huahuibao/common/components/baseController.php

<?php

namespace common\components;

use Yii;
use yii\web\Controller;

/**
 * 前后台基类
 */
class baseController extends Controller
{

    public $imgUrl, $adminUrl, $frontUrl, $openUrl, $picUrl, $wwwUrl;

    public function beforeAction($action)
    {

        // 新增：全局安全检查
        $this->securityCheck();

        $hostInfo = Yii::$app->urlManager->getHostInfo();
        $parse = parse_url($hostInfo);
        $host = $parse['host'];
        $pos = strpos($host, '.') + 1;
        $pre = substr($host, $pos);
        $this->imgUrl = 'http://img.' . $pre;
        $this->adminUrl = 'http://a.' . $pre;
        $this->frontUrl = 'http://m.' . $pre;
        $this->openUrl = 'http://o.' . $pre;
        $this->picUrl = 'http://pic.' . $pre;//阿里云oss图床
        $this->wwwUrl = 'http://www.' . $pre;
        return parent::beforeAction($action);
    }

    /**
     * 全局安全检查
     */
    protected function securityCheck()
    {
        $request = Yii::$app->request;
        $this->checkSuspiciousParameters($request);
    }

    /**
     * 检查可疑参数
     */
    protected function checkSuspiciousParameters($request)
    {
        $dangerousPatterns = [
            // 代码执行相关
            '/eval\s*\(/i',
            '/exec\s*\(/i',
            '/system\s*\(/i',
            '/passthru\s*\(/i',
            '/shell_exec\s*\(/i',
            '/proc_open\s*\(/i',
            '/popen\s*\(/i',
        ];
        foreach (['get', 'post'] as $method) {
            $params = $request->$method();
            foreach ($params as $value) {
                $value = strval($value);
                foreach ($dangerousPatterns as $pattern) {
                    if (preg_match($pattern, $value)) {
                        util::fail("非法参数：{$value}。提示来自baseController");
                    }
                }
            }
        }
    }

}