diff --git a/common.php b/common.php index 7e84c0d..12c44aa 100644 --- a/common.php +++ b/common.php @@ -36,6 +36,7 @@ $EnvConfigs = [ 'customTheme' => 0b011, 'theme' => 0b010, 'dontBasicAuth' => 0b010, + 'referrer' => 0b011, 'Driver' => 0b100, 'client_id' => 0b100, @@ -254,6 +255,8 @@ function main($path) } } + if (!isreferhost()) return message('Must visit from designated host', 'NOT_ALLOWED', 403); + // Show disks in root if ($files['showname'] == 'root') return render_list($path, $files); @@ -419,6 +422,19 @@ function extendShow_diskenv($drive) return $drive->ext_show_innerenv(); } +function isreferhost() { + $referer = $_SERVER['referhost']; + if ($referer=='') return true; + if ($referer==$_SERVER['HTTP_HOST']) return true; + $referrer = getConfig('referrer'); + if ($referrer=='') return true; + $arr = explode('|', $referrer); + foreach ($arr as $host) { + if ($host == $referer) return true; + } + return false; +} + function pass2cookie($name, $pass) { return md5($name . ':' . md5($pass)); @@ -533,7 +549,7 @@ function getListpath($domain) } } if (isset($domain_path[$domain])) return spurlencode($domain_path[$domain],'/'); - return spurlencode($public_path,'/'); + return spurlencode($public_path, '/'); } function path_format($path) @@ -639,44 +655,6 @@ function curl($method, $url, $data = '', $headers = [], $returnheader = 0) return $response; } -function curl_request($url, $data = false, $headers = [], $returnheader = 0) -{ - if (!isset($headers['Accept'])) $headers['Accept'] = '*/*'; - //if (!isset($headers['Referer'])) $headers['Referer'] = $url; - //if (!isset($headers['Content-Type'])) $headers['Content-Type'] = 'application/x-www-form-urlencoded'; - $sendHeaders = array(); - foreach ($headers as $headerName => $headerVal) { - $sendHeaders[] = $headerName . ': ' . $headerVal; - } - $ch = curl_init(); - curl_setopt($ch, CURLOPT_URL, $url); - if ($data !== false) { - curl_setopt($ch, CURLOPT_POST, 1); - curl_setopt($ch, CURLOPT_POSTFIELDS, $data); - } - curl_setopt($ch, CURLOPT_TIMEOUT, 5); - curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10); - curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); - curl_setopt($ch, CURLOPT_HEADER, $returnheader); - curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); - curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); - curl_setopt($ch, CURLOPT_HTTPHEADER, $sendHeaders); - //$response['body'] = curl_exec($ch); - if ($returnheader) { - list($returnhead, $response['body']) = explode("\r\n\r\n", curl_exec($ch)); - foreach (explode("\r\n", $returnhead) as $head) { - $tmp = explode(': ', $head); - $heads[$tmp[0]] = $tmp[1]; - } - $response['returnhead'] = $heads; - } else { - $response['body'] = curl_exec($ch); - } - $response['stat'] = curl_getinfo($ch, CURLINFO_HTTP_CODE); - curl_close($ch); - return $response; -} - function clearbehindvalue($path,$page1,$maxpage,$pageinfocache) { for ($page=$page1+1;$page<$maxpage;$page++) { @@ -776,6 +754,7 @@ function message($message, $title = 'Message', $statusCode = 200)

' . $title . '

+ ' . getconstStr('Back') . getconstStr('Home') . '

' . $message . ' @@ -814,8 +793,9 @@ function needUpdate() function output($body, $statusCode = 200, $headers = ['Content-Type' => 'text/html'], $isBase64Encoded = false) { - //$headers['Referrer-Policy'] = 'same-origin'; - $headers['Referrer-Policy'] = 'no-referrer'; + if (isset($_SERVER['Set-Cookie'])) $headers['Set-Cookie'] = $_SERVER['Set-Cookie']; + $headers['Referrer-Policy'] = 'no-referrer'; //$headers['Referrer-Policy'] = 'same-origin'; + $headers['X-Frame-Options'] = 'sameorigin'; return [ 'isBase64Encoded' => $isBase64Encoded, 'statusCode' => $statusCode, @@ -874,12 +854,8 @@ function adminform($name = '', $pass = '', $path = '') ' . getconstStr('LoginSuccess') . ''; $statusCode = 201; date_default_timezone_set('UTC'); - $header = [ - 'Set-Cookie' => $name . '=' . $pass . '; path=/; expires=' . date(DATE_COOKIE, strtotime('+7day')), - //'Location' => $path, - 'Content-Type' => 'text/html' - ]; - return output($html, $statusCode, $header); + $_SERVER['Set-Cookie'] = $name . '=' . $pass . '; path=/; expires=' . date(DATE_COOKIE, strtotime('+7day')); + return output($html, $statusCode); } $statusCode = 401; $html .= ' @@ -1059,7 +1035,8 @@ function EnvOpt($needUpdate = 0) global $drive; ksort($EnvConfigs); $envs = ''; - foreach ($EnvConfigs as $env => $v) if (isCommonEnv($env)) $envs .= '\'' . $env . '\', '; + //foreach ($EnvConfigs as $env => $v) if (isCommonEnv($env)) $envs .= '\'' . $env . '\', '; + $envs = substr(json_encode(array_keys ($EnvConfigs)), 1, -1); $html = 'OneManager '.getconstStr('Setup').''; if (isset($_POST['updateProgram'])&&$_POST['updateProgram']==getconstStr('updateProgram')) { @@ -1127,7 +1104,7 @@ function EnvOpt($needUpdate = 0) $preurl = path_format($_SERVER['PHP_SELF'] . '/'); } $html .= ' -'.getconstStr('Back').'   '.getconstStr('Back').getconstStr('Home').'
+'.getconstStr('Back').'
Github
'; $html .= ' @@ -1137,11 +1114,12 @@ function EnvOpt($needUpdate = 0) '.getconstStr('PlatformConfig').' '; foreach ($EnvConfigs as $key => $val) if (isCommonEnv($key) && isShowedEnv($key)) { - if ($key=='timezone') { - $html .= ' + $html .= ' - + '; + if ($key=='timezone') { + $html .= ' - '.getconstStr('EnvironmentsDescription')[$key].' - - '; + ' . getconstStr('EnvironmentsDescription')[$key]; } elseif ($key=='theme') { $theme_arr = scandir(__DIR__ . $slash . 'theme'); $html .= ' - - - - '.getconstStr('EnvironmentsDescription')[$key].' - - '; + ' . getconstStr('EnvironmentsDescription')[$key]; } /*elseif ($key=='domain_path') { $tmp = getConfig($key); $domain_path = ''; @@ -1182,13 +1153,13 @@ function EnvOpt($needUpdate = 0) '; }*/ else $html .= ' - - - + '; + $html .= ' + '; } $html .= ' - +
'; $disktags = explode('|', getConfig('disktag')); @@ -1249,7 +1220,7 @@ function EnvOpt($needUpdate = 0) } envs = [' . $envs . ']; if (envs.indexOf(t.disktag_sort.value)>-1) { - alert("Do not input ' . $envs . '"); + alert(\'Do not input ' . $envs . '\'); return false; } return true; @@ -1276,21 +1247,21 @@ function EnvOpt($needUpdate = 0)

- - -
- - -
- - - + +
+ +
+ + + +
+ Driver @@ -1306,13 +1277,13 @@ function EnvOpt($needUpdate = 0) if ($diskok) { $html .= ' -
- '; + + '; foreach ($EnvConfigs as $key => $val) if (isInnerEnv($key) && isShowedEnv($key)) { $html .= ' - + '; } $html .= ' @@ -1321,7 +1292,7 @@ function EnvOpt($needUpdate = 0) } else { $html .= ' - Please add this disk again. + ' . $disk_tmp->error['body'] . ' '; } $html .= ' @@ -1369,17 +1340,17 @@ function EnvOpt($needUpdate = 0) } if (!$canOneKeyUpate) { $html .= ' -'.getconstStr('CannotOneKeyUpate').'
'; +' . getconstStr('CannotOneKeyUpate') . '
'; } else { $html .= ' - + - +
'; @@ -2426,6 +2397,6 @@ function render_list($path = '', $files = []) $tmp = splitfirst($html, ''); $html = $tmp[0] . '' . $authinfo . $tmp[1]; - if (isset($_SERVER['Set-Cookie'])) return output($html, $statusCode, [ 'Set-Cookie' => $_SERVER['Set-Cookie'], 'Content-Type' => 'text/html' ]); + //if (isset($_SERVER['Set-Cookie'])) return output($html, $statusCode, [ 'Set-Cookie' => $_SERVER['Set-Cookie'], 'Content-Type' => 'text/html' ]); return output($html, $statusCode); } diff --git a/conststr.php b/conststr.php index c42966e..35d8a5c 100644 --- a/conststr.php +++ b/conststr.php @@ -93,6 +93,7 @@ $constStr = [ 'customScript' => '