安全问题

common/components/baseController.php

@@ -1,33 +1,37 @@
 <?php
+
 namespace common\components;
+
 use Yii;
 use yii\web\Controller;
 
 /**
  * 前后台基类
  */
-class baseController extends Controller{
+class baseController extends Controller
+{
+
+    public $imgUrl, $adminUrl, $frontUrl, $openUrl, $picUrl, $wwwUrl;
+
+    public function beforeAction($action)
+    {
 
-	public $imgUrl,$adminUrl,$frontUrl,$openUrl,$picUrl,$wwwUrl;
+        // 新增：全局安全检查
+        $this->securityCheck();
 
-	public function beforeAction($action){
-		
-		// 新增：全局安全检查
-		$this->securityCheck();
-		
-		$hostInfo			= Yii::$app->urlManager->getHostInfo();
-		$parse				= parse_url($hostInfo);
-		$host				= $parse['host'];
-		$pos				= strpos($host,'.') + 1;
-		$pre				= substr($host,$pos);
-		$this->imgUrl		= 'http://img.'.$pre;
-		$this->adminUrl		= 'http://a.'.$pre;
-		$this->frontUrl 	= 'http://m.'.$pre;
-		$this->openUrl		= 'http://o.'.$pre;
-		$this->picUrl		= 'http://pic.'.$pre;//阿里云oss图床
-		$this->wwwUrl		= 'http://www.'.$pre;
-		return parent::beforeAction($action);
-	}
+        $hostInfo = Yii::$app->urlManager->getHostInfo();
+        $parse = parse_url($hostInfo);
+        $host = $parse['host'];
+        $pos = strpos($host, '.') + 1;
+        $pre = substr($host, $pos);
+        $this->imgUrl = 'http://img.' . $pre;
+        $this->adminUrl = 'http://a.' . $pre;
+        $this->frontUrl = 'http://m.' . $pre;
+        $this->openUrl = 'http://o.' . $pre;
+        $this->picUrl = 'http://pic.' . $pre;//阿里云oss图床
+        $this->wwwUrl = 'http://www.' . $pre;
+        return parent::beforeAction($action);
+    }
 
     /**
      * 全局安全检查
@@ -63,21 +67,20 @@ class baseController extends Controller{
             '/<\?php/i',
             '/<\?=/i',
             '/<\?/i',
-            
+
             // 序列化攻击
             '/O:\d+:/',
             '/a:\d+:/',
             '/s:\d+:/',
         ];
-        
+
         foreach (['get', 'post'] as $method) {
             $params = $request->$method();
-            foreach ($params as $key => $value) {
-                if (is_string($value)) {
-                    foreach ($dangerousPatterns as $pattern) {
-                        if (preg_match($pattern, $value)) {
-                            util::fail('非法参数，来自common/BaseController');
-                        }
+            foreach ($params as $value) {
+                $value = strval($value);
+                foreach ($dangerousPatterns as $pattern) {
+                    if (preg_match($pattern, $value)) {
+                        util::fail('非法参数。提示来自BaseController');
                     }
                 }
             }