ecshop/OMS
1
0
Fork 0
mirror of https://gitee.com/ShopeX/OMS synced 2026-08-05 03:35:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

[TBID:SCRUM-7404] fix: 修复SQL注入漏洞

Browse Source 
# Conflicts:
#	app/taoexlib/lib/request/sms.php
#	app/taoexlib/lib/rpc/sms.php
This commit is contained in:
chenping
2026-07-06 21:06:38 +08:00
parent e1abe4d964
commit 4fddbafa65
2 changed files with 143 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

128
app/taoexlib/lib/request/sms.php
View File

@@ -19,6 +19,10 @@
* 短信模板请求
*/
class taoexlib_request_sms{
const SMS_CALLBACK_CODE_KEY = 'sms.callback.code';
/** 回调 code 有效期（秒），24 小时 */
const SMS_CALLBACK_CODE_TTL = 86400;
public static $serverTimestamp = null;
const VERSION = '1.0';
const SERVICE_URL = '/sms-tpl/';
@@ -72,7 +76,7 @@ class taoexlib_request_sms{
'content' => $this->_format_content($sms_data['content']),
'keys' => $keys,
'tags'=>'',
'callback'=> kernel::openapi_url('openapi.taoexlib.sms','sms_callback'),
'callback'=> kernel::openapi_url('openapi.taoexlib.sms','sms_callback', array('code' => self::get_sms_callback_code())),
);
break;
@@ -151,7 +155,6 @@ class taoexlib_request_sms{
* 模板列表请求
*/
public function list_request($type,$method,$data){
$oSms_sample = app::get('taoexlib')->model('sms_sample');
$params = $this->_sms_templateParams($type,$data);
$api_url = $this->_sms_templateUrl($type);
$result = $this->_request($api_url,$method,$params);
@@ -159,32 +162,7 @@ class taoexlib_request_sms{
if ($result['res'] == 'succ') {
$result = $result['data'];
foreach ($result as $re ) {
$sqlstr = array();
if (in_array($re['approved'],array('0','1'))) {
if ($re['approved']=='0') {
$approved = '2';
$reason = $re['reason'];
$sqlstr[]="sync_reason='".$reason."'";
}else if($re['approved']=='1'){
$approved = '1';
}
$isapproved = $data['isapproved'];
if ($isapproved == 'true') {
$sqlstr[]=',`status`=\'1\'';
}
$approved_at = $re['approved_at'];
$sqlstr[]="approved='".$approved."',approvedtime=".$approved_at;
$tplid = $re['tplid'];
$name = $re['name'];
if ($sqlstr) {
$sqlstr = implode(',',$sqlstr);
$oSms_sample->db->exec("UPDATE sdb_taoexlib_sms_sample_items SET ".$sqlstr." WHERE tplid='".$tplid."'");
$oSms_sample->db->exec("UPDATE sdb_taoexlib_sms_sample SET approved='".$approved."' WHERE tplid='".$tplid."'");
}
}
//其它更新为不启用
$this->_update_sms_approval_status($re, $data);
}
}
return true;
@@ -270,6 +248,100 @@ class taoexlib_request_sms{
}
return md5($str . md5($token));
}
/**
* 刷新短信回调 code 并写入 kv（带过期时间）
* @return string
*/
public static function refresh_sms_callback_code()
{
$code = md5(microtime());
base_kvstore::instance('taoexlib')->store(
self::SMS_CALLBACK_CODE_KEY,
$code,
self::SMS_CALLBACK_CODE_TTL
);
return $code;
}
/**
* 获取短信回调 code，不存在或已过期则重新生成
* @return string
*/
public static function get_sms_callback_code()
{
if (base_kvstore::instance('taoexlib')->fetch(self::SMS_CALLBACK_CODE_KEY, $code) && $code) {
return strval($code);
}
return self::refresh_sms_callback_code();
}
/**
* 校验短信模板审核回调 code（URL 路径中的 code 与 kv 中未过期的值一致）
* @param array $result
* @return bool
*/
public static function verify_sms_callback_code($result)
{
$code = isset($result['code']) ? trim(strval($result['code'])) : '';
if ($code === '') {
return false;
}
if (!base_kvstore::instance('taoexlib')->fetch(self::SMS_CALLBACK_CODE_KEY, $storedCode) || !$storedCode) {
return false;
}
return $code === strval($storedCode);
}
/**
* 根据审核结果更新短信模板状态
* @param array $item
* @param array $data
* @return void
*/
protected function _update_sms_approval_status($item, $data)
{
if (!in_array($item['approved'], array('0', '1'))) {
return;
}
$tplid = isset($item['tplid']) ? trim(strval($item['tplid'])) : '';
if ($tplid === '' || strlen($tplid) > 25 || !preg_match('/^[a-zA-Z0-9_-]+$/', $tplid)) {
return;
}
if ($item['approved'] == '0') {
$approved = '2';
} else {
$approved = '1';
}
$approved_at = time();
if (isset($item['approved_at']) && preg_match('/^\d+$/', strval($item['approved_at']))) {
$approved_at = intval($item['approved_at']);
}
$itemsModel = app::get('taoexlib')->model('sms_sample_items');
$sampleModel = app::get('taoexlib')->model('sms_sample');
$filter = array('tplid' => $tplid);
$itemsData = array(
'approved' => $approved,
'approvedtime' => $approved_at,
);
if ($item['approved'] == '0' && isset($item['reason'])) {
$itemsData['sync_reason'] = substr(trim(strval($item['reason'])), 0, 200);
}
if (isset($data['isapproved']) && $data['isapproved'] == 'true') {
$itemsData['status'] = '1';
}
$itemsModel->update($itemsData, $filter);
$sampleModel->update(array('approved' => $approved), $filter);
}
/**
*格式化内容
* @param type $varname description

70
app/taoexlib/lib/rpc/sms.php
View File

@@ -22,7 +22,6 @@
*/
class taoexlib_rpc_sms
{
/**
* 更新短信审核状态
* @param array result
@@ -33,33 +32,50 @@ class taoexlib_rpc_sms
function sms_callback($result)
{
$result = $_POST;
$reason = $result['reason'];
$tplid= $result['tplid'];
$status = $result['status'];
$db = kernel::database();
// status=0｜1｜2(拒绝｜通过｜等待审核),
$sqlstr=array();
if (in_array($status,array('0','1'))) {
if ($status == '0') {
$approved = '2';
$sqlstr[]="sync_reason='".$reason."'";
}else if($status == '1'){
$approved = '1';
}
$approved_at = $re['approved_at'];
$sqlstr[]="approved='".$approved."',approvedtime=".$approved_at;
if ($sqlstr) {
$sqlstr = implode(',',$sqlstr);
$db->exec("UPDATE sdb_taoexlib_sms_sample_items SET ".$sqlstr." WHERE tplid='".$tplid."'");
$db->exec("UPDATE sdb_taoexlib_sms_sample SET approved='".$approved."' WHERE tplid='".$tplid."'");
}
if (!taoexlib_request_sms::verify_sms_callback_code($result)) {
header('HTTP/1.1 403 Forbidden');
echo 'invalid code';
return false;
}
$status = isset($_POST['status']) ? strval($_POST['status']) : '';
if (!in_array($status, array('0', '1'), true)) {
header('HTTP/1.1 400 Bad Request');
echo 'Invalid status';
return false;
}
$tplid = isset($_POST['tplid']) ? trim(strval($_POST['tplid'])) : '';
if ($tplid === '' || strlen($tplid) > 25 || !preg_match('/^[a-zA-Z0-9_-]+$/', $tplid)) {
header('HTTP/1.1 400 Bad Request');
echo 'Invalid tplid';
return false;
}
$reason = isset($_POST['reason']) ? substr(trim(strval($_POST['reason'])), 0, 200) : '';
$approved = ($status == '0') ? '2' : '1';
$approved_at = time();
if (isset($_POST['approved_at']) && preg_match('/^\d+$/', strval($_POST['approved_at']))) {
$approved_at = intval($_POST['approved_at']);
}
$itemsModel = app::get('taoexlib')->model('sms_sample_items');
$sampleModel = app::get('taoexlib')->model('sms_sample');
$filter = array('tplid' => $tplid);
$itemsData = array(
'approved' => $approved,
'approvedtime' => $approved_at,
);
if ($status == '0') {
$itemsData['sync_reason'] = $reason;
}
$itemsModel->update($itemsData, $filter);
$sampleModel->update(array('approved' => $approved), $filter);
echo 'OK';
return true;
}
}
?>
}