加固-01/02: CWD 无关 include 改造 + UEditor 全入口鉴权 (P0-01)

A. 相对路径 include/require 全量改写为 __DIR__ 基址
   - 修复 nginx+fastcgi 下 php-cgi 继承启动目录 CWD (D:\phpstudy_pro\COM)
     导致 require '../function/...' 相对路径 include 全部失效；
     28 文件 101 处统一改为 __DIR__ 绝对基址，任意 Web 服务器行为一致。
   - 补齐带括号/缺斜杠漏改的 13 处 (controller.php、epay lib、
     payment.php、notify_url.php、return_url.php)。
   - function/config.inc.php 增加 config.local.inc.php 本地覆盖机制
     (该文件加入 .gitignore 不入库)，仓库默认配置保持中立。

B. UEditor 后台入口安全加固 (P0-01)
   - admin/php/controller.php 全部 action 前置管理员会话校验
     (admin_username + admin_password)，匿名无法上传/抓取/列目录/读配置。
   - 禁用远程图片抓取 catchimage (SSRF 向量)，删除 action_crawler.php。
   - 上传/列表白名单剔除 .exe/.dll/.iso/.cab/.swf。
   - Uploader: 移除 iconv('unicode') Windows 告警行；
     getFileInfo/action_list 的 URL 拼接增加 REQUEST_SCHEME 回退。

验证: 匿名访问全部 action 返回未授权；登录态上传成功且 URL 正确；
catchimage 已禁用；JSON 合法；全量 php -l 0 错误；
nginx(8081) 与内置服务器(8082) 双通道回归通过。

.gitignore

@@ -4,4 +4,5 @@
 *.bak
 /SDK/*.bak
 /function/function_core_source.php
-/install.php
+/install.php
+/function/config.local.inc.php

admin/ajax.php

@@ -5,7 +5,7 @@
  * Date: 2017-10-19
  * Time: 22:12
  */
-require '../function/function_core.php';
+require __DIR__ . '/../function/function_core.php';
 
 
 if ($_GET['mod'] === 'login'){
@@ -29,7 +29,7 @@ if ($_GET['mod'] === 'login'){
     if (empty($_POST['password'])) {
         die(json_encode(array('code' => -2, 'msg' => '请输入您的密码')));
     }
-    include '../function/VerificationCode.class.php';
+    include __DIR__ . '/../function/VerificationCode.class.php';
     $verification = Verification::check($_POST['token']);
     if ($verification !== true) {
         die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -356,7 +356,7 @@ switch ($_GET['mod']){
 
         $backinfo['code'] = 0;
         $backinfo['count'] = $db->select_count_row('sq_level',array(),'AND');
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
 
         if(!$arr = $db->select_limit_row('sq_level','*',($_GET['page'] - 1) * $_GET['limit'] , $_GET['limit'], array(), 'AND')){
             //$backinfo['code'] = -1;
@@ -403,7 +403,7 @@ switch ($_GET['mod']){
         //echo $whereinfo;
         $backinfo['code'] = 0;
         $backinfo['count'] = $db->select_count_row('sq_user',$whereinfo,'AND');
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         $appinfo = app_idgetinfo($_GET['appid']);
         if(!$arr = $db->select_limit_row('sq_user','*',($_GET['page'] - 1) * $_GET['limit'] , $_GET['limit'], $whereinfo, 'AND','ORDER BY ID DESC')){
             //$backinfo['code'] = -1;
@@ -528,7 +528,7 @@ switch ($_GET['mod']){
         }
         break;
     case 'getfidlist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if(!$result = $db->select_limit_row('sq_fidlist','*',($_GET['page'] - 1) * $_GET['limit'] , $_GET['limit'], array(), 'AND')){
 
             $backinfo['msg'] = $db->geterror();
@@ -606,7 +606,7 @@ switch ($_GET['mod']){
         )));
         break;
     case 'getlevallist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         $list  = '<option></option>';
         $back = $db->select_all_row('sq_level','ID,lname',array(),'AND');
         if (!empty($_POST['aid'])){
@@ -631,7 +631,7 @@ switch ($_GET['mod']){
         }
         break;
     case 'getagentlist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if(!$result = $db->select_limit_row('sq_agent','*',($_GET['page'] - 1) * $_GET['limit'] , $_GET['limit'], array(), 'AND')){
 			
             $backinfo['code'] = -1;
@@ -998,7 +998,7 @@ switch ($_GET['mod']){
         }
         $db->update('sq_trade',array('ID'=>$_POST['id']),'AND',array('status'=>3));
         $tradeinfo['status'] = 2;
-        include '../function/trade.inc.php';
+        include __DIR__ . '/../function/trade.inc.php';
         $back = trade_do($tradeinfo);
         //print_r($back);
         $back = json_decode($back,true);
@@ -1096,7 +1096,7 @@ switch ($_GET['mod']){
         die(makejson(1,'success',array('items'=>$result)));
         break;
     case 'loadbuybody':
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         if(!$appinfo = app_idgetinfo($_POST['appid'])){
             die();
         }
@@ -1188,7 +1188,7 @@ switch ($_GET['mod']){
         die($output);
         break;
     case 'buy_submit':
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         $_POST = json_decode($_POST['content'],true);
         if (!$appinfo = app_idgetinfo($_POST['id'])){
             die('应用信息获取失败');
@@ -1203,7 +1203,7 @@ switch ($_GET['mod']){
             die('开通的数量不能为空');
         }
         $balance = $_POST['kt_num'];
-        include '../function/function_auth.php';
+        include __DIR__ . '/../function/function_auth.php';
         if(!isset($_POST['kt_ip'])){
             $_POST['kt_ip'] = '';
         }
@@ -1285,7 +1285,7 @@ switch ($_GET['mod']){
         die('../.'.$info['imgsrc']);
     case 'gradelist':
 
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         $result = $db->select_all_row('sq_level','*','','');
         $data['gradelist_op'] = '<option value="0">请选择一个代理级别进行设置</option>';
         $data['gradelist_ad'] = '';
@@ -1345,7 +1345,7 @@ switch ($_GET['mod']){
             }
             die(json_encode($backinfo));
         }else{
-            include_once '../function/function_app.php';
+            include_once __DIR__ . '/../function/function_app.php';
             $info = '';
             $backinfo['code'] = 0;
             $backinfo['msg'] = '';
@@ -1457,7 +1457,7 @@ switch ($_GET['mod']){
         }
         break;
     case 'fidlist_show':
-        include_once '../function/function_app.php';
+        include_once __DIR__ . '/../function/function_app.php';
         $res = $db->select_all_row('sq_fidlist');
         $str = '<option></option>';
         foreach ($res as $info){

admin/index.php

@@ -5,7 +5,7 @@
  * Date: 2017-10-15
  * Time: 12:08
  */
-require '../function/function_core.php';
+require __DIR__ . '/../function/function_core.php';
 
 
 if (empty($_SESSION['admin_username']) || empty($_SESSION['admin_password'])) {

admin/php/Uploader.class.php

@@ -63,7 +63,8 @@ class Uploader
             $this->upFile();
         }
 
-        $this->stateMap['ERROR_TYPE_NOT_ALLOWED'] = iconv('unicode', 'utf-8', $this->stateMap['ERROR_TYPE_NOT_ALLOWED']);
+        // 原代码用 iconv('unicode','utf-8',...) 做错误信息国际化，Windows 下 'unicode' 非合法 charset 会告警且无实际意义，移除
+        // $this->stateMap['ERROR_TYPE_NOT_ALLOWED'] = iconv('unicode', 'utf-8', $this->stateMap['ERROR_TYPE_NOT_ALLOWED']);
     }
 
     /**
@@ -362,9 +363,10 @@ class Uploader
      */
     public function getFileInfo()
     {
+        $scheme = isset($_SERVER['REQUEST_SCHEME']) ? strtolower($_SERVER['REQUEST_SCHEME']) : (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' ? 'https' : 'http');
         return array(
             "state" => $this->stateInfo,
-            "url" => $_SERVER['REQUEST_SCHEME'] . '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'] . dirname(dirname(dirname($_SERVER['REQUEST_URI']))) . $this->fullName,
+            "url" => $scheme . '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'] . dirname(dirname(dirname($_SERVER['REQUEST_URI']))) . $this->fullName,
             "title" => $this->fileName,
             "original" => $this->oriName,
             "type" => $this->fileType,

admin/php/action_crawler.php

@@ -1,44 +0,0 @@
-<?php
-/**
- * 抓取远程图片
- * User: Jinqn
- * Date: 14-04-14
- * Time: 下午19:18
- */
-set_time_limit(0);
-include("Uploader.class.php");
-
-/* 上传配置 */
-$config = array(
-    "pathFormat" => $CONFIG['catcherPathFormat'],
-    "maxSize" => $CONFIG['catcherMaxSize'],
-    "allowFiles" => $CONFIG['catcherAllowFiles'],
-    "oriName" => "remote.png"
-);
-$fieldName = $CONFIG['catcherFieldName'];
-
-/* 抓取远程图片 */
-$list = array();
-if (isset($_POST[$fieldName])) {
-    $source = $_POST[$fieldName];
-} else {
-    $source = $_GET[$fieldName];
-}
-foreach ($source as $imgUrl) {
-    $item = new Uploader($imgUrl, $config, "remote");
-    $info = $item->getFileInfo();
-    array_push($list, array(
-        "state" => $info["state"],
-        "url" => $info["url"],
-        "size" => $info["size"],
-        "title" => htmlspecialchars($info["title"]),
-        "original" => htmlspecialchars($info["original"]),
-        "source" => htmlspecialchars($imgUrl)
-    ));
-}
-
-/* 返回抓取数据 */
-return json_encode(array(
-    'state' => count($list) ? 'SUCCESS' : 'ERROR',
-    'list' => $list
-));

admin/php/action_list.php

@@ -5,7 +5,7 @@
  * Date: 14-04-09
  * Time: 上午10:17
  */
-include "Uploader.class.php";
+include __DIR__ . "/Uploader.class.php";
 
 /* 判断类型 */
 switch ($_GET['action']) {
@@ -84,9 +84,10 @@ function getfiles($path, $allowFiles, &$files = array())
             } else {
                 if (preg_match("/\.(" . $allowFiles . ")$/i", $file)) {
                     //echo $path2;
+                    $scheme = isset($_SERVER['REQUEST_SCHEME']) ? strtolower($_SERVER['REQUEST_SCHEME']) : (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' ? 'https' : 'http');
                     $files[] = array(
 
-                        'url' => $_SERVER['REQUEST_SCHEME'] . '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'] . dirname(dirname(dirname($_SERVER['REQUEST_URI']))) . substr($path2, strlen($G['sys']['rootdir'])),
+                        'url' => $scheme . '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'] . dirname(dirname(dirname($_SERVER['REQUEST_URI']))) . substr($path2, strlen($G['sys']['rootdir'])),
                         'mtime' => filemtime($path2)
                     );
                 }

admin/php/action_upload.php

@@ -5,7 +5,7 @@
  * Date: 14-04-09
  * Time: 上午10:17
  */
-include "Uploader.class.php";
+include __DIR__ . "/Uploader.class.php";
 
 /* 上传配置 */
 $base64 = "upload";

admin/php/config.json

@@ -98,7 +98,6 @@
   /* 上传大小限制，单位B，默认100MB */
   "videoAllowFiles": [
     ".flv",
-    ".swf",
     ".mkv",
     ".avi",
     ".rm",
@@ -157,8 +156,6 @@
     ".gz",
     ".7z",
     ".bz2",
-    ".cab",
-    ".iso",
     ".doc",
     ".docx",
     ".xls",
@@ -168,9 +165,7 @@
     ".pdf",
     ".txt",
     ".md",
-    ".xml",
+    ".xml"
-    ".exe",
-    ".dll"
   ],
   /* 上传文件格式显示 */
 

admin/php/controller.php

@@ -6,8 +6,15 @@ date_default_timezone_set("Asia/chongqing");
 error_reporting(E_ERROR);
 header("Content-Type: text/html; charset=utf-8");
 
-$CONFIG = json_decode(preg_replace("/\/\*[\s\S]+?\*\//", "", file_get_contents("config.json")), true);
+$CONFIG = json_decode(preg_replace("/\/\*[\s\S]+?\*\//", "", file_get_contents(__DIR__ . "/config.json")), true);
 //print_r($CONFIG);
+
+/* 安全加固(P0)：UEditor 全部入口必须处于已登录的管理员会话，杜绝匿名上传/抓取 */
+if (empty($_SESSION['admin_username']) || empty($_SESSION['admin_password'])) {
+    header("Content-Type: application/json; charset=utf-8");
+    die(json_encode(array('state' => '未授权：请先登录管理后台')));
+}
+
 $action = $_GET['action'];
 
 switch ($action) {
@@ -23,21 +30,21 @@ switch ($action) {
     case 'uploadvideo':
         /* 上传文件 */
     case 'uploadfile':
-        $result = include("action_upload.php");
+        $result = include(__DIR__ . "/action_upload.php");
         break;
 
     /* 列出图片 */
     case 'listimage':
-        $result = include("action_list.php");
+        $result = include(__DIR__ . "/action_list.php");
         break;
     /* 列出文件 */
     case 'listfile':
-        $result = include("action_list.php");
+        $result = include(__DIR__ . "/action_list.php");
         break;
 
-    /* 抓取远程文件 */
+    /* 抓取远程文件：安全加固(P0)后已禁用 —— 任意 URL 拉取可被用于 SSRF（内网探测/元数据端点读取） */
     case 'catchimage':
-        $result = include("action_crawler.php");
+        $result = json_encode(array('state' => 'ERROR', 'list' => array(), 'msg' => '远程抓取功能已禁用'));
         break;
 
     default:

agent/ajax.php

@@ -6,7 +6,7 @@
  * Time: 22:12
  * 测试的
  */
-include '../function/function_core.php';
+include __DIR__ . '/../function/function_core.php';
 if ($_GET['mod'] === 'login') {
     if (!empty($_POST['token'])) {
         if (!$result = $db->select_first_row('sq_agent', '*', array('accesstoken' => $_POST['token']), 'AND')) {
@@ -23,7 +23,7 @@ if ($_GET['mod'] === 'login') {
     }
 
 
-    include '../function/VerificationCode.class.php';
+    include __DIR__ . '/../function/VerificationCode.class.php';
     $verification = Verification::check($_POST['token']);
     if ($verification !== true) {
         die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -108,7 +108,7 @@ switch ($_GET['mod']) {
         if (!$levelinfo = $db->select_first_row('sq_level', '*', array('ID' => $agentinfo['levelid']), 'AND')) {
             die(json_encode(array('code' => -2, 'msg' => '代理等级信息获取失败！')));
         }
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         $where = array();
         $i = '<option value="0">显示所有商品</option>';
         $info = explode(',', $levelinfo['appid']);
@@ -130,7 +130,7 @@ switch ($_GET['mod']) {
         die($i);
         break;
     case 'buy_fidlist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
 
         //$where['agentbuy'] = '1';
         if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $_SESSION['agent_username']), 'AND')) {
@@ -235,7 +235,7 @@ switch ($_GET['mod']) {
         //echo $whereinfo;
         $backinfo['code'] = 0;
         $backinfo['count'] = $db->select_count_row('sq_user', $whereinfo, 'AND');
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         $appinfo = app_idgetinfo($_GET['appid']);
         if (!$arr = $db->select_limit_row('sq_user', '*', ($_GET['page'] - 1) * $_GET['limit'], $_GET['limit'], $whereinfo, 'AND')) {
             //$backinfo['code'] = -1;
@@ -332,7 +332,7 @@ switch ($_GET['mod']) {
 
     case 'buy_first':
 
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         $fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $_GET['fid']), 'AND');
         $appinfo = app_idgetinfo($fidinfo['appid']);
         $show_form = '';
@@ -393,11 +393,11 @@ switch ($_GET['mod']) {
             }
             $type = 3;
         }
-        include './html/buy.page.inc.php';
+        include __DIR__ . '/html/buy.page.inc.php';
         die();
         break;
     case 'buy_submit':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
 
         if (!$fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $_POST['id']), 'AND')) {
             die(json_encode(array('code' => -2, 'msg' => '无法找到该商品，请刷新页面重试')));
@@ -828,7 +828,7 @@ switch ($_GET['mod']) {
         }
         break;
     case 'getagentlist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if (!$result = $db->select_limit_row('sq_agent', '*', ($_GET['page'] - 1) * $_GET['limit'], $_GET['limit'], array('superior' => $_SESSION['agent_id']), 'AND')) {
             $error = $db->geterror();
             if (!empty($error)) {
@@ -893,7 +893,7 @@ switch ($_GET['mod']) {
         }
         break;
     case 'leveltips':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if (!$levelinfo = $db->select_first_row('sq_level', '*', array('ID' => $_POST['leval']), 'AND')) {
             die('等级信息获取失败');
         }
@@ -905,7 +905,7 @@ switch ($_GET['mod']) {
         die('<center>代理应用：' . $appinfo . '，等级名称：' . $levelinfo['lname'] . '，升级金额：' . $levelinfo['price'] . '，拿货折率：' . $levelinfo['fracture'] . '<br>注意：升级后当前等级会被释放，而不是同时有两个等级，如果希望有多个等级请联系站长新开代理账号！</center>');
         break;
     case 'addagenttips':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $_SESSION['agent_username']), 'AND')) {
             die('代理信息获取失败');
         }
@@ -945,7 +945,7 @@ switch ($_GET['mod']) {
 
         break;
     case 'fidlist_show':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         //$where['agentbuy'] = '1';
         if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $_SESSION['agent_username']), 'AND')) {
             die(json_encode(array('code' => -2, 'msg' => '代理信息获取失败')));

agent/index.php

@@ -5,7 +5,7 @@
  * Date: 2017-10-15
  * Time: 12:08
  */
-require '../function/function_core.php';
+require __DIR__ . '/../function/function_core.php';
 if (empty($_SESSION['agent_username']) || empty($_SESSION['agent_password'])) {
     echo '没有登录:code:-1';
     header('Location: login.html');

ajax.php

@@ -6,7 +6,7 @@
  * Time: 13:24
  */
 
-include "function/function_core.php";
+include __DIR__ . "/function/function_core.php";
 error_reporting(E_ALL);
 switch ($_GET['mod']) {
     case 'buy_applist':
@@ -21,7 +21,7 @@ switch ($_GET['mod']) {
         die($i);
         break;
     case 'loadbuylist':
-        include 'function/function_app.php';
+        include __DIR__ . '/function/function_app.php';
         $where = array();
         $where['openbuy'] = '1';
 
@@ -84,7 +84,7 @@ switch ($_GET['mod']) {
         die($info);
         break;
     case 'buy_first':
-        include "function/function_app.php";
+        include __DIR__ . "/function/function_app.php";
         $fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $_GET['fid']), 'AND');
         $appinfo = app_idgetinfo($fidinfo['appid']);
         $output = '<!DOCTYPE html>
@@ -253,7 +253,7 @@ function dofill() {
         die($output);
         break;
     case 'buy_agent':
-        include './function/VerificationCode.class.php';
+        include __DIR__ . '/function/VerificationCode.class.php';
         $verification = Verification::check($_POST['token']);
         if ($verification !== true) {
             die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -335,12 +335,12 @@ function dofill() {
         break;
 
     case 'buy_submit':
-        include './function/VerificationCode.class.php';
+        include __DIR__ . '/function/VerificationCode.class.php';
         $verification = Verification::check($_POST['token']);
         if ($verification !== true) {
             die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
         }
-        include 'function/function_app.php';
+        include __DIR__ . '/function/function_app.php';
 
         if (empty($_POST['kt_key'])) {
             $_POST['kt_key'] = '无';
@@ -538,14 +538,14 @@ function dofill() {
         }
         break;
     case 'queryauth':
-        include './function/VerificationCode.class.php';
+        include __DIR__ . '/function/VerificationCode.class.php';
         $verification = Verification::check($_POST['token']);
         if ($verification !== true) {
             die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
         }
         if($result = $db->select_first_row('sq_bclist','*',array('obj'=>$_POST['qq']),'AND')){
             if ($result['appid'] != 0){
-                include_once 'function/function_app.php';
+                include_once __DIR__ . '/function/function_app.php';
                 $app = app_idgetname($result['appid']);
             }else{
                 $app = '所有应用';
@@ -558,7 +558,7 @@ function dofill() {
             die('查询的QQ号码不能为空');
         }
         $info = $db->select_all_row('sq_agent', 'begintime,levelid,qq', array('qq' => $_POST['qq'], 'status' => 1), 'AND');
-        include 'function/function_app.php';
+        include __DIR__ . '/function/function_app.php';
         if (!is_array($info) || count($info) == 0) {
             echo('QQ' . $_POST['qq'] . '没有查询到任何代理信息' . '<br>');
         } else {
@@ -619,7 +619,7 @@ function dofill() {
         die($i);
         break;
     case 'FieldKamiOpen_First':
-        include './function/VerificationCode.class.php';
+        include __DIR__ . '/function/VerificationCode.class.php';
         $verification = Verification::check($_GET['token']);
         if ($verification !== true) {
             die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -628,7 +628,7 @@ function dofill() {
         if ($info['status'] != 1) die('卡密已被冻结');
         if ( !empty($info['user']) || !empty($info['usetime'])) die('卡密已被使用');
         if (!$fidinfo = $db->select_first_row('sq_fidlist','fidname,appid',array('ID'=>$info['fid']),'AND'))die('无法找到对应套餐，请联系管理员处理');
-        include "function/function_app.php";
+        include __DIR__ . "/function/function_app.php";
         $appinfo = app_idgetinfo($fidinfo['appid']);
         $output = '<!DOCTYPE html>
 <html>
@@ -744,7 +744,7 @@ function buy_submit(id,type) {
         break;
     case 'FieldKeyBuy_submit':
 		error_reporting(E_ALL);
-        include './function/VerificationCode.class.php';
+        include __DIR__ . '/function/VerificationCode.class.php';
         $verification = Verification::check($_POST['token']);
         if ($verification !== true) {
             die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -754,7 +754,7 @@ function buy_submit(id,type) {
         if ( !empty($info['user']) || !empty($info['usetime'])) die(json_encode(array('code' => '-102', 'msg' => '卡密已被使用')));
         if (!$fidinfo = $db->select_first_row('sq_fidlist','*',array('ID'=>$info['fid']),'AND'))die(json_encode(array('code' => '-201', 'msg' => '套餐无法找到，请联系管理员')));;
         $tips='';
-		include 'function/function_app.php';
+		include __DIR__ . '/function/function_app.php';
         if (!$appinfo = app_idgetinfo($fidinfo['appid'])) {
             die(json_encode(array('code' => -2, 'msg' => '无法找到应用，也许是该应用已下架')));
         }
@@ -870,7 +870,7 @@ function buy_submit(id,type) {
         }
 		//$newtrade['ID'] = $db->insert_back_id('sq_trade', $newtrade);
 		
-        include_once './function/function_auth.php';
+        include_once __DIR__ . '/function/function_auth.php';
         $back = auth_add($newtrade['user'],$newtrade['pass'],$newtrade['ip'], $fidinfo['num'],$newtrade['uqq'],$newtrade['mail'],$fidinfo['appid'],3,$info['ID'],$info['aid'],$newkey,$tips,$newtrade);
         $db->update('sq_fidkey',array('ID'=>$info['ID']),'AND',array('usetime'=>time(),'user'=>$newtrade['user']));
         if ($back == 1){
@@ -885,7 +885,7 @@ function buy_submit(id,type) {
 
         break;
     case 'changegetform':
-        include './function/function_app.php';
+        include __DIR__ . '/function/function_app.php';
         if(!$appinfo = app_idgetinfo(intval($_POST['appid']))){
             die('');
         }
@@ -985,12 +985,12 @@ function buy_submit(id,type) {
         die($output);
         break;
     case 'ChangeGetVerCode':
-        include './function/VerificationCode.class.php';
+        include __DIR__ . '/function/VerificationCode.class.php';
         $verification = Verification::check($_POST['token']);
         if ($verification !== true) {
             die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
         }
-        include './function/function_app.php';
+        include __DIR__ . '/function/function_app.php';
         if(!$appinfo = app_idgetinfo(intval($_POST['applist']))){
             die(makejson(-1,'请先选择一个应用'));
         }
@@ -1076,7 +1076,7 @@ function buy_submit(id,type) {
             die('验证码错误，请重新输入');
         }
 
-        include_once './function/function_app.php';
+        include_once __DIR__ . '/function/function_app.php';
         if(!$appinfo = app_idgetinfo($_POST['applist'])){
             die('服务器错误：应用无法找到');
         }

api.php

@@ -9,9 +9,9 @@
 /*
  * 初始化函数库和系统
  */
-include 'function/function_core.php';
+include __DIR__ . '/function/function_core.php';
-include 'function/function_app.php';
+include __DIR__ . '/function/function_app.php';
-include 'function/communication.php';
+include __DIR__ . '/function/communication.php';
 $communication = new communication();
 if (!$appinfo = $db->select_first_row('sq_apps','*',array('ID'=>$_GET['appid']),'AND')){
     die('?');

api/Communication.php

@@ -9,10 +9,10 @@
 
 error_reporting(1); //只输出致命错误
 
-include '../function/function_core.php';
+include __DIR__ . '/../function/function_core.php';
-include '../function/function_app.php';
+include __DIR__ . '/../function/function_app.php';
-include '../function/Tips.php';
+include __DIR__ . '/../function/Tips.php';
-if (!empty($_GET['c']) && $_GET['c'] == 'api') include '../function/api.class.php';else include '../function/Encryption.class.php';
+if (!empty($_GET['c']) && $_GET['c'] == 'api') include __DIR__ . '/../function/api.class.php';else include __DIR__ . '/../function/Encryption.class.php';
 
 if (empty($_GET['appid'])) die(makejson(-1,$Tips['NoAppID']));
 if (strlen($_GET['sign']) !== 32) die(makejson(-2,$Tips['NoSign']));

api/monitor.php

@@ -9,12 +9,12 @@ set_time_limit(0);
 ignore_user_abort(1);
 
 //调用核心文件
-include '../function/function_core.php';
+include __DIR__ . '/../function/function_core.php';
 //获取已支付但未同步的订单信息
 $error = array();
 $log = array();
 if(!!$result = $db->select_limit_row('sq_trade','*','',5,array('status'=>'2'),'AND') && count($result) > 0){
-    include '../function/trade.inc.php';
+    include __DIR__ . '/../function/trade.inc.php';
     foreach ($result as $tradeinfo){
         if (!$db->update('sq_trade', array('tradeno' => $tradeno,'status'=>'2'), 'AND', array('status' => 3)))
             $error[] = '[监控信息]订单状态更新失败：'.$tradeinfo['tradeno'].'[Error:'.$db->geterror().']';

auth.php

@@ -1,4 +1,4 @@
-<?php include 'function/function_core.php';?>
+<?php include __DIR__ . '/function/function_core.php';?>
 <!DOCTYPE html>
 <html>
 <head>
@@ -12,7 +12,7 @@
     <title>套餐卡密在线使用开通授权 - <?php echo $G['config']['sitename'] ?></title>
     <link rel="stylesheet" href="./mdl/material.min.css">
     <script src="https://v.vaptcha.com/v3.js"></script>
-    <?php include './function/color.inc.html' ?>
+    <?php include __DIR__ . '/function/color.inc.html' ?>
 </head>
 
 <body class="flat-blue landing-page">

change.php

@@ -1,4 +1,4 @@
-<?php include 'function/function_core.php'; ?>
+<?php include __DIR__ . '/function/function_core.php'; ?>
 <!DOCTYPE html>
 <html>
 <head>
@@ -12,7 +12,7 @@
     <title>授权绑定在线更换 - <?php echo $G['config']['sitename'] ?></title>
     <link rel="stylesheet" href="./mdl/material.min.css">
     <script src="https://v.vaptcha.com/v3.js"></script>
-    <?php include './function/color.inc.html'?>
+    <?php include __DIR__ . '/function/color.inc.html'?>
 </head>
 
 <body class="flat-blue landing-page">

function/GetVerification.php

@@ -6,8 +6,8 @@
  * Time: 20:25
  */
 
-include "function_core.php";
+include __DIR__ . "/function_core.php";
-include 'VerificationCode.class.php';
+include __DIR__ . '/VerificationCode.class.php';
 //error_reporting(E_ALL);
 
 Verification::loadcode();

function/api.class.php

@@ -17,7 +17,7 @@ class ApiCommunication
     }
 
     public function back($code,$type='',$options = array()){
-        include 'Tips.php';
+        include __DIR__ . '/Tips.php';
         global $Tips;
         $Tips['ok'] = 'ok';
         $type = empty($type) ? 'ok' : $type;

function/communication.php

@@ -9,10 +9,10 @@
 
 error_reporting(1); //只输出致命错误
 
-include '../function/function_core.php';
+include __DIR__ . '/../function/function_core.php';
-include '../function/function_app.php';
+include __DIR__ . '/../function/function_app.php';
-include '../function/Tips.php';
+include __DIR__ . '/../function/Tips.php';
-if (!empty($_GET['c']) && $_GET['c'] == 'api') include '../function/api.class.php';else include '../function/Encryption.class.php';
+if (!empty($_GET['c']) && $_GET['c'] == 'api') include __DIR__ . '/../function/api.class.php';else include __DIR__ . '/../function/Encryption.class.php';
 
 
 if (empty($_GET['appid'])) die(makejson(-1,$Tips['NoAppID']));

function/config.inc.php

@@ -3,5 +3,9 @@ $G['db']['server'] = 'localhost';
 $G['db']['user'] = 'root';
 $G['db']['pass'] = '';
 $G['db']['dbname'] = 'wenquan_auth';
+// 本地部署覆盖（该文件加入 .gitignore，不随仓库提交）
+if (is_file(__DIR__ . '/config.local.inc.php')) {
+    include __DIR__ . '/config.local.inc.php';
+}
 
 //error_reporting(E_ALL);

function/function_auth.php

@@ -23,7 +23,7 @@
  * @return int 1为新开成功，2为续费成功，3为卡密新开成功
  */
 function auth_add($username,$password,$ip,$balance,$uqq,$mail,$appid,$origin,$oid,$aid,&$newkey,&$tips,$tradeinfo = array()){
-    include_once 'function_app.php';
+    include_once __DIR__ . '/function_app.php';
     global $db,$G,$MailTips;
 
 

function/function_core.php

@@ -44,8 +44,8 @@ function makejson($code = 1,$msg = 'ok',$data = array()){
  */
 
 $G = array();
-include 'db.class.php';
+include __DIR__ . '/db.class.php';
-include 'config.inc.php';
+include __DIR__ . '/config.inc.php';
 $return = $db = new db($G['db']['server'], $G['db']['user'], $G['db']['pass'], $G['db']['dbname']);
 if (!$return) {
     die('数据库链接失败，请检查设置是否正确:' . $db->geterror());
@@ -60,7 +60,7 @@ $back = $db->select_all_row('sq_config', array('*'), '', '');
 foreach ($back as $value) {
     $G['config'][$value['setname']] = $value['setvalue'];
 }
-include  'setname.inc.php';
+include  __DIR__ . '/setname.inc.php';
 foreach ($SetName as $key=>$value){
     if (!isset($G['config'][$key])){
         $db->insert_back_id('sq_config',array('setname'=>$key,'setvalue'=>$value));
@@ -114,8 +114,8 @@ if ($auth['code'] == '1'){
 */
 
 $ServerURL = 'https://new.api.shouquan.wenquan6.cn:99/api.php';
-include 'ver.inc.php';
+include __DIR__ . '/ver.inc.php';
-include_once 'MailTipsTemplate.php';
+include_once __DIR__ . '/MailTipsTemplate.php';
 /*
  *  注册申明常用函数
  */
@@ -351,9 +351,9 @@ function curl_request($url, $post = '', $cookie = '', $returnCookie = 0)
 function sendemail($title, $contant, $tomail, &$msg = '', $debug = false)
 {
     global $G,$ServerURL;
-	require_once ('PHPMailer.php');
+	require_once (__DIR__ . '/PHPMailer.php');
-    require_once ('SMTP.php');
+    require_once (__DIR__ . '/SMTP.php');
-    require_once ('Exception.php');
+    require_once (__DIR__ . '/Exception.php');
     $mail = new \PHPMailer\PHPMailer\PHPMailer();
     $mail->SMTPDebug = $debug;
     $mail->isSMTP();

function/trade.inc.php

@@ -40,7 +40,7 @@ function trade_do($tradeinfo){
         }
         $allspend = $agentinfo['allspend'] + $tradeinfo['paymoney'];
         $db->update('sq_agent', array('ID' => $tradeinfo['agentid']), 'AND', array('allspend' => $allspend));
-        include_once 'function_auth.php';
+        include_once __DIR__ . '/function_auth.php';
         $back = auth_add($tradeinfo['user'],$tradeinfo['pass'],$tradeinfo['ip'],$tradeinfo['num'] * $fidinfo['num'],$tradeinfo['uqq'],$tradeinfo['mail'],$fidinfo['appid'],4,'',$agentinfo['ID'],$newkey,$tips);
         if ($back == 1){
             return makejson(1,'授权新增成功');
@@ -57,7 +57,7 @@ function trade_do($tradeinfo){
         if (!$fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $tradeinfo['fid']), 'AND')) {
             return makejson(-301,'商品信息拉取失败');
         }
-        include_once 'function_auth.php';
+        include_once __DIR__ . '/function_auth.php';
         if ($tradeinfo['paytype'] == 'czkm') {
             if (!$kamiinfo = $db->select_first_row('sq_key','*',array('kami'=>$tradeinfo['kami']),'AND'))
             {

index.php

@@ -1,4 +1,4 @@
-<?php include 'function/function_core.php';
+<?php include __DIR__ . '/function/function_core.php';
 if (!$G['config']['xtsy']) die(); ?>
 <!DOCTYPE html>
 <html>
@@ -12,7 +12,7 @@ if (!$G['config']['xtsy']) die(); ?>
     <meta name="apple-mobile-web-app-title" content="Material Design Lite">
     <title>授权在线开通 - <?php echo $G['config']['sitename'] ?></title>
     <link rel="stylesheet" href="./mdl/material.min.css">
-    <?php include './function/color.inc.html' ?>
+    <?php include __DIR__ . '/function/color.inc.html' ?>
 </head>
 <style>
     .demo-card-square.mdl-card {

openagent.php

@@ -1,4 +1,4 @@
-<?php include 'function/function_core.php'; ?>
+<?php include __DIR__ . '/function/function_core.php'; ?>
 <!DOCTYPE html>
 <html>
 <head>
@@ -12,7 +12,7 @@
     <title>代理在线开通 - <?php echo $G['config']['sitename'] ?></title>
     <link rel="stylesheet" href="./mdl/material.min.css">
     <script src="https://v.vaptcha.com/v3.js"></script>
-    <?php include './function/color.inc.html'?>
+    <?php include __DIR__ . '/function/color.inc.html'?>
 </head>
 
 <body class="flat-blue landing-page">

pay/epay/lib/epay_notify.class.php

@@ -5,8 +5,8 @@
  * 详细：处理易支付接口通知返回
  */
 
-require_once("epay_core.function.php");
+require_once(__DIR__ . "/epay_core.function.php");
-require_once("epay_md5.function.php");
+require_once(__DIR__ . "/epay_md5.function.php");
 
 class AlipayNotify {
 

pay/epay/lib/epay_submit.class.php

@@ -4,8 +4,8 @@
  * 功能：彩虹易支付接口请求提交类
  * 详细：构造易支付接口表单HTML文本，获取远程HTTP数据
  */
-require_once("epay_core.function.php");
+require_once(__DIR__ . "/epay_core.function.php");
-require_once("epay_md5.function.php");
+require_once(__DIR__ . "/epay_md5.function.php");
 
 class AlipaySubmit {
 

pay/epay/notify_url.php

@@ -6,7 +6,7 @@ $alipay_config['sign_type'] = strtoupper('MD5');
 $alipay_config['input_charset'] = strtolower('utf-8');
 $alipay_config['transport'] = 'http';
 $alipay_config['apiurl'] = 'http://' . $G['config']['pay_domain'] . '/';
-require_once("lib/epay_notify.class.php");
+require_once(__DIR__ . "/lib/epay_notify.class.php");
 $alipayNotify = new AlipayNotify($alipay_config);
 $verify_result = $alipayNotify->verifyNotify();
 if ($verify_result) {

pay/epay/return_url.php

@@ -1,7 +1,7 @@
 <?php
 $path = dirname(dirname(dirname(__FILE__)));//当前目录
 include $path . '/function/function_core.php';
-require_once("lib/epay_notify.class.php");
+require_once(__DIR__ . "/lib/epay_notify.class.php");
 $alipay_config['partner'] = $G['config']['epay_pid'];
 $alipay_config['key'] = $G['config']['epay_key'];
 $alipay_config['sign_type'] = strtoupper('MD5');

payment.php

@@ -5,7 +5,7 @@
  * Date: 2018/2/5
  * Time: 20:17
  */ 
-include 'function/function_core.php';
+include __DIR__ . '/function/function_core.php';
 error_reporting(E_ALL);
 
 if (empty($_GET['tradeno'])) {
@@ -126,7 +126,7 @@ function mqyturn($paytype)
 	<title>正在跳转到支付页面，请稍后</title>
 </head>
 ';
-    require_once("./pay/epay/lib/epay_submit.class.php");
+    require_once(__DIR__ . "/pay/epay/lib/epay_submit.class.php");
     $alipay_config['partner'] = $G['config']['epay_pid'];
     $alipay_config['key'] = $G['config']['epay_key'];
     $alipay_config['sign_type'] = strtoupper('MD5');

payresult.php

@@ -7,7 +7,7 @@
  */
 
 
-include "function/function_core.php";
+include __DIR__ . "/function/function_core.php";
 error_reporting(E_ALL);
 if (empty($_GET['tradeno'])) {
     tips('订单号为空！', 'index.php');
@@ -27,7 +27,7 @@ if ($tradeinfo['status'] != '2') {
 if (!$db->update('sq_trade', array('tradeno' => $tradeno,'status'=>'2'), 'AND', array('status' => 3))) {
     tips('订单更新失败', 'index.php');
 }
-include 'function/trade.inc.php';
+include __DIR__ . '/function/trade.inc.php';
 $back = trade_do($tradeinfo);
 $back = json_decode($back,true);
 if ($back['code'] == 2){

query.php

@@ -1,4 +1,4 @@
-<?php include 'function/function_core.php';?>
+<?php include __DIR__ . '/function/function_core.php';?>
 <!DOCTYPE html>
 <html>
 <head>
@@ -12,7 +12,7 @@
     <title>授权在线查询 - <?php echo $G['config']['sitename'] ?></title>
     <link rel="stylesheet" href="./mdl/material.min.css">
     <script src="https://v.vaptcha.com/v3.js"></script>
-    <?php include './function/color.inc.html'?>
+    <?php include __DIR__ . '/function/color.inc.html'?>
 </head>
 
 <body class="flat-blue landing-page">