mobile() { function jump_mobile() {
$ua = $_SERVER['HTTP_USER_AGENT']; $ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
if( stristr($ua,'iphone') || stristr($ua,'android') ) { if( stristr($ua,'iphone') || stristr($ua,'android') ) {
header("Location: /index.php?c=mobile#/"); header("Location: /index.php?c=mobile#/");
@ -132,7 +155,7 @@ function get_all_themes() {
case 'admin': case 'admin':
case 'mobile': case 'mobile':
case 'universal': case 'universal':
continue; continue 2;
break; break;
default: default:
array_push($tpl_one,$value); array_push($tpl_one,$value);
@ -155,7 +178,7 @@ function get_all_themes() {
case '.': case '.':
case '..': case '..':
case 'admin': case 'admin':
continue; continue 2;
break; break;
default: default:
array_push($tpl_two,$value); array_push($tpl_two,$value);
@ -178,7 +201,7 @@ function get_all_themes() {
// 获取HOST，需要去除端口号 // 获取HOST，需要去除端口号
function get_host(){ function get_host(){
$host = $_SERVER['HTTP_HOST']; $host = $_SERVER['HTTP_HOST'] ?? '';
$parsed_host = parse_url($host); $parsed_host = parse_url($host);
//var_dump($parsed_host); //var_dump($parsed_host);
if (isset($parsed_host['port']) && $parsed_host['port'] != 80 && $parsed_host['port'] != 443) { if (isset($parsed_host['port']) && $parsed_host['port'] != 80 && $parsed_host['port'] != 443) {
@ -190,7 +213,9 @@ function get_host(){
// 获取当前域名，比如https://nav.rss.ink // 获取当前域名，比如https://nav.rss.ink
function getCurrentUrlDomain() { function getCurrentUrlDomain() {
$url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; $host = $_SERVER['HTTP_HOST'] ?? '';
$request_uri = $_SERVER['REQUEST_URI'] ?? '';
$url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://" . $host . $request_uri;
$url_parts = parse_url($url); $url_parts = parse_url($url);
@ -231,7 +256,7 @@ function check_all_cat(){
* name：检查是否存在明文密码参数，如果存在，则提示重新初始化 * name：检查是否存在明文密码参数，如果存在，则提示重新初始化
*/ */
function unSafe() { function unSafe() {
$password = @PASSWORD; $password = defined('PASSWORD') ? PASSWORD : null;
if( isset($password) && $password !== 'PASSWORD' ) { if( isset($password) && $password !== 'PASSWORD' ) {
exit("由于安全升级，请删除站点目录下的 data/config.php 文件后，重新完成初始化，此操作不会影响数据！"); exit("由于安全升级，请删除站点目录下的 data/config.php 文件后，重新完成初始化，此操作不会影响数据！");

2
index.php
Unescape View File

@ -7,7 +7,7 @@ header("content-Type: text/html; charset=Utf-8");
//获取控制器 //获取控制器
$c = @$_GET['c']; $c = @$_GET['c'];
//进行过滤 //进行过滤
$c = strip_tags($c); $c = strip_tags($c ?? '');
//读取版本号 //读取版本号
//$version = @file_get_contents("./functions/version.txt"); //$version = @file_get_contents("./functions/version.txt");
//载入配置文件 //载入配置文件

33
templates/admin/click.php
Unescape View File

@ -1,3 +1,23 @@
<?php
// 兼容直接通过后台页面参数加载模板的情况，保证变量和字段存在
$link = array_merge([
'title' => '',
'url' => '',
'url_standby' => '',
'description' => ''
], (isset($link) && is_array($link)) ? $link : []);
$site = array_merge([
'title' => 'OneNav',
'custom_header' => ''
], (isset($site) && is_array($site)) ? $site : []);
$transition_page = array_merge([
'visitor_stay_time' => 5,
'admin_stay_time' => 1,
'a_d_1' => '',
'a_d_2' => ''
], (isset($transition_page) && is_array($transition_page)) ? $transition_page : []);
$is_login = isset($is_login) ? $is_login : FALSE;
?>
<!DOCTYPE html> <!DOCTYPE html>
<html lang="zh-cn" xmlns="http://www.w3.org/1999/xhtml"> <html lang="zh-cn" xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
@ -104,13 +124,8 @@
$visitor_stay_time = $transition_page['visitor_stay_time']; $visitor_stay_time = $transition_page['visitor_stay_time'];
//管理员停留时间 //管理员停留时间
$admin_stay_time = $transition_page['admin_stay_time']; $admin_stay_time = $transition_page['admin_stay_time'];
$refresh_time = $is_login ? $admin_stay_time : $visitor_stay_time;
if ($is_login) { echo '<meta http-equiv="refresh" content="'.intval($refresh_time).';url='.htmlspecialchars($link['url'], ENT_QUOTES).'">';
header("Refresh:$admin_stay_time;url=".$link['url']);
}
else{
header("Refresh:$visitor_stay_time;url=".$link['url']);
}
} }
?> ?>
@ -137,13 +152,13 @@
<div class="notice-title">即将跳转到外部网站</div> <div class="notice-title">即将跳转到外部网站</div>
<div class="notice-des">安全性未知，是否继续</div> <div class="notice-des">安全性未知，是否继续</div>
<div class="link" title="主链接"> <div class="link" title="主链接">
<span class="icon"><?xml?><svg width="24" height="24" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.2401 16.373L17.1001 7.23303C14.4388 4.57168 10.0653 4.6303 7.33158 7.36397C4.59791 10.0976 4.53929 14.4712 7.20064 17.1325L15.1359 25.0678" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M32.9027 23.0031L40.838 30.9384C43.4994 33.5998 43.4407 37.9733 40.7071 40.707C37.9734 43.4407 33.5999 43.4993 30.9385 40.8379L21.7985 31.6979" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M26.1093 26.1416C28.843 23.4079 28.9016 19.0344 26.2403 16.373" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M21.7989 21.7984C19.0652 24.5321 19.0066 28.9056 21.6679 31.5669" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/></svg></span> <span class="icon"><svg width="24" height="24" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M26.2401 16.373L17.1001 7.23303C14.4388 4.57168 10.0653 4.6303 7.33158 7.36397C4.59791 10.0976 4.53929 14.4712 7.20064 17.1325L15.1359 25.0678" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M32.9027 23.0031L40.838 30.9384C43.4994 33.5998 43.4407 37.9733 40.7071 40.707C37.9734 43.4407 33.5999 43.4993 30.9385 40.8379L21.7985 31.6979" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M26.1093 26.1416C28.843 23.4079 28.9016 19.0344 26.2403 16.373" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M21.7989 21.7984C19.0652 24.5321 19.0066 28.9056 21.6679 31.5669" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/></svg></span>
<a href="<?php echo $link['url']; ?>" rel = "nofollow" title = "<?php echo $link['title']; ?>"><?php echo $link['url']; ?></a> <a href="<?php echo $link['url']; ?>" rel = "nofollow" title = "<?php echo $link['title']; ?>"><?php echo $link['url']; ?></a>
</div> </div>
<?php if( !empty( $link['url_standby'] ) ) { ?> <?php if( !empty( $link['url_standby'] ) ) { ?>
<div class="link" title = "备用链接"> <div class="link" title = "备用链接">
<span class="icon"> <span class="icon">
<?xml?><svg width="24" height="24" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M30 19H20C15.5817 19 12 22.5817 12 27C12 31.4183 15.5817 35 20 35H36C40.4183 35 44 31.4183 44 27C44 24.9711 43.2447 23.1186 42 21.7084" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M6 24.2916C4.75527 22.8814 4 21.0289 4 19C4 14.5817 7.58172 11 12 11H28C32.4183 11 36 14.5817 36 19C36 23.4183 32.4183 27 28 27H18" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/></svg> <svg width="24" height="24" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M30 19H20C15.5817 19 12 22.5817 12 27C12 31.4183 15.5817 35 20 35H36C40.4183 35 44 31.4183 44 27C44 24.9711 43.2447 23.1186 42 21.7084" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/><path d="M6 24.2916C4.75527 22.8814 4 21.0289 4 19C4 14.5817 7.58172 11 12 11H28C32.4183 11 36 14.5817 36 19C36 23.4183 32.4183 27 28 27H18" stroke="#f3f3f3" stroke-width="4" stroke-linecap="round" stroke-linejoin="bevel"/></svg>
</span> </span>
<a href="<?php echo $link['url_standby']; ?>" rel = "nofollow" title = "<?php echo $link['title']; ?>"><?php echo $link['url_standby']; ?></a> <a href="<?php echo $link['url_standby']; ?>" rel = "nofollow" title = "<?php echo $link['title']; ?>"><?php echo $link['url_standby']; ?></a>
</div> </div>

2
templates/admin/edit_category.php
Unescape View File

@ -140,7 +140,7 @@
// 每页显示数量，默认12 // 每页显示数量，默认12
limit: 30, limit: 30,
// 点击回调 // 点击回调
value:'<?php echo str_replace("fa ","",$category_one["font_icon"]); ?>', //自定义默认图标 value:'<?php echo str_replace("fa ","",$category_one["font_icon"] ?? ''); ?>', //自定义默认图标
click: function(data) { click: function(data) {
console.log(data); console.log(data);
}, },

2
templates/admin/edit_category_new.php
Unescape View File

@ -138,7 +138,7 @@
// 每页显示数量，默认12 // 每页显示数量，默认12
limit: 30, limit: 30,
// 点击回调 // 点击回调
value:'<?php echo str_replace("fa ","",$category_one["font_icon"]); ?>', //自定义默认图标 value:'<?php echo str_replace("fa ","",$category_one["font_icon"] ?? ''); ?>', //自定义默认图标
click: function(data) { click: function(data) {
console.log(data); console.log(data);
}, },

1
templates/admin/setting/api.php
Unescape View File

@ -1,4 +1,3 @@
<?php echo $transition_page['control']; ?>
<!-- API页面设置 --> <!-- API页面设置 -->
<?php require_once(dirname(__DIR__).'/header.php'); ?> <?php require_once(dirname(__DIR__).'/header.php'); ?>
<?php include_once(dirname(__DIR__).'/left.php'); ?> <?php include_once(dirname(__DIR__).'/left.php'); ?>

1
templates/admin/setting/backup.php
Unescape View File

@ -1,4 +1,3 @@
<?php echo $transition_page['control']; ?>
<!-- API页面设置 --> <!-- API页面设置 -->
<?php require_once(dirname(__DIR__).'/header.php'); ?> <?php require_once(dirname(__DIR__).'/header.php'); ?>
<?php include_once(dirname(__DIR__).'/left.php'); ?> <?php include_once(dirname(__DIR__).'/left.php'); ?>

1
templates/admin/setting/share.php
Unescape View File

@ -1,4 +1,3 @@
<?php echo $transition_page['control']; ?>
<!-- API页面设置 --> <!-- API页面设置 -->
<?php require_once(dirname(__DIR__).'/header.php'); ?> <?php require_once(dirname(__DIR__).'/header.php'); ?>
<?php include_once(dirname(__DIR__).'/left.php'); ?> <?php include_once(dirname(__DIR__).'/left.php'); ?>

6
templates/admin/setting/site.php
Unescape View File

@ -48,7 +48,7 @@
<div class="layui-form-item"> <div class="layui-form-item">
<label class="layui-form-label">直链模式</label> <label class="layui-form-label">直链模式</label>
<div class="layui-input-inline"> <div class="layui-input-inline">
<?php if( $site['link_model'] === 'direct' ) { ?> <?php if( ($site['link_model'] ?? 'jump') === 'direct' ) { ?>
<input type="radio" name="link_model" value="jump" title="关闭"> <input type="radio" name="link_model" value="jump" title="关闭">
<input type="radio" name="link_model" value="direct" title="开启" checked> <input type="radio" name="link_model" value="direct" title="开启" checked>
<?php }else{ ?> <?php }else{ ?>
@ -62,7 +62,7 @@
<div class="layui-form-item"> <div class="layui-form-item">
<label class="layui-form-label">链接数量</label> <label class="layui-form-label">链接数量</label>
<div class="layui-input-inline"> <div class="layui-input-inline">
<input type="number" name="link_num" value = "<?php echo $site['link_num']; ?>" autocomplete="off" placeholder="分类需要展示的链接数量" class="layui-input"> <input type="number" name="link_num" value = "<?php echo $site['link_num'] ?? 30; ?>" autocomplete="off" placeholder="分类需要展示的链接数量" class="layui-input">
</div> </div>
<div class="layui-form-mid layui-word-aux">指的是首页单个分类下需要展示的链接数量，默认30，值越低，性能越好</div> <div class="layui-form-mid layui-word-aux">指的是首页单个分类下需要展示的链接数量，默认30，值越低，性能越好</div>
</div> </div>
@ -84,7 +84,7 @@
<div class="layui-form-item layui-form-text"> <div class="layui-form-item layui-form-text">
<label class="layui-form-label">自定义footer(支持HTML代码，订阅可用)</label> <label class="layui-form-label">自定义footer(支持HTML代码，订阅可用)</label>
<div class="layui-input-block"> <div class="layui-input-block">
<textarea name = "custom_footer" placeholder="自定义站点底部信息，请填写HTML代码" class="layui-textarea"><?php echo $site['custom_footer']; ?></textarea> <textarea name = "custom_footer" placeholder="自定义站点底部信息，请填写HTML代码" class="layui-textarea"><?php echo $site['custom_footer'] ?? ''; ?></textarea>
</div> </div>
</div> </div>

2
templates/admin/setting/subscribe.php
Unescape View File

@ -53,7 +53,7 @@
<div class="layui-form-item" style = "display:none;"> <div class="layui-form-item" style = "display:none;">
<label class="layui-form-label">域名</label> <label class="layui-form-label">域名</label>
<div class="layui-input-block"> <div class="layui-input-block">
<input type="text" name="domain" id = "domain" value = "<?php echo $_SERVER['HTTP_HOST']; ?>" autocomplete="off" placeholder="网站域名" class="layui-input"> <input type="text" name="domain" id = "domain" value = "<?php echo $_SERVER['HTTP_HOST'] ?? ''; ?>" autocomplete="off" placeholder="网站域名" class="layui-input">
</div> </div>
</div> </div>

7
templates/default/index.php
Unescape View File

@ -27,7 +27,7 @@
</head> </head>
<?php <?php
// 根据cookie来设置mdui主题 // 根据cookie来设置mdui主题
$md_theme = $_COOKIE['docs-theme-layout']; $md_theme = $_COOKIE['docs-theme-layout'] ?? '';
if( empty($md_theme) || ( $md_theme == "light" ) ) { if( empty($md_theme) || ( $md_theme == "light" ) ) {
$md_theme = ""; $md_theme = "";
} }
@ -172,6 +172,9 @@
<?php foreach ( $categorys as $category ) { <?php foreach ( $categorys as $category ) {
$fid = $category['id']; $fid = $category['id'];
$links = $get_links($fid); $links = $get_links($fid);
if ( !is_array($links) ) {
$links = [];
}
$font_icon = empty($category['font_icon']) ? '' : "<i class='{$category['font_icon']}'></i> "; $font_icon = empty($category['font_icon']) ? '' : "<i class='{$category['font_icon']}'></i> ";
//如果分类是私有的 //如果分类是私有的
if( $category['property'] == 1 ) { if( $category['property'] == 1 ) {
@ -192,7 +195,7 @@
$link['description'] = empty($link['description']) ? '作者很懒，没有填写描述。' : $link['description']; $link['description'] = empty($link['description']) ? '作者很懒，没有填写描述。' : $link['description'];
$id = $link['id']; $id = $link['id'];
//直链模式 //直链模式
if( $site['link_model'] === 'direct' ) { if( ($site['link_model'] ?? 'jump') === 'direct' ) {
$url = $link['url']; $url = $link['url'];
} }
else{ else{

5
templates/minima/index.php
Unescape View File

@ -127,6 +127,9 @@
<?php foreach ($categorys as $category) { <?php foreach ($categorys as $category) {
$fid = $category['id']; $fid = $category['id'];
$links = $get_links($fid); $links = $get_links($fid);
if ( !is_array($links) ) {
$links = [];
}
$font_icon = empty($category['font_icon']) ? 'fa fa-folder' : $category['font_icon']; $font_icon = empty($category['font_icon']) ? 'fa fa-folder' : $category['font_icon'];
// 如果分类是私有的 // 如果分类是私有的
@ -152,7 +155,7 @@
$id = $link['id']; $id = $link['id'];
// 直链模式 // 直链模式
if( $site['link_model'] === 'direct' ) { if( ($site['link_model'] ?? 'jump') === 'direct' ) {
$url = $link['url']; $url = $link['url'];
} else { } else {
$url = '/index.php?c=click&id='.$link['id']; $url = '/index.php?c=click&id='.$link['id'];

Write Preview
Loading…
Cancel
Save