1，优化后台登录检测。

2，优化保存检测播放器下载器服务器防止出现跨站攻击。
3，其他细节。

application/admin/controller/Index.php

@@ -104,7 +104,7 @@ class Index extends Base
         $this->assign('update_sql',$update_sql);
         $this->assign('mac_lang',config('default_lang'));
 
-        $this->assign('info',$this->_admin);
+        $this->assign('admin',$this->_admin);
         $this->assign('title',lang('admin/index/welcome/title'));
         return $this->fetch('admin@index/welcome');
     }

application/admin/controller/Voddowner.php

@@ -33,6 +33,10 @@ class VodDowner extends Base
             if(is_numeric($param['from'])){
                 $param['from'] .='_';
             }
+            if (strpos($param['from'], '.') !== false || strpos($param['from'], '/') !== false || strpos($param['from'], '\\') !== false) {
+                $this->error(lang('param_err'));
+                return;
+            }
             $list[$param['from']] = $param;
             $sort=[];
             foreach ($list as $k=>&$v){

application/admin/controller/Vodplayer.php

@@ -32,10 +32,13 @@ class VodPlayer extends Base
             unset($param['flag']);
             $code = $param['code'];
             unset($param['code']);
-
             if(is_numeric($param['from'])){
                 $param['from'] .='_';
             }
+            if (strpos($param['from'], '.') !== false || strpos($param['from'], '/') !== false || strpos($param['from'], '\\') !== false) {
+                $this->error(lang('param_err'));
+                return;
+            }
             $list[$param['from']] = $param;
             $sort=[];
             foreach ($list as $k=>&$v){

application/admin/controller/Vodserver.php

@@ -34,7 +34,10 @@ class VodServer extends Base
             if(is_numeric($param['from'])){
                 $param['from'] .='_';
             }
-
+            if (strpos($param['from'], '.') !== false || strpos($param['from'], '/') !== false || strpos($param['from'], '\\') !== false) {
+                $this->error(lang('param_err'));
+                return;
+            }
             $list[$param['from']] = $param;
             $sort=[];
             foreach ($list as $k=>&$v){

application/admin/view/index/welcome.html

@@ -7,7 +7,7 @@
 
     <blockquote class="layui-elem-quote layui-quote-nm mt10">
         <p class="f-20 text-success">{:lang('admin/index/welcome/tip_warn')}</p>
-        <p>{:lang('admin/index/welcome/filed_login_num')}：{$info.admin_login_num}  {:lang('admin/index/welcome/filed_last_login_ip')}：{$info.admin_last_login_ip|long2ip}  {:lang('admin/index/welcome/filed_last_login_time')}：{$info.admin_last_login_time|mac_day}</p>
+        <p>{:lang('admin/index/welcome/filed_login_num')}：{$admin.admin_login_num}  {:lang('admin/index/welcome/filed_last_login_ip')}：{$admin.admin_last_login_ip|long2ip}  {:lang('admin/index/welcome/filed_last_login_time')}：{$admin.admin_last_login_time|mac_day}</p>
     </blockquote>
 
     <table class="layui-table" >

application/common/model/Admin.php

@@ -147,8 +147,7 @@ class Admin extends Base {
         }
 
         session('admin_auth','1');
-        session('admin_id',$row['admin_id']);
-        session('admin_name',$row['admin_name']);
+        session('admin_info',$row->toArray());
 
         //cookie('admin_id',$row['admin_id']);
         //cookie('admin_name',$row['admin_name']);
@@ -160,36 +159,23 @@ class Admin extends Base {
     public function logout()
     {
         session('admin_auth',null);
-        session('admin_name',null);
-        cookie('admin_id',null);
-        cookie('admin_name',null);
-        cookie('admin_check',null);
+        session('admin_info',null);
+        //cookie('admin_id',null);
+        //cookie('admin_name',null);
+        //cookie('admin_check',null);
 
         return ['code'=>1,'msg'=>lang('model/admin/logout_ok')];
     }
 
     public function checkLogin()
     {
-        if(!session('admin_auth')){
+        if(session('admin_auth')!=='1'){
             return ['code'=>1009,'msg'=>lang('model/admin/not_login')];
         }
-        $admin_id = session('admin_id');
-        $admin_name = session('admin_name');
-
-        if(empty($admin_id) || empty($admin_name)){
-            return ['code'=>1001, 'msg'=>lang('model/admin/not_login')];
-        }
-
-        $where = [];
-        $where['admin_id'] = $admin_id;
-        $where['admin_name'] = $admin_name;
-        $where['admin_status'] =1 ;
-
-        $info = $this->where($where)->find();
+        $info = session('admin_info');
         if(empty($info)){
             return ['code'=>1002,'msg'=>lang('model/admin/not_login')];
         }
-        $info = $info->toArray();
         return ['code'=>1,'msg'=>lang('model/admin/haved_login'),'info'=>$info];
     }
 

application/extra/version.php

@@ -3,7 +3,7 @@ return array (
     'name' => '苹果CMS内容管理系统',
     'copyright' => 'MacCMS',
     'url' => '//github.com/magicblack',
-    'code' => '2020.1000.1054',
+    'code' => '2020.1000.1055',
     'license' => '免费版',
 );
 ?>

application/lang/zh-cn.php

@@ -8,7 +8,7 @@
 *last update 0917
 */
 return [
-    'lang_ver'=>'1053+',
+    'lang_ver'=>'1055+',
     'hello'  => '欢迎使用',
     'maccms_name'=>'苹果CMS-v10',
     'maccms_copyright'=>'© MacCMS All Rights Reserved.',
@@ -1356,7 +1356,7 @@ return [
     'admin/voddowner/title'=>'下载器管理',
     'admin/vodplayer/alone_api_url'=>'独立接口地址',
     'admin/vodplayer/alone_api_url'=>'独立接口地址',
-    'admin/vodplayer/code_tip'=>'唯一标识英文、纯数字会自动加_',
+    'admin/vodplayer/code_tip'=>'唯一标识英文、纯数字会自动加_，禁止出现./\\等符号',
     'admin/vodplayer/name_tip'=>'中文名称',
     'admin/vodplayer/api_url'=>'接口地址',
     'admin/vodplayer/api_url_tip'=>'独立接口地址，权重高于全局播放器设置的接口',

application/lang/zh-tw.php

@@ -8,7 +8,7 @@
 *last update 0917
 */
 return [
-    'lang_ver'=>'1053+',
+    'lang_ver'=>'1055+',
     'hello'  => '歡迎使用',
     'maccms_name'=>'蘋果CMS-v10',
     'maccms_copyright'=>'© MacCMS All Rights Reserved.',
@@ -1356,7 +1356,7 @@ return [
     'admin/voddowner/title'=>'下載器管理',
     'admin/vodplayer/alone_api_url'=>'獨立接口地址',
     'admin/vodplayer/alone_api_url'=>'獨立接口地址',
-    'admin/vodplayer/code_tip'=>'唯壹標識英文、純數字會自動加_',
+    'admin/vodplayer/code_tip'=>'唯壹標識英文、純數字會自動加_，禁止出現./\\等符號',
     'admin/vodplayer/name_tip'=>'中文名稱',
     'admin/vodplayer/api_url'=>'接口地址',
     'admin/vodplayer/api_url_tip'=>'獨立接口地址，權重高於全局播放器設置的接口',