xiaoz
/
onenav
mirror of https://github.com/helloxz/onenav.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

支持php 8.X

pull/244/head
xiaoz 2 days ago
parent
cb3d61a6fa
commit
d232089b02
22 changed files with 378 additions and 245 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 120
      class/Api.php
  2. 59
      controller/admin.php
  3. 260
      controller/api.php
  4. 4
      controller/bing.php
  5. 19
      controller/click.php
  6. 6
      controller/ico.php
  7. 31
      controller/index.php
  8. 8
      controller/init.php
  9. 14
      controller/login.php
  10. 3
      controller/universal.php
  11. 41
      functions/helper.php
  12. 2
      index.php
  13. 29
      templates/admin/click.php
  14. 2
      templates/admin/edit_category.php
  15. 2
      templates/admin/edit_category_new.php
  16. 1
      templates/admin/setting/api.php
  17. 1
      templates/admin/setting/backup.php
  18. 1
      templates/admin/setting/share.php
  19. 6
      templates/admin/setting/site.php
  20. 2
      templates/admin/setting/subscribe.php
  21. 7
      templates/default/index.php
  22. 5
      templates/minima/index.php

120
class/Api.php
Unescape View File

@ -213,13 +213,22 @@ class Api { @@ -213,13 +213,22 @@ class Api {
protected function auth($token){
// 当方法没有传递token的时候，则先尝试通过POST/GET获取token
if( empty($token) ) {
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
if ( !empty($_POST['token']) ) {
$token = $_POST['token'];
}
else if ( isset($_GET['token']) ) {
$token = $_GET['token'];
}
else {
$token = '';
}
}
//计算正确的token：用户名 + TOKEN
$SecretKey = @$this->db->get('on_options','*',[ 'key' => 'SecretKey' ])['value'];
$secret_row = $this->db->get('on_options','*',[ 'key' => 'SecretKey' ]);
$SecretKey = $secret_row['value'] ?? '';
$token_yes = md5(USER.$SecretKey);
//获取header中的X-token
$xtoken = $_SERVER['HTTP_X_TOKEN'];
$xtoken = $_SERVER['HTTP_X_TOKEN'] ?? '';
//如果通过header传递token，且验证通过
if( !empty($xtoken) && ($xtoken === $token_yes) ) {
@ -300,7 +309,7 @@ class Api { @@ -300,7 +309,7 @@ class Api {
* 批量修改链接分类
*/
public function batch_modify_category($data) {
$this->auth($token);
$this->auth(null);
//获取链接ID，是一个数组
$id = implode(',',$data['id']);
//获取分类ID
@ -331,7 +340,7 @@ class Api { @@ -331,7 +340,7 @@ class Api {
* 批量修改链接属性为公有或私有
*/
public function set_link_attribute($data) {
$this->auth($token);
$this->auth(null);
//获取链接ID，是一个数组
$ids = implode(',',$data['ids']);
$property = intval($data['property']);
@ -352,7 +361,7 @@ class Api { @@ -352,7 +361,7 @@ class Api {
*
*/
public function set_cat_batch($data) {
$this->auth($token);
$this->auth(null);
//获取链接ID，是一个数组
$ids = implode(',',$data['ids']);
$property = intval($data['property']);
@ -466,7 +475,7 @@ class Api { @@ -466,7 +475,7 @@ class Api {
//过滤$filename
$filename = str_replace('../','',$filename);
$filename = str_replace('./','',$filename);
$this->auth($token);
$this->auth(null);
//检查文件是否存在
if ( !file_exists($filename) ) {
$this->err_msg(-1016,'File does not exist!');
@ -623,7 +632,7 @@ class Api { @@ -623,7 +632,7 @@ class Api {
*/
public function general_upload($path,$suffixs){
// 验证权限
$this->auth($token);
$this->auth(null);
// 存在错误，上传失败
if ($_FILES["file"]["error"] > 0)
{
@ -1043,7 +1052,7 @@ class Api { @@ -1043,7 +1052,7 @@ class Api {
*/
public function edit_link_row(){
//验证授权
$this->auth($token);
$this->auth(null);
// 获取POST请求中的JSON数据
$json_data = file_get_contents('php://input');
@ -1164,11 +1173,11 @@ class Api { @@ -1164,11 +1173,11 @@ class Api {
$offset = ($page - 1) * $limit;
// 验证登录或 token
if ($this->is_login() || (!empty($token) && $this->auth($token))) {
if ($this->is_login() || (!empty($token) && $this->auth(null))) {
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC";
$count = $this->db->count('on_categorys', '*');
} elseif (!empty($token)) {
$this->auth($token);
$this->auth(null);
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC";
$count = $this->db->count('on_categorys', '*');
} else {
@ -1253,12 +1262,12 @@ class Api { @@ -1253,12 +1262,12 @@ class Api {
$count = $this->db->count('on_links','*');
//如果成功登录，但token为空，获取所有
if( $this->is_login() || ( !empty($token) && $this->auth($token) ) ){
if( $this->is_login() || ( !empty($token) && $this->auth(null) ) ){
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
}
//如果token验证通过
elseif( (!empty($token)) && ($this->auth($token)) ) {
elseif( (!empty($token)) && ($this->auth(null)) ) {
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
}
//如果通过header传递的token验证成功，则获取所有
@ -1320,7 +1329,7 @@ class Api { @@ -1320,7 +1329,7 @@ class Api {
// }
//如果token验证通过
elseif( (!empty($token)) && ($this->auth($token)) ) {
elseif( (!empty($token)) && ($this->auth(null)) ) {
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links WHERE fid = $fid ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
}
//如果即没有登录成功，又没有token，则默认为游客,游客查询链接属性为公有，分类为公有，不查询私有
@ -1365,7 +1374,7 @@ class Api { @@ -1365,7 +1374,7 @@ class Api {
//分类属性为1，则说明是私有链接，则未认证用户不允许查询
if( $category_property === 1 ){
//进行认证
$this->auth($token);
$this->auth(null);
}
$datas = [
'code' => 0,
@ -1375,7 +1384,7 @@ class Api { @@ -1375,7 +1384,7 @@ class Api {
}
//如果是私有链接，并且认证通过
elseif( $link_info['property'] == "1" ) {
if ( ( $this->auth($token) ) || ( $this->is_login() ) ) {
if ( ( $this->auth(null) ) || ( $this->is_login() ) ) {
$datas = [
'code' => 0,
'data' => $link_info
@ -1418,7 +1427,7 @@ class Api { @@ -1418,7 +1427,7 @@ class Api {
}
//如果是私有链接，并且认证通过
elseif( $category_info['property'] == "1" ) {
if ( ( $this->auth($token) ) || ( $this->is_login() ) ) {
if ( ( $this->auth(null) ) || ( $this->is_login() ) ) {
$datas = [
'code' => 0,
'data' => $category_info
@ -1441,9 +1450,9 @@ class Api { @@ -1441,9 +1450,9 @@ class Api {
* 验证是否登录
*/
protected function is_login(){
$key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.$_SERVER['HTTP_USER_AGENT']);
$key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//获取session
$session = $_COOKIE['key'];
$session = $_COOKIE['key'] ?? '';
//如果已经成功登录
if($session == $key) {
return true;
@ -1806,7 +1815,7 @@ class Api { @@ -1806,7 +1815,7 @@ class Api {
if( $insert_re ) {
$data = [
"code" => 0,
"data" => $name."更新完成！总数${num}，成功：${init_num}"
"data" => $name."更新完成！总数{$num}，成功：{$init_num}"
];
exit(json_encode($data));
}
@ -1822,7 +1831,7 @@ class Api { @@ -1822,7 +1831,7 @@ class Api {
* 保存主题参数
*/
public function save_theme_config($data) {
$this->auth($token);
$this->auth(null);
//获取主题名称
$name = $data['name'];
//获取config参数,是一个对象
@ -1850,7 +1859,7 @@ class Api { @@ -1850,7 +1859,7 @@ class Api {
*/
public function delete_theme($name) {
//验证授权
$this->auth($token);
$this->auth(null);
//正则判断主题名称是否合法
$pattern = "/^[a-zA-Z0-9][a-zA-Z0-9-_]+[a-zA-Z0-9]$/";
if ( !preg_match($pattern,$name) ) {
@ -1973,7 +1982,7 @@ class Api { @@ -1973,7 +1982,7 @@ class Api {
*/
public function set_option($key,$value = '') {
// 验证授权
$this->auth($token);
$this->auth(null);
$key = htmlspecialchars(trim($key));
//如果key是空的
if( empty($key) ) {
@ -2025,7 +2034,7 @@ class Api { @@ -2025,7 +2034,7 @@ class Api {
*/
public function new_set_option(){
// 验证授权
$this->auth($token);
$this->auth(null);
// 获取key
$key = trim(@$_POST['key']);
// 获取value
@ -2132,7 +2141,7 @@ class Api { @@ -2132,7 +2141,7 @@ class Api {
*/
public function check_subscribe() {
//验证token是否合法
$this->auth($token);
$this->auth(null);
//获取订阅信息
//获取当前站点信息
$subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]);
@ -2191,9 +2200,9 @@ class Api { @@ -2191,9 +2200,9 @@ class Api {
$key = $data['key'];
$value = $data['value'];
//拼接主题URL
$url = API_URL."/v1/down_theme.php?name=${name}&key=${key}&value=${value}";
$url = API_URL."/v1/down_theme.php?name={$name}&key={$key}&value={$value}";
//验证token是否合法
$this->auth($token);
$this->auth(null);
//检查主题是否已经存在
if ( $data['type'] == 'download' ) {
$theme1 = "templates/".$name;
@ -2223,7 +2232,7 @@ class Api { @@ -2223,7 +2232,7 @@ class Api {
$theme_dir = "templates";
}
//主题完整压缩包路径
$file_name = $theme_dir."/${name}.tar.gz";
$file_name = $theme_dir."/{$name}.tar.gz";
if( !is_dir($theme_dir) ) {
mkdir($theme_dir,0755);
}
@ -2233,7 +2242,7 @@ class Api { @@ -2233,7 +2242,7 @@ class Api {
//下载主题，并设置超时时间为120s
$content = $this->curl_get($url,120);
//写入主题
$re = file_put_contents($theme_dir."/${name}.tar.gz",$content);
$re = file_put_contents($theme_dir."/{$name}.tar.gz",$content);
//如果写入主题失败了，说明权限不粗糙
if( !$re ) {
$this->return_json(-2000,'','主题写入失败，请检查目录权限！');
@ -2242,7 +2251,7 @@ class Api { @@ -2242,7 +2251,7 @@ class Api {
//解压文件
$phar = new PharData($file_name);
//路径 要解压的文件 是否覆盖
$phar->extractTo($theme_dir."/${name}", null, true);
$phar->extractTo($theme_dir."/{$name}", null, true);
//删除主题
unlink($file_name);
$this->return_json(200,'','主题下载成功！');
@ -2263,16 +2272,19 @@ class Api { @@ -2263,16 +2272,19 @@ class Api {
//获取订阅SESSION状态
session_start();
//获取session订阅状态
$is_subscribe = $_SESSION['subscribe'];
$is_subscribe = $_SESSION['subscribe'] ?? null;
//如果订阅是空的，则请求接口获取订阅状态
if ( !isset($is_subscribe) ) {
//获取当前站点信息
$subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]);
$domain = $_SERVER['HTTP_HOST'];
$domain = $_SERVER['HTTP_HOST'] ?? '';
$subscribe = unserialize($subscribe);
$subscribe = is_string($subscribe) ? unserialize($subscribe) : [];
if ( !is_array($subscribe) ) {
$subscribe = [];
}
//api请求地址
$api_url = API_URL."/v1/check_subscribe.php?order_id=".$subscribe['order_id']."&email=".$subscribe['email']."&domain=".$domain;
$api_url = API_URL."/v1/check_subscribe.php?order_id=".($subscribe['order_id'] ?? '')."&email=".($subscribe['email'] ?? '')."&domain=".$domain;
// echo $api_url;
try {
#GET HTTPS
@ -2466,7 +2478,7 @@ class Api { @@ -2466,7 +2478,7 @@ class Api {
*/
public function backup_db(){
//验证请求
$this->auth($token);
$this->auth(null);
//验证订阅
$this->check_is_subscribe();
@ -2500,7 +2512,7 @@ class Api { @@ -2500,7 +2512,7 @@ class Api {
*/
public function backup_db_list() {
//验证请求
$this->auth($token);
$this->auth(null);
//验证订阅
$this->check_is_subscribe();
@ -2577,7 +2589,7 @@ class Api { @@ -2577,7 +2589,7 @@ class Api {
*/
public function del_backup_db($name) {
//验证请求
$this->auth($token);
$this->auth(null);
//验证订阅
$this->check_is_subscribe();
@ -2607,7 +2619,7 @@ class Api { @@ -2607,7 +2619,7 @@ class Api {
*/
public function restore_db($name) {
//验证请求
$this->auth($token);
$this->auth(null);
//验证订阅
$this->check_is_subscribe();
@ -2659,7 +2671,7 @@ class Api { @@ -2659,7 +2671,7 @@ class Api {
*/
public function down_db($name) {
//验证请求
$this->auth($token);
$this->auth(null);
//使用正则表达式判断数据库名称是否合法
$pattern = '/^onenav_[0-9\-]+_[0-9.]+(db3)$/';
@ -2704,7 +2716,7 @@ class Api { @@ -2704,7 +2716,7 @@ class Api {
*/
public function create_share($data) {
//验证请求
$this->auth($token);
$this->auth(null);
//如果订阅不存在
if ( $this->is_subscribe() === FALSE ) {
@ -2753,7 +2765,7 @@ class Api { @@ -2753,7 +2765,7 @@ class Api {
*/
public function share_list($data){
//验证请求
$this->auth($token);
$this->auth(null);
$limit = $data['limit'];
$offset = ($data['page'] - 1) * $data['limit'];
@ -2856,7 +2868,7 @@ class Api { @@ -2856,7 +2868,7 @@ class Api {
*/
public function del_share($data) {
//验证请求
$this->auth($token);
$this->auth(null);
$id = $data['id'];
@ -2894,7 +2906,7 @@ class Api { @@ -2894,7 +2906,7 @@ class Api {
*/
public function del_link_icon(){
//验证授权
$this->auth($token);
$this->auth(null);
//获取图标路径
$icon_path = trim($_POST['icon_path']);
@ -2929,7 +2941,7 @@ class Api { @@ -2929,7 +2941,7 @@ class Api {
} elseif(isset($_GET[$param])) {
return $_GET[$param];
} else {
return null;
return '';
}
}
@ -2938,7 +2950,7 @@ class Api { @@ -2938,7 +2950,7 @@ class Api {
*/
public function global_search() {
//验证授权
$this->auth($token);
$this->auth(null);
// 获取关键词
$keyword = htmlspecialchars( $this->getData("keyword") );
@ -2999,7 +3011,7 @@ class Api { @@ -2999,7 +3011,7 @@ class Api {
*/
public function update_link_order(){
//验证授权
$this->auth($token);
$this->auth(null);
// 获取分类ID
$cid = intval($this->getData("category_id"));
// 获取json对象数据
@ -3031,7 +3043,7 @@ class Api { @@ -3031,7 +3043,7 @@ class Api {
*/
public function get_subscribe() {
//验证授权
$this->auth($token);
$this->auth(null);
//获取当前站点信息
$subscribe = $this->db->get('on_options','value',[ 'key' => "s_subscribe" ]);
$subscribe = unserialize($subscribe);
@ -3045,7 +3057,7 @@ class Api { @@ -3045,7 +3057,7 @@ class Api {
public function get_subscribe_status(){
// var_dump($_SERVER['HTTP_HOST']);
//验证授权
$this->auth($token);
$this->auth(null);
// 获取订阅结果
$result = $this->is_subscribe();
@ -3064,7 +3076,7 @@ class Api { @@ -3064,7 +3076,7 @@ class Api {
public function batch_check_links(){
set_time_limit(1200); // 设置执行最大时间为20分钟
// 验证授权
$this->auth($token);
$this->auth(null);
// 验证订阅
$this->check_is_subscribe();
@ -3226,7 +3238,7 @@ class Api { @@ -3226,7 +3238,7 @@ class Api {
// 设置超时时间为120s
set_time_limit(120);
// 验证授权
$this->auth($token);
$this->auth(null);
// 验证订阅
$this->check_is_subscribe();
@ -3406,7 +3418,7 @@ class Api { @@ -3406,7 +3418,7 @@ class Api {
*/
private function get_options($key) {
//验证授权
$this->auth($token);
$this->auth(null);
//获取当前站点信息
$options = $this->db->get('on_options','value',[ 'key' => $key ]);
// 判断查询结果是否为空
@ -3424,7 +3436,7 @@ class Api { @@ -3424,7 +3436,7 @@ class Api {
*/
public function get_option_base(){
//验证授权
$this->auth($token);
$this->auth(null);
// 获取key
$key = htmlspecialchars( trim( $_GET['key'] ));
$options = $this->db->get('on_options','value',[ 'key' => $key ]);
@ -3442,7 +3454,7 @@ class Api { @@ -3442,7 +3454,7 @@ class Api {
*/
public function forward_order(){
//验证token是否合法
$this->auth($token);
$this->auth(null);
// 声明一个空数组，作为请求体
$data = [];
if (!empty($_GET)) {
@ -3533,7 +3545,7 @@ class Api { @@ -3533,7 +3545,7 @@ class Api {
// 获取相临的版本
public function getNextVersion(){
$this->auth($token);
$this->auth(null);
// 获取当前版本
$version = trim($_GET['version']);
// 正则判断版本是否合法，只能是数组或.组成

59
controller/admin.php
Unescape View File

@ -41,10 +41,11 @@ if( $page == 'index' ) { @@ -41,10 +41,11 @@ if( $page == 'index' ) {
//如果页面是修改edit_category
if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == 'add_category_new') ) {
//获取id
$id = intval($_GET['id']);
$id = intval($_GET['id'] ?? 0);
//查询单条分类信息
$sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname FROM on_categorys AS a WHERE id = $id";
$category_one = $db->query($sql)->fetchAll()[0];
$category_rows = $db->query($sql)->fetchAll();
$category_one = $category_rows[0] ?? [];
//$category_one = $db->get('on_categorys','*',[ 'id' => $id ]);
//查询父级分类
$categorys = $db->select('on_categorys','*',[
@ -52,7 +53,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == ' @@ -52,7 +53,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == '
'ORDER' => ['weight' => 'DESC']
]);
//checked按钮
if( $category_one['property'] == 1 ) {
if( !empty($category_one['property']) ) {
$category_one['checked'] = 'checked';
}
else{
@ -63,7 +64,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == ' @@ -63,7 +64,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == '
//如果是主题设置页面
if ( $page == "setting/theme_config" ){
//获取主题名称
$name = trim($_GET['name']);
$name = trim($_GET['name'] ?? '');
//获取主题目录
if ( is_dir("templates/".$name) ) {
$theme_dir = "templates/".$name;
@ -77,11 +78,14 @@ if ( $page == "setting/theme_config" ){ @@ -77,11 +78,14 @@ if ( $page == "setting/theme_config" ){
$config_content = @file_get_contents("data/templates/".$name."/info.json");
}
$configs = json_decode($config_content);
$configs = $configs->config;
$configs = ( is_object($configs) && isset($configs->config) ) ? $configs->config : (object) [];
//获取当前的配置参数
$current_configs = file_get_contents($theme_dir."/config.json");
$current_configs = @file_get_contents($theme_dir."/config.json");
$current_configs = json_decode($current_configs);
if ( !is_object($current_configs) ) {
$current_configs = (object) [];
}
//var_dump($current_configs);
@ -99,7 +103,8 @@ if ( $page == 'add_category' ) { @@ -99,7 +103,8 @@ if ( $page == 'add_category' ) {
//API设置页面
if( $page == 'setting/api' ) {
//查询SecretKey
$SecretKey = $db->get('on_options','*',[ 'key' => 'SecretKey' ])['value'];
$secret_row = $db->get('on_options','*',[ 'key' => 'SecretKey' ]);
$SecretKey = $secret_row['value'] ?? '';
}
@ -114,15 +119,16 @@ if ( ( $page == 'edit_link' ) || ( $page === 'edit_link_new' ) ) { @@ -114,15 +119,16 @@ if ( ( $page == 'edit_link' ) || ( $page === 'edit_link_new' ) ) {
//查询所有分类信息，用于分类框选择
$categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weigth' => 'DESC'] ]);
//获取id
$id = intval($_GET['id']);
$id = intval($_GET['id'] ?? 0);
//查询单条链接信息
$link = $db->get('on_links','*',[ 'id' => $id ]);
$link = $link ?: [];
//查询单个分类信息
$cat_name = $db->get('on_categorys',['name'],[ 'id' => $link['fid'] ]);
$cat_name = $cat_name['name'];
$cat_name = $db->get('on_categorys',['name'],[ 'id' => $link['fid'] ?? 0 ]);
$cat_name = $cat_name['name'] ?? '';
//checked按钮
if( $link['property'] == 1 ) {
if( !empty($link['property']) ) {
$link['checked'] = 'checked';
}
else{
@ -141,7 +147,7 @@ if ( ($page == 'add_link') || ($page == 'add_link_tpl') || ($page == 'add_quick_ @@ -141,7 +147,7 @@ if ( ($page == 'add_link') || ($page == 'add_link_tpl') || ($page == 'add_quick_
//查询所有分类信息
$categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weight' => 'DESC'] ]);
//checked按钮
if( $category['property'] == 1 ) {
if( !empty($category['property']) ) {
$category['checked'] = 'checked';
}
else{
@ -154,7 +160,7 @@ if ( $page == 'imp_link' ) { @@ -154,7 +160,7 @@ if ( $page == 'imp_link' ) {
//查询所有分类信息
$categorys = $db->select('on_categorys','*',[ 'ORDER' => ['weight' => 'DESC'] ]);
//checked按钮
if( $category['property'] == 1 ) {
if( !empty($category['property']) ) {
$category['checked'] = 'checked';
}
else{
@ -176,6 +182,16 @@ if ( $page == 'setting/theme_detail' ) { @@ -176,6 +182,16 @@ if ( $page == 'setting/theme_detail' ) {
$info = file_get_contents($tpl_dir2.'/info.json');
}
$theme = json_decode($info);
$theme_defaults = [
'name' => '',
'screenshot' => '',
'description' => '',
'author' => '',
'update' => '',
'help_url' => '',
'homepage' => ''
];
$theme = (object) array_merge($theme_defaults, is_object($theme) ? (array) $theme : []);
//var_dump($theme);
}
@ -201,7 +217,7 @@ if( $page == 'setting/theme' ) { @@ -201,7 +217,7 @@ if( $page == 'setting/theme' ) {
case 'admin':
case 'mobile':
case 'universal':
continue;
continue 2;
break;
default:
array_push($tpl_one,$value);
@ -224,7 +240,7 @@ if( $page == 'setting/theme' ) { @@ -224,7 +240,7 @@ if( $page == 'setting/theme' ) {
case '.':
case '..':
case 'admin':
continue;
continue 2;
break;
default:
array_push($tpl_two,$value);
@ -272,8 +288,7 @@ if( $page == 'setting/theme' ) { @@ -272,8 +288,7 @@ if( $page == 'setting/theme' ) {
//站点设置页面
if( $page == 'setting/site' ) {
//获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]);
$site = unserialize($site);
$site = get_site_setting();
}
//站点订阅页面
@ -281,7 +296,15 @@ if( $page == 'setting/subscribe' ) { @@ -281,7 +296,15 @@ if( $page == 'setting/subscribe' ) {
//获取当前站点信息
$subscribe = $db->get('on_options','value',[ 'key' => "s_subscribe" ]);
$subscribe = unserialize($subscribe);
$subscribe = is_string($subscribe) ? unserialize($subscribe) : [];
if ( !is_array($subscribe) ) {
$subscribe = [];
}
$subscribe = array_merge([
'order_id' => '',
'email' => '',
'end_time' => ''
], $subscribe);
//获取当前版本信息
$current_version = explode("-",file_get_contents("version.txt"));

260
controller/api.php
Unescape View File

@ -11,10 +11,42 @@ header("Access-Control-Allow-Origin: *"); @@ -11,10 +11,42 @@ header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: Access-Control-Allow-Private-Network,Content-Type, AccessToken, X-CSRF-Token, Authorization, Token,X-Token,X-Cid");
require('./class/Api.php');
/**
* 读取请求参数，缺失时返回默认值
* 避免 PHP 8 下未定义索引和 null 传入字符串函数的弃用警告
*/
function req_param($key, $default = '')
{
if ( array_key_exists($key, $_POST) ) {
return $_POST[$key];
}
if ( array_key_exists($key, $_GET) ) {
return $_GET[$key];
}
if ( array_key_exists($key, $_REQUEST) ) {
return $_REQUEST[$key];
}
return $default;
}
/**
* 获取 API token，POST 优先，其次 GET
*/
function req_token()
{
if ( !empty($_POST['token']) ) {
return $_POST['token'];
}
if ( isset($_GET['token']) ) {
return $_GET['token'];
}
return '';
}
$api = new Api($db);
//获取请求方法
$method = $_GET['method'];
$method = $_GET['method'] ?? '';
//可变函数变量
$var_func = htmlspecialchars(trim($method),ENT_QUOTES);
// 屏蔽的方法，让其不调用class/Api.php 中的方法
@ -37,7 +69,9 @@ $deny_func = [ @@ -37,7 +69,9 @@ $deny_func = [
'set_option',
'set_option_bool',
'update_link_status',
'get_options'
'get_options',
'req_param',
'req_token'
];
// 判断是否在屏蔽列表中
if( in_array($var_func,$deny_func) ) {
@ -66,21 +100,21 @@ if ( function_exists($var_func) ) { @@ -66,21 +100,21 @@ if ( function_exists($var_func) ) {
*/
function add_category($api){
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取分类名称
$name = $_POST['name'];
$name = req_param('name', '');
//获取私有属性
$property = empty($_POST['property']) ? 0 : 1;
//获取分级ID
$fid = intval($_POST['fid']);
$fid = intval(req_param('fid', ''));
//获取权重
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
$weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
//获取描述
$description = empty($_POST['description']) ? '' : $_POST['description'];
$description = empty($_POST['description']) ? '' : req_param('description', '');
//描述过滤
$description = htmlspecialchars($description);
//获取字体图标
$font_icon = htmlspecialchars($_POST['font_icon'],ENT_QUOTES);
$font_icon = htmlspecialchars(req_param('font_icon', ''),ENT_QUOTES);
//搜索字体图标是否包含'fa '，如果不包含则自动加上
if( !strstr($font_icon,'fa ') ) {
$font_icon = 'fa '.$font_icon;
@ -92,23 +126,23 @@ function add_category($api){ @@ -92,23 +126,23 @@ function add_category($api){
*/
function edit_category($api){
//获取ID
$id = intval($_POST['id']);
$id = intval(req_param('id', ''));
//获取父级ID
$fid = intval($_POST['fid']);
$fid = intval(req_param('fid', ''));
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取分类名称
$name = $_POST['name'];
$name = req_param('name', '');
//获取私有属性
$property = empty($_POST['property']) ? 0 : 1;
//获取权重
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
$weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
//获取描述
$description = empty($_POST['description']) ? '' : $_POST['description'];
$description = empty($_POST['description']) ? '' : req_param('description', '');
//描述过滤
$description = htmlspecialchars($description);
//字体图标
$font_icon = htmlspecialchars($_POST['font_icon'],ENT_QUOTES);
$font_icon = htmlspecialchars(req_param('font_icon', ''),ENT_QUOTES);
//搜索字体图标是否包含'fa '，如果不包含则自动加上
if( !strstr($font_icon,'fa ') ) {
$font_icon = 'fa '.$font_icon;
@ -120,9 +154,9 @@ function edit_category($api){ @@ -120,9 +154,9 @@ function edit_category($api){
*/
function del_category($api){
//获取ID
$id = intval($_POST['id']);
$id = intval(req_param('id', ''));
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
$api->del_category($token,$id);
}
/**
@ -131,17 +165,17 @@ function del_category($api){ @@ -131,17 +165,17 @@ function del_category($api){
function add_link($api){
//add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0)
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取fid
$fid = intval(@$_POST['fid']);
$title = $_POST['title'];
$url = $_POST['url'];
$url_standby = $_POST['url_standby'];
$description = empty($_POST['description']) ? '' : $_POST['description'];
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
$fid = intval(req_param('fid', ''));
$title = req_param('title', '');
$url = req_param('url', '');
$url_standby = req_param('url_standby', '');
$description = empty($_POST['description']) ? '' : req_param('description', '');
$weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
$property = empty($_POST['property']) ? 0 : 1;
$font_icon = empty($_POST['font_icon']) ? '' : $_POST['font_icon'];
$font_icon = empty($_POST['font_icon']) ? '' : req_param('font_icon', '');
$api->add_link($token,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon);
@ -152,18 +186,18 @@ function add_link($api){ @@ -152,18 +186,18 @@ function add_link($api){
function edit_link($api){
//add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0)
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$id = intval(@$_POST['id']);
$token = req_token();
$id = intval(req_param('id', ''));
//获取fid
$fid = intval(@$_POST['fid']);
$title = $_POST['title'];
$url = $_POST['url'];
$url_standby = $_POST['url_standby'];
$description = empty($_POST['description']) ? '' : $_POST['description'];
$weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
$fid = intval(req_param('fid', ''));
$title = req_param('title', '');
$url = req_param('url', '');
$url_standby = req_param('url_standby', '');
$description = empty($_POST['description']) ? '' : req_param('description', '');
$weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
$property = empty($_POST['property']) ? 0 : 1;
$font_icon = empty($_POST['font_icon']) ? '' : $_POST['font_icon'];
$font_icon = empty($_POST['font_icon']) ? '' : req_param('font_icon', '');
$api->edit_link($token,$id,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon);
@ -173,16 +207,16 @@ function edit_link($api){ @@ -173,16 +207,16 @@ function edit_link($api){
* 删除链接
*/
function del_link($api){
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$id = intval(@$_POST['id']);
$token = req_token();
$id = intval(req_param('id', ''));
$api->del_link($token,$id);
}
/**
* 查询分类目录列表
*/
function category_list($api){
$page = empty(intval($_GET['page'])) ? 1 : intval($_GET['page']);
$limit = empty(intval($_GET['limit'])) ? 10 : intval($_GET['limit']);
$page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
$api->category_list($page,$limit);
}
@ -190,12 +224,12 @@ function category_list($api){ @@ -190,12 +224,12 @@ function category_list($api){
* 查询链接列表
*/
function link_list($api){
$page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']);
$limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']);
$page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取分类ID
$category_id = empty($_POST['category_id']) ? null : intval($_POST['category_id']);
$category_id = empty($_POST['category_id']) ? null : intval(req_param('category_id', ''));
$data = [
'page' => $page,
'limit' => $limit,
@ -209,12 +243,12 @@ function link_list($api){ @@ -209,12 +243,12 @@ function link_list($api){
* 查询分类下的链接
*/
function q_category_link($api){
$page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']);
$limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']);
$page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取分类ID
$category_id = empty($_REQUEST['category_id']) ? null : intval($_REQUEST['category_id']);
$category_id = empty($_REQUEST['category_id']) ? null : intval(req_param('category_id', ''));
$data = [
'page' => $page,
'limit' => $limit,
@ -229,9 +263,9 @@ function q_category_link($api){ @@ -229,9 +263,9 @@ function q_category_link($api){
*/
function get_link_info($api) {
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取URL
$url = @$_POST['url'];
$url = req_param('url', '');
$api->get_link_info($token,$url);
}
@ -240,9 +274,9 @@ function get_link_info($api) { @@ -240,9 +274,9 @@ function get_link_info($api) {
*/
function get_a_category($api) {
//获取token
$data['token'] = @empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$data['token'] = req_token();
//获取分类ID
$data['id'] = intval(trim($_POST['id']));
$data['id'] = intval(trim(req_param('id', '')));
//var_dump($data);
$api->get_a_category($data);
}
@ -252,9 +286,9 @@ function get_a_category($api) { @@ -252,9 +286,9 @@ function get_a_category($api) {
*/
function get_a_link($api) {
//获取token
$data['token'] = htmlspecialchars(empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']);
$data['token'] = htmlspecialchars(req_token());
//获取链接的ID
$data['id'] = intval(htmlspecialchars($_GET['id']));
$data['id'] = intval(htmlspecialchars(req_param('id', '')));
$api->get_a_link($data);
}
@ -263,50 +297,50 @@ function get_a_link($api) { @@ -263,50 +297,50 @@ function get_a_link($api) {
*/
function add_js($api) {
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$content = @$_POST['content'];
$token = req_token();
$content = req_param('content', '');
$api->add_js($token,$content);
}
// 上传书签
function upload($api){
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取上传类型
$type = $_GET['type'];
$type = req_param('type', '');
$api->upload($token,$type);
}
// 上传图标
function uploadImages(){
global $api;
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取上传类型
$api->uploadImages($token);
}
//书签导入
function imp_link($api) {
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取书签路径
$filename = trim($_POST['filename']);
$fid = intval($_POST['fid']);
$property = intval(@$_POST['property']);
$filename = trim(req_param('filename', ''));
$fid = intval(req_param('fid', ''));
$property = intval(req_param('property', ''));
$api->imp_link($token,$filename,$fid,$property);
}
//新版书签批量导入并自动创建分类
function import_link($api) {
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
//获取书签路径
$filename = trim($_POST['filename']);
$fid = intval($_POST['fid']);
$property = intval(@$_POST['property']);
$filename = trim(req_param('filename', ''));
$fid = intval(req_param('fid', ''));
$property = intval(req_param('property', ''));
$api->import_link($filename,$property);
}
//检查弱密码
function check_weak_password($api) {
//获取token
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
$api->check_weak_password($token);
}
@ -318,14 +352,14 @@ function get_sql_update_list($api){ @@ -318,14 +352,14 @@ function get_sql_update_list($api){
//执行SQL更新
function exe_sql($api) {
$data['name'] = htmlspecialchars(trim($_GET['name']));
$data['name'] = htmlspecialchars(trim(req_param('name', '')));
$api->exe_sql($data);
}
//设置options表
function set_theme($api) {
$key = 's_themes';
$value = $_POST['value'];
$value = req_param('value', '');
$api->set_option($key,$value);
}
@ -333,23 +367,23 @@ function set_theme($api) { @@ -333,23 +367,23 @@ function set_theme($api) {
function set_site($api) {
//获取传递过来的参数
//获取网站标题
$data['title'] = htmlspecialchars($_POST['title']);
$data['title'] = htmlspecialchars(req_param('title', ''));
//获取网站logo
$data['logo'] = htmlspecialchars($_POST['logo']);
$data['logo'] = htmlspecialchars(req_param('logo', ''));
//获取副标题
$data['subtitle'] = htmlspecialchars($_POST['subtitle']);
$data['subtitle'] = htmlspecialchars(req_param('subtitle', ''));
//获取关键词
$data['keywords'] = htmlspecialchars($_POST['keywords']);
$data['keywords'] = htmlspecialchars(req_param('keywords', ''));
//获取描述
$data['description'] = htmlspecialchars($_POST['description']);
$data['description'] = htmlspecialchars(req_param('description', ''));
//获取自定义header
$data['custom_header'] = $_POST['custom_header'];
$data['custom_header'] = req_param('custom_header', '');
//获取自定义footer
$data['custom_footer'] = $_POST['custom_footer'];
$data['custom_footer'] = req_param('custom_footer', '');
//获取链接模式
$data['link_model'] = $_POST['link_model'];
$data['link_model'] = req_param('link_model', '');
// 获取链接数量
$data['link_num'] = $_POST['link_num'];
$data['link_num'] = req_param('link_num', '');
//序列化存储
$value = serialize($data);
@ -390,11 +424,11 @@ function _deny_set($content,$err_msg) { @@ -390,11 +424,11 @@ function _deny_set($content,$err_msg) {
//设置订阅信息
function set_subscribe($api) {
//获取订单ID
$data['order_id'] = htmlspecialchars( trim($_POST['order_id']) );
$data['order_id'] = htmlspecialchars( trim(req_param('order_id', '')) );
//获取邮箱
$data['email'] = htmlspecialchars( trim($_POST['email']) );
$data['email'] = htmlspecialchars( trim(req_param('email', '')) );
//到期时间
$data['end_time'] = htmlspecialchars( trim($_POST['end_time']) );
$data['end_time'] = htmlspecialchars( trim(req_param('end_time', '')) );
//重置订阅状态
session_start();
$_SESSION['subscribe'] = NULL;
@ -415,7 +449,7 @@ function up_updater($api) { @@ -415,7 +449,7 @@ function up_updater($api) {
}
//验证当前版本是否匹配
function check_version($api) {
$version = $_REQUEST['version'];
$version = req_param('version', '');
$api->check_version($version);
}
@ -423,18 +457,18 @@ function check_version($api) { @@ -423,18 +457,18 @@ function check_version($api) {
function set_transition_page($api) {
//获取传递过来的参数
//获取开关
$data['control'] = htmlspecialchars(trim($_POST['control']));
$data['control'] = htmlspecialchars(trim(req_param('control', '')));
//获取游客停留时间
$data['visitor_stay_time'] = intval($_POST['visitor_stay_time']);
$data['visitor_stay_time'] = intval(req_param('visitor_stay_time', ''));
//获取管理员停留时间
$data['admin_stay_time'] = intval($_POST['admin_stay_time']);
$data['admin_stay_time'] = intval(req_param('admin_stay_time', ''));
//获取菜单
$data['menu'] = $_POST['menu'];
$data['menu'] = req_param('menu', '');
//获取footer
$data['footer'] = $_POST['footer'];
$data['footer'] = req_param('footer', '');
//获取广告
$data['a_d_1'] = $_POST['a_d_1'];
$data['a_d_2'] = $_POST['a_d_2'];
$data['a_d_1'] = req_param('a_d_1', '');
$data['a_d_2'] = req_param('a_d_2', '');
//验证订阅
@ -490,9 +524,9 @@ function get_latest_version() { @@ -490,9 +524,9 @@ function get_latest_version() {
//批量修改链接分类
function batch_modify_category($api) {
//获取id列表
$id = $_POST['id'];
$id = req_param('id', '');
//获取分类ID
$fid = intval($_POST['fid']);
$fid = intval(req_param('fid', ''));
$data = [
'id' => $id,
@ -616,8 +650,8 @@ function export_json($api) { @@ -616,8 +650,8 @@ function export_json($api) {
// 批量设置链接私有属性
function set_link_attribute($api) {
$ids = $_POST['ids'];
$property = intval( $_POST['property'] );
$ids = req_param('ids', []);
$property = intval( req_param('property', '') );
$data = [
"ids" => $ids,
"property" => $property
@ -627,23 +661,23 @@ function set_link_attribute($api) { @@ -627,23 +661,23 @@ function set_link_attribute($api) {
//获取用户登录状态
function check_login($api) {
$token = trim($_REQUEST['token']);
$token = trim(req_param('token'));
$api->check_login($token);
}
//删除主题
function delete_theme($api) {
$name = $_REQUEST['name'];
$name = req_param('name', '');
$api->delete_theme($name);
}
//下载主题
function down_theme() {
global $api;
$data['name'] = trim($_GET['name']);
$data['key'] = trim( $_GET['key'] );
$data['value'] = trim( $_GET['value'] );
$data['type'] = trim( $_GET['type'] );
$data['name'] = trim(req_param('name', ''));
$data['key'] = trim( req_param('key', '') );
$data['value'] = trim( req_param('value', '') );
$data['type'] = trim( req_param('type', '') );
$api->down_theme($data);
}
@ -663,20 +697,20 @@ function backup_db_list() { @@ -663,20 +697,20 @@ function backup_db_list() {
//删除单个数据库备份
function del_backup_db() {
global $api;
$name = @$_GET['name'];
$name = req_param('name', '');
$api->del_backup_db($name);
}
//回滚数据库
function restore_db() {
global $api;
$name = @$_REQUEST['name'];
$name = req_param('name', '');
$api->restore_db($name);
}
//获取APPINFO
function app_info() {
$token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
$token = req_token();
global $api;
$api->app_info($token);
@ -685,7 +719,7 @@ function app_info() { @@ -685,7 +719,7 @@ function app_info() {
//下载数据库
function down_db() {
global $api;
$name = $_GET['name'];
$name = req_param('name', '');
$api->down_db($name);
}
@ -694,10 +728,10 @@ function create_share() { @@ -694,10 +728,10 @@ function create_share() {
global $api;
$data['add_time'] = date("Y-m-d H:i:s",time());
$data['expire_time'] = $_POST['expire_time'];
$data['password'] = trim($_POST['password']);
$data['cid'] = intval($_POST['cid']);
$data['note'] = $_POST['note'];
$data['expire_time'] = req_param('expire_time', '');
$data['password'] = trim(req_param('password', ''));
$data['cid'] = intval(req_param('cid', ''));
$data['note'] = req_param('note', '');
$api->create_share($data);
}
@ -705,8 +739,8 @@ function create_share() { @@ -705,8 +739,8 @@ function create_share() {
//分享列表
function share_list() {
global $api;
$page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']);
$limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']);
$page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
$limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
$data = [
'page' => $page,
@ -719,15 +753,15 @@ function share_list() { @@ -719,15 +753,15 @@ function share_list() {
//获取SID下的链接
function get_sid_links() {
global $api;
$data['sid'] = trim($_POST['sid']);
$data['password'] = trim($_POST['password']);
$data['sid'] = trim(req_param('sid', ''));
$data['password'] = trim(req_param('password', ''));
$api->get_sid_links($data);
}
//删除分享
function del_share() {
global $api;
$data['id'] = intval($_GET['id']);
$data['id'] = intval(req_param('id', ''));
//var_dump($data['id']);
$api->del_share($data);
@ -753,8 +787,8 @@ function edit_link_row(){ @@ -753,8 +787,8 @@ function edit_link_row(){
// 批量修改分类属性
function set_cat_batch() {
$data['ids'] = $_POST['ids'];
$data['property'] = $_POST['property'];
$data['ids'] = req_param('ids', []);
$data['property'] = req_param('property', '');
global $api;
$api->set_cat_batch($data);
}

4
controller/bing.php
Unescape View File

@ -6,9 +6,9 @@ header('Content-Type:application/json; charset=utf-8'); @@ -6,9 +6,9 @@ header('Content-Type:application/json; charset=utf-8');
// 载入辅助函数
require('functions/helper.php');
//获取当前主机名
$host = $_SERVER['HTTP_HOST'];
$host = $_SERVER['HTTP_HOST'] ?? '';
//获取reffrer
$referer = $_SERVER['HTTP_REFERER'];
$referer = $_SERVER['HTTP_REFERER'] ?? '';
//如果referer和主机名不匹配，则禁止调用
if ( ( !empty($referer) ) && ( !strstr($referer,$host) ) ) {

19
controller/click.php
Unescape View File

@ -3,7 +3,7 @@ @@ -3,7 +3,7 @@
require('functions/helper.php');
//获取link.id
$id = intval($_GET['id']);
$id = intval($_GET['id'] ?? 0);
//如果链接为空
if(empty($id)) {
@ -28,8 +28,10 @@ if( !$link ){ @@ -28,8 +28,10 @@ if( !$link ){
$category = $db->get('on_categorys',['id','property'],[
'id' => $link['fid']
]);
$category = $category ?: [];
//判断用户是否登录
$is_login = FALSE;
if( is_login() ) {
$is_login = TRUE;
}
@ -37,13 +39,22 @@ if( is_login() ) { @@ -37,13 +39,22 @@ if( is_login() ) {
//查询过渡页设置
$transition_page = $db->get('on_options','value',[ 'key' => "s_transition_page" ]);
$transition_page = unserialize($transition_page);
if ( !is_array($transition_page) ) {
$transition_page = [];
}
$transition_page = array_merge([
'control' => 'on',
'visitor_stay_time' => 5,
'admin_stay_time' => 1,
'a_d_1' => '',
'a_d_2' => ''
], $transition_page);
//获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]);
$site = unserialize($site);
$site = get_site_setting();
//link.id为公有，且category.id为公有
if( ( $link['property'] == 0 ) && ($category['property'] == 0) ){
if( ( $link['property'] == 0 ) && ( ($category['property'] ?? 0) == 0) ){
//增加link.id的点击次数
$click = $link['click'] + 1;
//更新数据库

6
controller/ico.php
Unescape View File

@ -77,13 +77,13 @@ function hsv2rgb($h, $s, $v) @@ -77,13 +77,13 @@ function hsv2rgb($h, $s, $v)
*/
function output_ico() {
//获取文字
$text = @trim($_GET['text']);
$text = trim($_GET['text'] ?? '');
$text = empty($text) ? '空' : $text;
//获取当前主机名
$host = $_SERVER['HTTP_HOST'];
$host = $_SERVER['HTTP_HOST'] ?? '';
//获取reffrer
$referer = $_SERVER['HTTP_REFERER'];
$referer = $_SERVER['HTTP_REFERER'] ?? '';
//如果referer和主机名不匹配，则禁止调用
if ( ( !empty($referer) ) && ( !strstr($referer,$host) ) ) {

31
controller/index.php
Unescape View File

@ -3,17 +3,17 @@ @@ -3,17 +3,17 @@
* 首页模板入口
*/
// 载入辅助函数
require('functions/helper.php');
//获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]);
$site = unserialize($site);
$site = get_site_setting();
// 获取链接数量,默认为30
$link_num = empty( $site['link_num'] ) ? 30 : intval($site['link_num']);
// var_dump($link_num);
//如果已经登录，获取所有分类和链接
// 载入辅助函数
require('functions/helper.php');
// 明文密码检查
unSafe();
@ -211,7 +211,7 @@ $templates = $db->get("on_options","value",[ @@ -211,7 +211,7 @@ $templates = $db->get("on_options","value",[
"key" => "s_themes"
]);
// 获取UA
$userAgent = $_SERVER['HTTP_USER_AGENT'];
$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$mobileKeywords = [
'mobile', 'android', 'iphone'
];
@ -237,7 +237,7 @@ if (empty($templates)) { @@ -237,7 +237,7 @@ if (empty($templates)) {
//获取用户传递的主题参数
$theme = trim( @$_GET['theme'] );
$theme = trim( $_GET['theme'] ?? '' );
//如果用户传递了主题参数
if( !empty($theme) ) {
//获取所有主题
@ -274,12 +274,16 @@ $config_content = @file_get_contents($config_file); @@ -274,12 +274,16 @@ $config_content = @file_get_contents($config_file);
//如果是info.json,则特殊处理下
if ( strstr($config_file,"info.json") ) {
$config_content = json_decode($config_content);
$theme_config = $config_content->config;
$theme_config = ( is_object($config_content) && isset($config_content->config) )
? $config_content->config
: (object) [];
}
else{
$config_content = $config_content;
$theme_config = json_decode($config_content);
}
if ( !is_object($theme_config) ) {
$theme_config = (object) [];
}
@ -327,8 +331,14 @@ $search_engines = [ @@ -327,8 +331,14 @@ $search_engines = [
//获取主题的最低版本要求
$info_json = @file_get_contents($tpl_dir.$template."/info.json");
$info = (object) [
'version' => ''
];
if( $info_json ) {
$info = json_decode($info_json);
$decoded_info = json_decode($info_json);
if ( is_object($decoded_info) ) {
$info = (object) array_merge( (array) $info, (array) $decoded_info );
}
$min_version = @$info->require->min;
//获取到了最低版本
@ -343,7 +353,8 @@ if( $info_json ) { @@ -343,7 +353,8 @@ if( $info_json ) {
// 该分类下可见的链接数量
function get_links_number($fid){
$number = count(get_links($fid));
$links = get_links($fid);
$number = is_array($links) ? count($links) : 0;
// var_dump($number);
return $number;
}

8
controller/init.php
Unescape View File

@ -12,7 +12,7 @@ function check_env() { @@ -12,7 +12,7 @@ function check_env() {
$ext = get_loaded_extensions();
//检查PHP版本，最低要求7.2，兼容8.x
$php_version = PHP_VERSION;
$uri = $_SERVER["REQUEST_URI"];
$uri = $_SERVER["REQUEST_URI"] ?? '';
// var_dump($uri);
@ -138,9 +138,9 @@ check_env(); @@ -138,9 +138,9 @@ check_env();
if ( $c == 'init' ) {
//接收POST参数
$email = htmlspecialchars(trim($_POST['email']));
$username = htmlspecialchars(trim($_POST['username']));
$password = htmlspecialchars(trim($_POST['password']));
$email = htmlspecialchars(trim($_POST['email'] ?? ''));
$username = htmlspecialchars(trim($_POST['username'] ?? ''));
$password = htmlspecialchars(trim($_POST['password'] ?? ''));
$data = [
"email" => $email,
"username" => $username,

14
controller/login.php
Unescape View File

@ -13,9 +13,9 @@ $username = $site_setting['user']; @@ -13,9 +13,9 @@ $username = $site_setting['user'];
$password = ENCRYPTED_PASSWORD;
$ip = getIP();
//如果认证通过，直接跳转到后台管理
$key = md5($username.$password.'onenav'.$_SERVER['HTTP_USER_AGENT']);
$key = md5($username.$password.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//获取cookie
$cookie = $_COOKIE['key'];
$cookie = $_COOKIE['key'] ?? '';
//获取版本号
$version = new_get_version();
@ -27,16 +27,16 @@ if( is_login() ){ @@ -27,16 +27,16 @@ if( is_login() ){
}
//登录检查
if( $_GET['check'] == 'login' ) {
$user = trim($_POST['user']);
$pass = trim($_POST['password']);
if( ($_GET['check'] ?? '') == 'login' ) {
$user = trim($_POST['user'] ?? '');
$pass = trim($_POST['password'] ?? '');
// 用户密码进行加密处理，加密算法为用户名 + 密码，再进行MD5加密
$pass = md5($user.$pass);
header('Content-Type:application/json; charset=utf-8');
if( ($user === $username) && ($pass === $password) ) {
$key = md5($username.$password.'onenav'.$_SERVER['HTTP_USER_AGENT']);
$key = md5($username.$password.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//开启httponly支持
setcookie("key", $key, time()+30 * 24 * 60 * 60,"/",NULL,false,TRUE);
setcookie("key", $key, time()+30 * 24 * 60 * 60,"/","",false,TRUE);
$data = [
'code' => 0,
'msg' => 'successful'

3
controller/universal.php
Unescape View File

@ -9,8 +9,7 @@ require('functions/helper.php'); @@ -9,8 +9,7 @@ require('functions/helper.php');
$version = new_get_version();
//获取当前站点信息
$site = $db->get('on_options','value',[ 'key' => "s_site" ]);
$site = unserialize($site);
$site = get_site_setting();
//载入视图

41
functions/helper.php
Unescape View File

@ -17,16 +17,16 @@ function getIP() { @@ -17,16 +17,16 @@ function getIP() {
$ip = getenv('HTTP_FORWARDED');
}
else {
$ip = $_SERVER['REMOTE_ADDR'];
$ip = $_SERVER['REMOTE_ADDR'] ?? '';
}
return $ip;
}
function is_login(){
$key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.$_SERVER['HTTP_USER_AGENT']);
$key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
//获取session
$session = $_COOKIE['key'];
$session = $_COOKIE['key'] ?? '';
//如果已经成功登录
if($session === $key) {
return true;
@ -37,6 +37,29 @@ function is_login(){ @@ -37,6 +37,29 @@ function is_login(){
}
//后续全局函数全部以g_命名开头
/**
* 获取站点设置，并补齐旧版本/种子库缺失的字段
*/
function get_site_setting() {
global $db;
$site = $db->get('on_options','value',[ 'key' => 's_site' ]);
$site = is_string($site) ? @unserialize($site) : $site;
if ( !is_array($site) ) {
$site = [];
}
return array_merge([
'title' => 'OneNav',
'logo' => 'OneNav',
'subtitle' => '',
'keywords' => '',
'description' => '',
'custom_header' => '',
'custom_footer' => '',
'link_model' => 'jump',
'link_num' => 30
], $site);
}
function g_extend_js() {
//载入js扩展
if( file_exists('data/extend.js') ) {
@ -102,7 +125,7 @@ function GetRandStr($len) @@ -102,7 +125,7 @@ function GetRandStr($len)
//跳转到手机版页面
function jump_mobile() {
$ua = $_SERVER['HTTP_USER_AGENT'];
$ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
if( stristr($ua,'iphone') || stristr($ua,'android') ) {
header("Location: /index.php?c=mobile#/");
@ -132,7 +155,7 @@ function get_all_themes() { @@ -132,7 +155,7 @@ function get_all_themes() {
case 'admin':
case 'mobile':
case 'universal':
continue;
continue 2;
break;
default:
array_push($tpl_one,$value);
@ -155,7 +178,7 @@ function get_all_themes() { @@ -155,7 +178,7 @@ function get_all_themes() {
case '.':
case '..':
case 'admin':
continue;
continue 2;
break;
default:
array_push($tpl_two,$value);
@ -178,7 +201,7 @@ function get_all_themes() { @@ -178,7 +201,7 @@ function get_all_themes() {
// 获取HOST，需要去除端口号
function get_host(){
$host = $_SERVER['HTTP_HOST'];
$host = $_SERVER['HTTP_HOST'] ?? '';
$parsed_host = parse_url($host);
//var_dump($parsed_host);
if (isset($parsed_host['port']) && $parsed_host['port'] != 80 && $parsed_host['port'] != 443) {
@ -190,7 +213,9 @@ function get_host(){ @@ -190,7 +213,9 @@ function get_host(){
// 获取当前域名，比如https://nav.rss.ink
function getCurrentUrlDomain() {
$url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
$host = $_SERVER['HTTP_HOST'] ?? '';
$request_uri = $_SERVER['REQUEST_URI'] ?? '';
$url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://" . $host . $request_uri;
$url_parts = parse_url($url);

2
index.php
Unescape View File

@ -7,7 +7,7 @@ header("content-Type: text/html; charset=Utf-8"); @@ -7,7 +7,7 @@ header("content-Type: text/html; charset=Utf-8");
//获取控制器
$c = @$_GET['c'];
//进行过滤
$c = strip_tags($c);
$c = strip_tags($c ?? '');
//读取版本号
//$version = @file_get_contents("./functions/version.txt");
//载入配置文件

29
templates/admin/click.php
Unescape View File

@ -1,3 +1,23 @@ @@ -1,3 +1,23 @@
<?php
// 兼容直接通过后台页面参数加载模板的情况，保证变量和字段存在
$link = array_merge([
'title' => '',
'url' => '',
'url_standby' => '',
'description' => ''
], (isset($link) && is_array($link)) ? $link : []);
$site = array_merge([
'title' => 'OneNav',
'custom_header' => ''
], (isset($site) && is_array($site)) ? $site : []);
$transition_page = array_merge([
'visitor_stay_time' => 5,
'admin_stay_time' => 1,
'a_d_1' => '',
'a_d_2' => ''
], (isset($transition_page) && is_array($transition_page)) ? $transition_page : []);
$is_login = isset($is_login) ? $is_login : FALSE;
?>
<!DOCTYPE html>
<html lang="zh-cn" xmlns="http://www.w3.org/1999/xhtml">
<head>
@ -104,13 +124,8 @@ @@ -104,13 +124,8 @@
$visitor_stay_time = $transition_page['visitor_stay_time'];
//管理员停留时间
$admin_stay_time = $transition_page['admin_stay_time'];
if ($is_login) {
header("Refresh:$admin_stay_time;url=".$link['url']);
}
else{
header("Refresh:$visitor_stay_time;url=".$link['url']);
}
$refresh_time = $is_login ? $admin_stay_time : $visitor_stay_time;
echo '<meta http-equiv="refresh" content="'.intval($refresh_time).';url='.htmlspecialchars($link['url'], ENT_QUOTES).'">';
}
?>

2
templates/admin/edit_category.php
Unescape View File

@ -140,7 +140,7 @@ @@ -140,7 +140,7 @@
// 每页显示数量，默认12
limit: 30,
// 点击回调
value:'<?php echo str_replace("fa ","",$category_one["font_icon"]); ?>', //自定义默认图标
value:'<?php echo str_replace("fa ","",$category_one["font_icon"] ?? ''); ?>', //自定义默认图标
click: function(data) {
console.log(data);
},

2
templates/admin/edit_category_new.php
Unescape View File

@ -138,7 +138,7 @@ @@ -138,7 +138,7 @@
// 每页显示数量，默认12
limit: 30,
// 点击回调
value:'<?php echo str_replace("fa ","",$category_one["font_icon"]); ?>', //自定义默认图标
value:'<?php echo str_replace("fa ","",$category_one["font_icon"] ?? ''); ?>', //自定义默认图标
click: function(data) {
console.log(data);
},

1
templates/admin/setting/api.php
Unescape View File

@ -1,4 +1,3 @@ @@ -1,4 +1,3 @@
<?php echo $transition_page['control']; ?>
<!-- API页面设置 -->
<?php require_once(dirname(__DIR__).'/header.php'); ?>
<?php include_once(dirname(__DIR__).'/left.php'); ?>

1
templates/admin/setting/backup.php
Unescape View File

@ -1,4 +1,3 @@ @@ -1,4 +1,3 @@
<?php echo $transition_page['control']; ?>
<!-- API页面设置 -->
<?php require_once(dirname(__DIR__).'/header.php'); ?>
<?php include_once(dirname(__DIR__).'/left.php'); ?>

1
templates/admin/setting/share.php
Unescape View File

@ -1,4 +1,3 @@ @@ -1,4 +1,3 @@
<?php echo $transition_page['control']; ?>
<!-- API页面设置 -->
<?php require_once(dirname(__DIR__).'/header.php'); ?>
<?php include_once(dirname(__DIR__).'/left.php'); ?>

6
templates/admin/setting/site.php
Unescape View File

@ -48,7 +48,7 @@ @@ -48,7 +48,7 @@
<div class="layui-form-item">
<label class="layui-form-label">直链模式</label>
<div class="layui-input-inline">
<?php if( $site['link_model'] === 'direct' ) { ?>
<?php if( ($site['link_model'] ?? 'jump') === 'direct' ) { ?>
<input type="radio" name="link_model" value="jump" title="关闭">
<input type="radio" name="link_model" value="direct" title="开启" checked>
<?php }else{ ?>
@ -62,7 +62,7 @@ @@ -62,7 +62,7 @@
<div class="layui-form-item">
<label class="layui-form-label">链接数量</label>
<div class="layui-input-inline">
<input type="number" name="link_num" value = "<?php echo $site['link_num']; ?>" autocomplete="off" placeholder="分类需要展示的链接数量" class="layui-input">
<input type="number" name="link_num" value = "<?php echo $site['link_num'] ?? 30; ?>" autocomplete="off" placeholder="分类需要展示的链接数量" class="layui-input">
</div>
<div class="layui-form-mid layui-word-aux">指的是首页单个分类下需要展示的链接数量，默认30，值越低，性能越好</div>
</div>
@ -84,7 +84,7 @@ @@ -84,7 +84,7 @@
<div class="layui-form-item layui-form-text">
<label class="layui-form-label">自定义footer(支持HTML代码，订阅可用)</label>
<div class="layui-input-block">
<textarea name = "custom_footer" placeholder="自定义站点底部信息，请填写HTML代码" class="layui-textarea"><?php echo $site['custom_footer']; ?></textarea>
<textarea name = "custom_footer" placeholder="自定义站点底部信息，请填写HTML代码" class="layui-textarea"><?php echo $site['custom_footer'] ?? ''; ?></textarea>
</div>
</div>

2
templates/admin/setting/subscribe.php
Unescape View File

@ -53,7 +53,7 @@ @@ -53,7 +53,7 @@
<div class="layui-form-item" style = "display:none;">
<label class="layui-form-label">域名</label>
<div class="layui-input-block">
<input type="text" name="domain" id = "domain" value = "<?php echo $_SERVER['HTTP_HOST']; ?>" autocomplete="off" placeholder="网站域名" class="layui-input">
<input type="text" name="domain" id = "domain" value = "<?php echo $_SERVER['HTTP_HOST'] ?? ''; ?>" autocomplete="off" placeholder="网站域名" class="layui-input">
</div>
</div>

7
templates/default/index.php
Unescape View File

@ -27,7 +27,7 @@ @@ -27,7 +27,7 @@
</head>
<?php
// 根据cookie来设置mdui主题
$md_theme = $_COOKIE['docs-theme-layout'];
$md_theme = $_COOKIE['docs-theme-layout'] ?? '';
if( empty($md_theme) || ( $md_theme == "light" ) ) {
$md_theme = "";
}
@ -172,6 +172,9 @@ @@ -172,6 +172,9 @@
<?php foreach ( $categorys as $category ) {
$fid = $category['id'];
$links = $get_links($fid);
if ( !is_array($links) ) {
$links = [];
}
$font_icon = empty($category['font_icon']) ? '' : "<i class='{$category['font_icon']}'></i> ";
//如果分类是私有的
if( $category['property'] == 1 ) {
@ -192,7 +195,7 @@ @@ -192,7 +195,7 @@
$link['description'] = empty($link['description']) ? '作者很懒，没有填写描述。' : $link['description'];
$id = $link['id'];
//直链模式
if( $site['link_model'] === 'direct' ) {
if( ($site['link_model'] ?? 'jump') === 'direct' ) {
$url = $link['url'];
}
else{

5
templates/minima/index.php
Unescape View File

@ -127,6 +127,9 @@ @@ -127,6 +127,9 @@
<?php foreach ($categorys as $category) {
$fid = $category['id'];
$links = $get_links($fid);
if ( !is_array($links) ) {
$links = [];
}
$font_icon = empty($category['font_icon']) ? 'fa fa-folder' : $category['font_icon'];
// 如果分类是私有的
@ -152,7 +155,7 @@ @@ -152,7 +155,7 @@
$id = $link['id'];
// 直链模式
if( $site['link_model'] === 'direct' ) {
if( ($site['link_model'] ?? 'jump') === 'direct' ) {
$url = $link['url'];
} else {
$url = '/index.php?c=click&id='.$link['id'];

Write Preview
Loading…
Cancel
Save