ecshop/OMS
1
0
Fork 0
mirror of https://gitee.com/ShopeX/OMS synced 2026-08-01 02:16:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

[TBID:SCRUM-7409] fix: 禁用OMS系统qimen Api接口,防止数据注入漏洞

Browse Source
This commit is contained in:
wangbiao
2026-07-07 10:33:11 +08:00
committed by chenping
parent c89ab37dfa
commit b4ecc9a93f
2 changed files with 55 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
app/base/kernel.php
View File

@@ -122,7 +122,6 @@ class kernel{
cachemgr::init();
return kernel::single('base_misc_doc',1)->display($pathinfo);
}elseif($part=='/qimen'){
//qimen路由(birkenstock勃肯中间件使用)
cachemgr::init();
return kernel::single('qimen_rpc_service',1)->process($pathinfo);
}

101
app/qimen/lib/rpc/service.php
View File

@@ -30,52 +30,61 @@ class qimen_rpc_service
die('error');
}
$p = strpos($_REQUEST['method'], '.');
$method = substr($_REQUEST['method'], $p+1, strlen($_REQUEST['method']));
switch($method)
{
case 'onex.oms.custom.iostock.add':
$iostockLib = kernel::single('qimen_iostock_iostock');
//创建入库单
$res = $iostockLib->add($_REQUEST);
//write_log
$title = '接收转仓单通知';
$original_bn = $_REQUEST['trfoutno'];
$status = ($res['rsp'] == 'succ' ? 'success' : 'fail');
$params = array();
$params[0] = $method;
$params[1] = $_POST;
$msg = json_encode($res);
$iostockLib->_write_log($title, $original_bn, $status, $params, $msg);
echo $msg;
exit;
break;
case 'onex.oms.custom.openapi.sync':
$q = json_decode(base64_decode($_REQUEST['q']), true);
$format_parmas = array(
'flag' => $_REQUEST['flag'],
'type' => $_REQUEST['type'],
'charset' => $_REQUEST['charset'],
'ver' => $_REQUEST['ver'],
);
unset($_POST, $_REQUEST);
$_POST = array_merge($format_parmas, $q);
$params = array();
kernel::single('openapi_entrance')->service($params);
break;
default:
break;
}
// 禁止请求此接口，直接返回
$result = array(
'rsp' => 'fail',
'sub_code' => '403', // 无权限（Forbidden）
'sub_message' => '禁止请求此接口!'
);
return json_encode(array('rsp'=>'fail', 'sub_code'=>'e0053', 'sub_message'=>'无效的请求通知'));
return json_encode($result);
// $p = strpos($_REQUEST['method'], '.');
// $method = substr($_REQUEST['method'], $p+1, strlen($_REQUEST['method']));
// switch($method)
// {
// case 'onex.oms.custom.iostock.add':
// $iostockLib = kernel::single('qimen_iostock_iostock');
//
// //创建入库单
// $res = $iostockLib->add($_REQUEST);
//
// //write_log
// $title = '接收转仓单通知';
// $original_bn = $_REQUEST['trfoutno'];
// $status = ($res['rsp'] == 'succ' ? 'success' : 'fail');
//
// $params = array();
// $params[0] = $method;
// $params[1] = $_POST;
//
// $msg = json_encode($res);
//
// $iostockLib->_write_log($title, $original_bn, $status, $params, $msg);
//
// echo $msg;
// exit;
// break;
// case 'onex.oms.custom.openapi.sync':
// $q = json_decode(base64_decode($_REQUEST['q']), true);
//
// $format_parmas = array(
// 'flag' => $_REQUEST['flag'],
// 'type' => $_REQUEST['type'],
// 'charset' => $_REQUEST['charset'],
// 'ver' => $_REQUEST['ver'],
// );
// unset($_POST, $_REQUEST);
//
// $_POST = array_merge($format_parmas, $q);
//
// $params = array();
// kernel::single('openapi_entrance')->service($params);
// break;
// default:
// break;
// }
//
// return json_encode(array('rsp'=>'fail', 'sub_code'=>'e0053', 'sub_message'=>'无效的请求通知'));
}
}