文件上传限制

server/application/admin/view/file_new/lists.html

@@ -218,6 +218,8 @@
                 if(res.code == 1) {
                     layer.msg(res.msg);
                     location.reload();
+                } else {
+                    layer.msg(res.msg, {icon:2})
                 }
             }
             ,error: function(){

server/application/common.php

@@ -820,6 +820,30 @@ if (!function_exists('omit_str')) {
     }
 }
 
+function check_is_image($image) : bool
+{
+    
+    try {
+        if (function_exists('exif_imagetype')) {
+            $ImageType =  exif_imagetype($image);
+        } else {
+            $info = getimagesize($image);
+            $ImageType = $info ? $info[2] : false;
+        }
+    } catch (\Exception $e) {
+        return false;
+    }
+    
+    return in_array($ImageType, [1, 2, 3, 6]);
+}
+
+function check_is_video($video) : bool
+{
+    $type = mime_content_type($video);
+    
+    return strpos($type, 'video') !== false;
+}
+
 
 
 

server/application/common/server/FileServer.php

@@ -50,6 +50,11 @@ class FileServer extends ServerBase
 
             $StorageDriver = new StorageDriver($config);
             $StorageDriver->setUploadFile('file');
+    
+            // 验证是否是图片文件
+            if (! check_is_image($StorageDriver->getFileInfo()['tmp_name'] ?? '')) {
+                throw new Exception('不是有效的图像文件');
+            }
 
             if (!$StorageDriver->upload($save_dir)) {
                 throw new Exception('图片上传失败' . $StorageDriver->getError());
@@ -105,6 +110,11 @@ class FileServer extends ServerBase
 
             $StorageDriver = new StorageDriver($config);
             $StorageDriver->setUploadFile('file');
+    
+            // 验证是否是图片文件
+            if (! check_is_image($StorageDriver->getFileInfo()['tmp_name'] ?? '')) {
+                throw new Exception('不是有效的图像文件');
+            }
 
             if (!$StorageDriver->upload($save_dir)) {
                 throw new Exception('图片上传失败' . $StorageDriver->getError());
@@ -157,6 +167,11 @@ class FileServer extends ServerBase
 
             $StorageDriver = new StorageDriver($config);
             $StorageDriver->setUploadFile('file');
+    
+            // 验证是否是视频
+            if (! check_is_video($StorageDriver->getFileInfo()['tmp_name'] ?? '')) {
+                throw new Exception('不是有效的视频文件');
+            }
 
             if (!$StorageDriver->upload($save_dir)) {
                 throw new Exception('图片上传失败' . $StorageDriver->getError());
@@ -336,15 +351,20 @@ class FileServer extends ServerBase
 
             $StorageDriver = new StorageDriver($config);
             $StorageDriver->setUploadFile('file');
-
+    
-            if (!$StorageDriver->upload($save_dir)) {
-                throw new Exception('视频上传失败' . $StorageDriver->getError());
-            }
-
             // 视频上传路径
             $fileName = $StorageDriver->getFileName();
             // 视频信息
             $fileInfo = $StorageDriver->getFileInfo();
+    
+            // 验证是否是视频
+            if (! check_is_video($StorageDriver->getFileInfo()['tmp_name'] ?? '')) {
+                throw new Exception('不是有效的视频文件');
+            }
+
+            if (!$StorageDriver->upload($save_dir)) {
+                throw new Exception('视频上传失败' . $StorageDriver->getError());
+            }
 
             //名字长度太长
             if (strlen($fileInfo['name']) > 128) {

server/composer.json

@@ -32,7 +32,8 @@
         "aliyuncs/oss-sdk-php": "^2.4",
         "qcloud/cos-sdk-v5": "^2.1",
         "alipaysdk/easysdk": "^2.2",
-        "tencentcloud/tencentcloud-sdk-php": "^3.0"
+        "tencentcloud/tencentcloud-sdk-php": "^3.0",
+        "ext-fileinfo": "*"
     },
     "autoload": {
         "psr-4": {