安全问题

common/components/baseController.php

@@ -56,30 +56,18 @@ class baseController extends Controller
             '/shell_exec\s*\(/i',
             '/proc_open\s*\(/i',
             '/popen\s*\(/i',
-
-            // 文件操作相关
-            '/file_put_contents\s*\(/i',
-            '/file_get_contents\s*\(/i',
-            '/fwrite\s*\(/i',
-            '/fopen\s*\(/i',
-
-            // 模板注入
-            '/<\?php/i',
-            '/<\?=/i',
-            '/<\?/i',
         ];
-
-//        foreach (['get', 'post'] as $method) {
-//            $params = $request->$method();
-//            foreach ($params as $value) {
-//                $value = strval($value);
-//                foreach ($dangerousPatterns as $pattern) {
-//                    if (preg_match($pattern, $value)) {
-//                        util::fail('非法参数。提示来自BaseController');
-//                    }
-//                }
-//            }
-//        }
+        foreach (['get', 'post'] as $method) {
+            $params = $request->$method();
+            foreach ($params as $value) {
+                $value = strval($value);
+                foreach ($dangerousPatterns as $pattern) {
+                    if (preg_match($pattern, $value)) {
+                        util::fail('非法参数。提示来自baseController');
+                    }
+                }
+            }
+        }
     }
 
 }