huahuibao/common/components/baseController.php

<?php
namespace common\components;
use Yii;
use yii\web\Controller;

/**
 * 前后台基类
 */
class baseController extends Controller{

	public $imgUrl,$adminUrl,$frontUrl,$openUrl,$picUrl,$wwwUrl;

	public function beforeAction($action){
		
		// 新增：全局安全检查
		$this->securityCheck();
		
		$hostInfo			= Yii::$app->urlManager->getHostInfo();
		$parse				= parse_url($hostInfo);
		$host				= $parse['host'];
		$pos				= strpos($host,'.') + 1;
		$pre				= substr($host,$pos);
		$this->imgUrl		= 'http://img.'.$pre;
		$this->adminUrl		= 'http://a.'.$pre;
		$this->frontUrl 	= 'http://m.'.$pre;
		$this->openUrl		= 'http://o.'.$pre;
		$this->picUrl		= 'http://pic.'.$pre;//阿里云oss图床
		$this->wwwUrl		= 'http://www.'.$pre;
		return parent::beforeAction($action);
	}

    /**
     * 全局安全检查
     */
    protected function securityCheck()
    {
        $request = Yii::$app->request;
        $this->checkSuspiciousParameters($request);
    }

    /**
     * 检查可疑参数
     */
    protected function checkSuspiciousParameters($request)
    {
        $dangerousPatterns = [
            // 代码执行相关
            '/eval\s*\(/i',
            '/exec\s*\(/i',
            '/system\s*\(/i',
            '/passthru\s*\(/i',
            '/shell_exec\s*\(/i',
            '/proc_open\s*\(/i',
            '/popen\s*\(/i',

            // 文件操作相关
            '/file_put_contents\s*\(/i',
            '/file_get_contents\s*\(/i',
            '/fwrite\s*\(/i',
            '/fopen\s*\(/i',

            // 模板注入
            '/<\?php/i',
            '/<\?=/i',
            '/<\?/i',
            
            // 序列化攻击
            '/O:\d+:/',
            '/a:\d+:/',
            '/s:\d+:/',
        ];
        
        foreach (['get', 'post'] as $method) {
            $params = $request->$method();
            foreach ($params as $key => $value) {
                if (is_string($value)) {
                    foreach ($dangerousPatterns as $pattern) {
                        if (preg_match($pattern, $value)) {
                            util::fail('非法参数，来自common/BaseController');
                        }
                    }
                }
            }
        }
    }

}