修改微信关键词xss过滤，只允许a标签

zoujingli · Sep 17, 2021 · d7a9fc0 · d7a9fc0
1 parent 416b2af
commit d7a9fc0
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/app/wechat/controller/Keys.php b/app/wechat/controller/Keys.php
@@ -169,6 +169,7 @@ protected function _form_filter(array &$data)
             if (WechatKeys::mk()->where($map)->count() > 0) {
                 $this->error('该关键字已经存在！');
             }
+            $data['content'] = strip_tags($data['content'], '<a>');
         } elseif ($this->request->isGet()) {
             $public = dirname($this->request->basefile(true));
             $this->defaultImage = "{$public}/static/theme/img/image.png";

diff --git a/app/wechat/view/api/view/text.html b/app/wechat/view/api/view/text.html
@@ -4,6 +4,6 @@
 <div class="header"><span>{:date('H:i')}</span></div>
 <div class="container">
     <div class="logo">Ta</div>
-    <div class="content arrow">{$content|default=''}</div>
+    <div class="content arrow">{$content|raw|default=''}</div>
 </div>
 {/block}