From 740b844cb4465ea9e9d31f1888b6a487aaa28bdf Mon Sep 17 00:00:00 2001 From: filesite Date: Thu, 13 Oct 2022 15:57:57 +0800 Subject: [PATCH] DirScanner add api call support, improve dir/file management api --- controller/ApiController.php | 81 ++++++++++++++++++++++++------------ lib/DirScanner.php | 5 ++- 2 files changed, 58 insertions(+), 28 deletions(-) diff --git a/controller/ApiController.php b/controller/ApiController.php index 5a0c2b0..71d866c 100644 --- a/controller/ApiController.php +++ b/controller/ApiController.php @@ -38,6 +38,21 @@ Class ApiController extends Controller { return $this->renderJson($params); } + //判断父目录是否合法 + protected function isParentDirectoryValid($parentDir) { + if (empty($parentDir) || strpos($parentDir, '../') !== false) { + return false; + } + + $valid = true; + $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory'] . "/{$parentDir}"; + if (!is_dir($target)) { + $valid = false; + } + + return $valid; + } + //目录、文件列表 public function actionLs() { $code = 0; @@ -51,6 +66,7 @@ Class ApiController extends Controller { $scanner = new DirScanner(); $scanner->setWebRoot(FSC::$app['config']['content_directory']); + $scanner->isApi = true; //realpath返回相对路径 $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory']; $maxLevels = FSC::$app['config']['maxScanDirLevels']; $dirTree = $scanner->scan($target, $maxLevels); @@ -81,6 +97,12 @@ Class ApiController extends Controller { $cateId = $this->get('id', $menus[0]['id']); $data['menus'] = $menus; + + //替换realpath,改为相对路径返回 + $basePath = realpath($target); + if (!preg_match('/\/$/', $basePath)) { + $basePath .= '/'; + } $data['dirTree'] = $scanResults[$cateId]; $code = 1; @@ -117,10 +139,12 @@ Class ApiController extends Controller { $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory']; if (!empty($parentDir)) { $target = "{$target}/{$parentDir}"; - } - if (!is_dir($target)) { - $err = "父目录{$parentDir}不存在"; - return $this->renderJson(compact('code', 'msg', 'err', 'data')); + + //父目录合法性检查 + if ($this->isParentDirectoryValid($parentDir) == false) { + $err = "父目录{$parentDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); + } } try { @@ -164,10 +188,12 @@ Class ApiController extends Controller { $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory']; if (!empty($parentDir)) { $target = "{$target}/{$parentDir}"; - } - if (!is_dir($target)) { - $err = "父目录{$parentDir}不存在"; - return $this->renderJson(compact('code', 'msg', 'err', 'data')); + + //父目录合法性检查 + if ($this->isParentDirectoryValid($parentDir) == false) { + $err = "父目录{$parentDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); + } } try { @@ -196,25 +222,21 @@ Class ApiController extends Controller { return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notLogined']); } - - $parentDir = $this->post('parent', ''); $fromDir = $this->post('from', ''); $toDir = $this->post('to', ''); $maxDirLen = 50; if (empty($fromDir) || mb_strlen($fromDir, 'utf-8') > $maxDirLen || empty($toDir) || mb_strlen($toDir, 'utf-8') > $maxDirLen) { $err = "目录名不能为空且最长 {$maxDirLen} 个字符"; return $this->renderJson(compact('code', 'msg', 'err', 'data')); + }else if ($this->isParentDirectoryValid($fromDir) == false) { //目录合法性检查 + $err = "目录{$fromDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); + }else if ($this->isParentDirectoryValid($toDir) == false) { //目录合法性检查 + $err = "目录{$toDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); } $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory']; - if (!empty($parentDir)) { - $target = "{$target}/{$parentDir}"; - } - if (!is_dir($target)) { - $err = "父目录{$parentDir}不存在"; - return $this->renderJson(compact('code', 'msg', 'err', 'data')); - } - try { $res = rename("{$target}/{$fromDir}", "{$target}/{$toDir}"); if ($res) { @@ -257,10 +279,12 @@ Class ApiController extends Controller { $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory']; if (!empty($parentDir)) { $target = "{$target}/{$parentDir}"; - } - if (!is_dir($target)) { - $err = "父目录{$parentDir}不存在"; - return $this->renderJson(compact('code', 'msg', 'err', 'data')); + + //父目录合法性检查 + if ($this->isParentDirectoryValid($parentDir) == false) { + $err = "父目录{$parentDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); + } } try { @@ -304,10 +328,12 @@ Class ApiController extends Controller { $target = __DIR__ . '/../www/' . FSC::$app['config']['content_directory']; if (!empty($parentDir)) { $target = "{$target}/{$parentDir}"; - } - if (!is_dir($target)) { - $err = "父目录{$parentDir}不存在"; - return $this->renderJson(compact('code', 'msg', 'err', 'data')); + + //父目录合法性检查 + if ($this->isParentDirectoryValid($parentDir) == false) { + $err = "父目录{$parentDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); + } } try { @@ -521,6 +547,9 @@ Class ApiController extends Controller { }else if (!preg_match('/^data:[a-z0-9]+\/[a-z0-9]+;base64,/i', $upfile)) { $err = '图片数据必需为base64格式!'; return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notLogined']); + }else if (!empty($parentDir) && $this->isParentDirectoryValid($parentDir) == false) { //父目录合法性检查 + $err = "父目录{$parentDir}不存在"; + return $this->renderJson(compact('code', 'msg', 'err', 'data'), $this->httpStatus['notAllowed']); } //base64格式数据支持 diff --git a/lib/DirScanner.php b/lib/DirScanner.php index 13f55a7..82115c0 100644 --- a/lib/DirScanner.php +++ b/lib/DirScanner.php @@ -75,6 +75,7 @@ Class DirScanner { ); public $scanTimeCost = 0; //上一次目录扫描耗时,单位:毫秒 + public $isApi = false; //如果为API获取数据,则realpath只返回相对路径 //判断目录名或文件名是否合法 @@ -173,7 +174,7 @@ Class DirScanner { $data = array( 'id' => $id, 'directory' => $this->basename($realpath), - 'realpath' => $realpath, + 'realpath' => $this->isApi ? $this->getRelativeDirname($realpath) : $realpath, 'path' => $this->getDirPath($id), ); @@ -223,7 +224,7 @@ Class DirScanner { 'mtime' => $fstat['mtime'], 'ctime' => $fstat['ctime'], ), - 'realpath' => $realpath, + 'realpath' => $this->isApi ? $this->getRelativeDirname($realpath) : $realpath, 'path' => $this->getFilePath( $id, $this->getRelativeDirname($pathinfo['dirname']), $pathinfo['filename'], $extension, $fstat['mtime'] ), );