Merge branch 'master' into dev

app-pt/controllers/BaseController.php

@@ -5,6 +5,7 @@ namespace pt\controllers;
 use bizHd\saas\services\StaffService;
 use common\components\jwt;
 use common\components\util;
+use Faker\Provider\bn_BD\Utils;
 use Yii;
 
 class BaseController extends PublicController
@@ -17,9 +18,6 @@ class BaseController extends PublicController
 
     public function beforeAction($action)
     {
-        // 新增：全局安全检查
-        $this->securityCheck();
-
         //6表示总后台
         Yii::$app->params['ptStyle'] = 6;
         $staffId = jwt::getLoginId();
@@ -43,7 +41,7 @@ class BaseController extends PublicController
                 'upload/save-img',
                 'item/add',
             ];
-            if (in_array($currentRoute, $arr) == false) {
+            if (!in_array($currentRoute, $arr)) {
                 util::fail('没有找到资源');
             }
         }
@@ -61,192 +59,11 @@ class BaseController extends PublicController
             }
             $this->staff = $staff;
         }
-        if ($this->validate == false) {
+        if (!$this->validate) {
             util::notLogin();
         }
         $this->staffId = $staffId;
         return parent::beforeAction($action);
     }
 
-    /**
-     * 全局安全检查
-     */
-    protected function securityCheck()
-    {
-        $request = Yii::$app->request;
-        $this->checkSuspiciousParameters($request);
-        $this->checkFileUploadSecurity($request);
-        $this->checkSqlInjection($request);
-        $this->checkXssAttack($request);
-        $this->logSecurityActivity($request);
-    }
-
-    /**
-     * 检查可疑参数
-     */
-    protected function checkSuspiciousParameters($request)
-    {
-        $dangerousPatterns = [
-            // 代码执行相关
-            '/eval\s*\(/i',
-            '/exec\s*\(/i',
-            '/system\s*\(/i',
-            '/passthru\s*\(/i',
-            '/shell_exec\s*\(/i',
-            '/proc_open\s*\(/i',
-            '/popen\s*\(/i',
-            
-            // 文件操作相关
-            '/file_put_contents\s*\(/i',
-            '/file_get_contents\s*\(/i',
-            '/fwrite\s*\(/i',
-            '/fopen\s*\(/i',
-            
-            // 目录遍历
-            '/\.\.\//',
-            '/\.\.\\\/',
-            
-            // 模板注入
-            '/<\?php/i',
-            '/<\?=/i',
-            '/<\?/i',
-            
-            // 序列化攻击
-            '/O:\d+:/',
-            '/a:\d+:/',
-            '/s:\d+:/',
-        ];
-        
-        foreach (['get', 'post'] as $method) {
-            $params = $request->$method();
-            foreach ($params as $key => $value) {
-                if (is_string($value)) {
-                    foreach ($dangerousPatterns as $pattern) {
-                        if (preg_match($pattern, $value)) {
-                            $this->logSecurityViolation($request, "Dangerous pattern detected: $pattern in $key");
-                            throw new \yii\web\HttpException(403, 'Access denied');
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    /**
-     * 检查文件上传安全
-     */
-    protected function checkFileUploadSecurity($request)
-    {
-        if (!empty($_FILES)) {
-            foreach ($_FILES as $file) {
-                if (isset($file['name'])) {
-                    $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
-                    $allowed = ['jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx'];
-                    if (!in_array($ext, $allowed)) {
-                        $this->logSecurityViolation($request, "Illegal file upload: " . $file['name']);
-                        throw new \yii\web\HttpException(403, 'Illegal file type');
-                    }
-                }
-            }
-        }
-    }
-
-    /**
-     * 检查SQL注入
-     */
-    protected function checkSqlInjection($request)
-    {
-        $sqlPatterns = [
-            '/select\s.+\sfrom/i',
-            '/union\s+select/i',
-            '/insert\s+into/i',
-            '/update\s.+\sset/i',
-            '/delete\s+from/i',
-            '/drop\s+table/i',
-            '/--/',
-            '/\bOR\b.+\=/i',
-        ];
-        foreach (['get', 'post'] as $method) {
-            $params = $request->$method();
-            foreach ($params as $key => $value) {
-                if (is_string($value)) {
-                    foreach ($sqlPatterns as $pattern) {
-                        if (preg_match($pattern, $value)) {
-                            $this->logSecurityViolation($request, "SQL injection pattern: $pattern in $key");
-                            throw new \yii\web\HttpException(403, 'Access denied');
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    /**
-     * 检查XSS攻击
-     */
-    protected function checkXssAttack($request)
-    {
-        $xssPatterns = [
-            '/<script\b[^>]*>(.*?)<\/script>/is',
-            '/on\w+\s*=/i',
-            '/javascript:/i',
-            '/<iframe/i',
-            '/<img/i',
-        ];
-        foreach (['get', 'post'] as $method) {
-            $params = $request->$method();
-            foreach ($params as $key => $value) {
-                if (is_string($value)) {
-                    foreach ($xssPatterns as $pattern) {
-                        if (preg_match($pattern, $value)) {
-                            $this->logSecurityViolation($request, "XSS pattern: $pattern in $key");
-                            throw new \yii\web\HttpException(403, 'Access denied');
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    /**
-     * 记录安全日志
-     */
-    protected function logSecurityActivity($request)
-    {
-        $log = [
-            'time' => date('Y-m-d H:i:s'),
-            'ip' => $request->userIP,
-            'url' => $request->url,
-            'get' => $request->get(),
-            'post' => $request->post(),
-            'user_agent' => $request->userAgent,
-        ];
-        file_put_contents(
-            Yii::getAlias('@runtime/logs/security_activity.log'),
-            json_encode($log, JSON_UNESCAPED_UNICODE) . "\n",
-            FILE_APPEND
-        );
-    }
-
-    /**
-     * 记录安全违规日志
-     */
-    protected function logSecurityViolation($request, $reason)
-    {
-        $log = [
-            'time' => date('Y-m-d H:i:s'),
-            'ip' => $request->userIP,
-            'url' => $request->url,
-            'get' => $request->get(),
-            'post' => $request->post(),
-            'user_agent' => $request->userAgent,
-            'reason' => $reason,
-        ];
-        file_put_contents(
-            Yii::getAlias('@runtime/logs/security_violation.log'),
-            json_encode($log, JSON_UNESCAPED_UNICODE) . "\n",
-            FILE_APPEND
-        );
-    }
-
 }

common/components/baseController.php

@@ -1,27 +1,90 @@
 <?php
+
 namespace common\components;
+
 use Yii;
 use yii\web\Controller;
 
 /**
  * 前后台基类
  */
-class baseController extends Controller{
-
-	public $imgUrl,$adminUrl,$frontUrl,$openUrl,$picUrl,$wwwUrl;
-
-	public function beforeAction($action){	
-		$hostInfo			= Yii::$app->urlManager->getHostInfo();
-		$parse				= parse_url($hostInfo);
-		$host				= $parse['host'];
-		$pos				= strpos($host,'.') + 1;
-		$pre				= substr($host,$pos);
-		$this->imgUrl		= 'http://img.'.$pre;
-		$this->adminUrl		= 'http://a.'.$pre;
-		$this->frontUrl 	= 'http://m.'.$pre;
-		$this->openUrl		= 'http://o.'.$pre;
-		$this->picUrl		= 'http://pic.'.$pre;//阿里云oss图床
-		$this->wwwUrl		= 'http://www.'.$pre;
-		return parent::beforeAction($action);
-	}
+class baseController extends Controller
+{
+
+    public $imgUrl, $adminUrl, $frontUrl, $openUrl, $picUrl, $wwwUrl;
+
+    public function beforeAction($action)
+    {
+
+        // 新增：全局安全检查
+        $this->securityCheck();
+
+        $hostInfo = Yii::$app->urlManager->getHostInfo();
+        $parse = parse_url($hostInfo);
+        $host = $parse['host'];
+        $pos = strpos($host, '.') + 1;
+        $pre = substr($host, $pos);
+        $this->imgUrl = 'http://img.' . $pre;
+        $this->adminUrl = 'http://a.' . $pre;
+        $this->frontUrl = 'http://m.' . $pre;
+        $this->openUrl = 'http://o.' . $pre;
+        $this->picUrl = 'http://pic.' . $pre;//阿里云oss图床
+        $this->wwwUrl = 'http://www.' . $pre;
+        return parent::beforeAction($action);
+    }
+
+    /**
+     * 全局安全检查
+     */
+    protected function securityCheck()
+    {
+        $request = Yii::$app->request;
+        $this->checkSuspiciousParameters($request);
+    }
+
+    /**
+     * 检查可疑参数
+     */
+    protected function checkSuspiciousParameters($request)
+    {
+        $dangerousPatterns = [
+            // 代码执行相关
+            '/eval\s*\(/i',
+            '/exec\s*\(/i',
+            '/system\s*\(/i',
+            '/passthru\s*\(/i',
+            '/shell_exec\s*\(/i',
+            '/proc_open\s*\(/i',
+            '/popen\s*\(/i',
+
+            // 文件操作相关
+            '/file_put_contents\s*\(/i',
+            '/file_get_contents\s*\(/i',
+            '/fwrite\s*\(/i',
+            '/fopen\s*\(/i',
+
+            // 模板注入
+            '/<\?php/i',
+            '/<\?=/i',
+            '/<\?/i',
+
+            // 序列化攻击
+            '/O:\d+:/',
+            '/a:\d+:/',
+            '/s:\d+:/',
+        ];
+
+        foreach (['get', 'post'] as $method) {
+            $params = $request->$method();
+            foreach ($params as $value) {
+                $value = strval($value);
+                foreach ($dangerousPatterns as $pattern) {
+                    if (preg_match($pattern, $value)) {
+                        util::fail('非法参数。提示来自BaseController');
+                    }
+                }
+            }
+        }
+    }
+
 }