add lan ip and white ip check for admin functions

conf/app.php

@@ -69,6 +69,16 @@ $configs = array(
 
     'defaultMenuStatusInPC' => 'closed',    //PC下左侧目录默认状态，可选值：opened, closed
 
+    //开启局域网ip拥有管理权限，如：保存目录、视频封面图
+    //默认只支持192.168网段以及本机（127.0.0.1、localhost）
+    'adminForLanIps' => true,
+
+    //拥有管理权限的ip白名单
+    'adminWhiteIps' => array(
+        '127.0.0.1',
+        '192.168.1.105',
+    ),
+
     /*
     //视频皮肤配置
     'videoblog' => array(

controller/Controller.php

@@ -192,7 +192,7 @@ Class Controller {
 
             if (!empty($ips)) {
                 for ($i = 0; $i < count($ips); $i++) {
-                    if (!preg_match("/^(10│172\.16│192\.168)\./", $ips[$i])) {
+                    if (!preg_match("/^(10|172\.16|192\.168)\./", $ips[$i])) {
                         $ip = $ips[$i];
                         break;
                     }

plugins/Common.php

@@ -691,4 +691,27 @@ Class Common {
         return $authed;
     }
 
+    //判断当前用户IP是否拥有管理权限
+    public static function isAdminIp($ip) {
+        $admin = false;
+
+        $localhostIps = array(
+            '127.0.0.1',
+            'localhost',
+        );
+
+        if ( !empty(FSC::$app['config']['adminForLanIps']) && (
+                preg_match("/^(10|172\.16|192\.168)\./", $ip)
+                ||
+                in_array($ip, $localhostIps)
+            )
+        ) {
+            $admin = true;
+        }else if (!empty(FSC::$app['config']['adminWhiteIps']) && in_array($ip, FSC::$app['config']['adminWhiteIps'])) {
+            $admin = true;
+        }
+
+        return $admin;
+    }
+
 }

themes/beauty/controller/ListController.php

@@ -226,11 +226,12 @@ Class ListController extends Controller {
         //获取目录面包屑
         $breadcrumbs = $this->getBreadcrumbs($currentDir, $cachedParentData, $scanner);
 
+        $isAdminIp = Common::isAdminIp($this->getUserIp());        //判断是否拥有管理权限
 
         $viewName = '//site/index';     //共享视图
         $params = compact(
             'cateId', 'dirTree', 'scanResults', 'menus', 'htmlReadme', 'breadcrumbs', 'htmlCateReadme',
-            'mp3File', 'page', 'pageSize', 'cacheDataId', 'copyright', 'showType'
+            'mp3File', 'page', 'pageSize', 'cacheDataId', 'copyright', 'showType', 'isAdminIp'
         );
         return $this->render($viewName, $params, $pageTitle);
     }

themes/beauty/controller/SiteController.php

@@ -214,12 +214,13 @@ Class SiteController extends Controller {
             return $this->renderJson(compact('page', 'pageSize', 'videos'));
         }
 
+        $isAdminIp = Common::isAdminIp($this->getUserIp());        //判断是否拥有管理权限
 
         $viewName = 'index';
         $params = compact(
             'page', 'pageSize', 'cacheDataId', 'showType',
             'dirTree', 'scanResults', 'menus', 'htmlReadme', 'htmlCateReadme', 'mp3File', 'copyright',
-            'alertWarning'
+            'alertWarning', 'isAdminIp'
         );
         return $this->render($viewName, $params, $pageTitle);
     }
@@ -373,6 +374,9 @@ Class SiteController extends Controller {
         if (empty($cateId) || empty($url)) {
             $code = 0;
             $msg = '参数不能为空';
+        }else if (Common::isAdminIp($this->getUserIp()) == false) {
+            $code = 0;
+            $msg = '403 Forbidden，禁止访问';
         }else {
             $cacheKey = $this->getCacheKey($cateId, 'snap');
             $img_id = '';   //为保持数据格式一致，图片id传空
@@ -579,13 +583,15 @@ Class SiteController extends Controller {
             $copyright = $readmeFile['copyright'];
         }
 
+        $isAdminIp = Common::isAdminIp($this->getUserIp());        //判断是否拥有管理权限
+
         $pageTitle = "正在播放：{$videoFilename}";
         $this->layout = 'player';
         $viewName = 'player';
         $params = compact(
             'videoUrl', 'videoId', 'videoFilename',
             'cateId', 'cacheParentDataId', 'page', 'pageSize',
-            'copyright'
+            'copyright', 'isAdminIp'
         );
         return $this->render($viewName, $params, $pageTitle);
     }
@@ -628,6 +634,9 @@ Class SiteController extends Controller {
         if (empty($videoId) || empty($metaData)) {
             $code = 0;
             $msg = '参数不能为空';
+        }else if (Common::isAdminIp($this->getUserIp()) == false) {
+            $code = 0;
+            $msg = '403 Forbidden，禁止访问';
         }else {
             $cacheKey = $this->getCacheKey($videoId, 'vmeta');
             $cacheSubDir = 'video';

themes/beauty/views/site/index.php

@@ -86,6 +86,10 @@ if (empty($selectedId) && !empty($viewData['menus'])) {
     $btnSetSnap = '';
 }
 
+if (empty($viewData['isAdminIp'])) {
+    $btnSetSnap = '';
+}
+
 if (!empty($category['files'])) {
     $total = Html::getDataTotal($category['files'], $supportedExts);     //翻页支持
 }

themes/beauty/views/site/player.php

@@ -41,10 +41,12 @@
                 <source src="<?php echo $viewData['videoUrl']; ?>" type="video/mp4">
             </video>
             <div class="text-right mt-2 mr-1">
+                <?php if (!empty($viewData['isAdminIp'])) { ?>
                 <button class="btn btn-default mr-1 btn-snapshot">
                     <img src="/img/beauty/video_dir.png" alt="download icon" width="20">
                     生成封面图
                 </button>
+                <?php } ?>
                 <a class="btn btn-default" href="<?php echo $viewData['videoUrl']; ?>&download=1">
                     <img src="/img/download.png" alt="download icon" width="20">
                     下载视频