From b04374a9f71b413b7d40163a1932bd63a34109f8 Mon Sep 17 00:00:00 2001
From: filesite <release@filesite.io>
Date: Tue, 7 May 2024 10:15:45 +0000
Subject: [PATCH] replace special chars of nickname

---
 plugins/Common.php                              | 13 +++++++++++++
 themes/tajian/controller/FrontapiController.php |  6 +++++-
 themes/tajian/views/layout/main.php             |  2 +-
 themes/tajian/views/site/myindex.php            |  2 +-
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/plugins/Common.php b/plugins/Common.php
index b75fb30..77416c7 100644
--- a/plugins/Common.php
+++ b/plugins/Common.php
@@ -3,6 +3,19 @@
  * 常用的公用方法
  */
 Class Common {
+    public static function cleanSpecialChars($str) {
+        $findChars = array(
+            '"',
+            "'",
+            '&',
+            '<',
+            '>',
+            '\/',
+        );
+
+        return str_replace($findChars, '', $str);
+    }
+
 	public static function isCellphoneNumber($number) {
         return preg_match("/^1[3456789][0-9]{9}$/", $number);
     }
diff --git a/themes/tajian/controller/FrontapiController.php b/themes/tajian/controller/FrontapiController.php
index 5081973..db3abf6 100644
--- a/themes/tajian/controller/FrontapiController.php
+++ b/themes/tajian/controller/FrontapiController.php
@@ -690,7 +690,11 @@ eof;
 
             if (empty($nickname)) {
                 $err = "请填写注册你的昵称";
-            }else if (mb_strlen($nickname, 'utf-8') < 2 || mb_strlen($nickname, 'utf-8') > 5) {
+            }else {
+                $nickname = Common::cleanSpecialChars($nickname);
+            }
+
+            if (mb_strlen($nickname, 'utf-8') < 2 || mb_strlen($nickname, 'utf-8') > 5) {
                 $err = "昵称至少 2 个汉字，最多 5 个汉字，请按规则填写";
             }
 
diff --git a/themes/tajian/views/layout/main.php b/themes/tajian/views/layout/main.php
index a74e0ad..f27f654 100644
--- a/themes/tajian/views/layout/main.php
+++ b/themes/tajian/views/layout/main.php
@@ -24,7 +24,7 @@ if (!empty(FSC::$app['config']['multipleUserUriParse']) && !empty(FSC::$app['use
         <a class="log_tn clearfix" href="/">
             <span class="verBaseline">Ta荐</span>
             <?php if (!empty($viewData['nickname'])) { ?>
-                - <strong><?=$viewData['nickname']?></strong>
+                - <strong><?=htmlspecialchars($viewData['nickname'], ENT_QUOTES)?></strong>
             <?php } ?>
         </a>
         <div class="search hide_movi_xs hide">
diff --git a/themes/tajian/views/site/myindex.php b/themes/tajian/views/site/myindex.php
index 097c28d..7c0d05c 100644
--- a/themes/tajian/views/site/myindex.php
+++ b/themes/tajian/views/site/myindex.php
@@ -44,7 +44,7 @@ if (!empty($viewData['tags'])) {        //显示tags分类
         //输出分类名称
         echo <<<eof
         <div class="tgroup">
-            <a href="{$linkPrefix}/list/?id={$id}" class="morelink">&gt;&gt;更多</a>
+            <a href="{$linkPrefix}/list/?id={$id}" class="morelink">更多&gt;&gt;</a>
             <h3>{$item['name']}</h3>
         </div>
         <div class="clearfix">