bump6.2.8

docs/changelog.md

@@ -15,6 +15,7 @@
 - 优化伪静态功能；
 - 修正找回密码功能；
 - 修正枚举标签调用功能；
+- 常规安全问题修复；
 
 # V6.2.7
 - 增加jsonq标签功能，支持跨站跨应用栏目数据调用；

src/system/archive/archives.class.php

@@ -857,6 +857,7 @@ class Archives
      */
     function GetPageTitlesDM($styleName, $pageNo)
     {
+        global $cfg_rewrite;
         if ($this->TotalPage == 1) {
             return "";
         }
@@ -869,26 +870,47 @@ class Archives
             $revalue = "";
             foreach ($this->SplitTitles as $k => $v) {
                 if ($i == 1) {
-                    $revalue .= "<a href='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>$v</a>\r\n";
+                    if ($cfg_rewrite == 'Y') {
+                        $revalue .= "<a href='/doc-$aid-$i.html'>$v</a>\r\n";
+                    } else {
+                        $revalue .= "<a href='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>$v</a>\r\n";
+                    }
                 } else {
                     if ($pageNo == $i) {
                         $revalue .= " $v \r\n";
                     } else {
-                        $revalue .= "<a href='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>$v</a>\r\n";
+                        if ($cfg_rewrite == 'Y') {
+                            $revalue .= "<a href='/doc-$aid-$i.html'>$v</a>\r\n";
+                        } else {
+                            $revalue .= "<a href='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>$v</a>\r\n";
+                        }
+                        
                     }
                 }
                 $i++;
             }
         } else {
-            $revalue = "<select id='dedepagetitles' onchange='location.href=this.options[this.selectedIndex].value;'>\r\n";
+            $revalue = "<select class='form-control w-25' id='dedepagetitles' onchange='location.href=this.options[this.selectedIndex].value;'>\r\n";
             foreach ($this->SplitTitles as $k => $v) {
                 if ($i == 1) {
-                    $revalue .= "<option value='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>{$i}、{$v}</option>\r\n";
+                    if ($cfg_rewrite == 'Y') {
+                        $revalue .= "<option value='/doc-$aid-$i.html'>{$i}、{$v}</option>\r\n";
+                    } else {
+                        $revalue .= "<option value='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>{$i}、{$v}</option>\r\n";
+                    }
                 } else {
                     if ($pageNo == $i) {
-                        $revalue .= "<option value='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i' selected>{$i}、{$v}</option>\r\n";
+                        if ($cfg_rewrite == 'Y') {
+                            $revalue .= "<option value='/doc-$aid-$i.html' selected>{$i}、{$v}</option>\r\n";
+                        } else {
+                            $revalue .= "<option value='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i' selected>{$i}、{$v}</option>\r\n";
+                        }
                     } else {
-                        $revalue .= "<option value='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>{$i}、{$v}</option>\r\n";
+                        if ($cfg_rewrite == 'Y') {
+                            $revalue .= "<option value='/doc-$aid-$i.html'>{$i}、{$v}</option>\r\n";
+                        } else {
+                            $revalue .= "<option value='".$this->Fields['phpurl']."/view.php?aid=$aid&pageno=$i'>{$i}、{$v}</option>\r\n";
+                        }
                     }
                 }
                 $i++;

src/theme/dedebiz/article_article.htm

@@ -42,6 +42,7 @@
 							<span><i class="fa fa-globe mr-1"></i>{dede:field.source/}</span>
 							<span><i class="fa fa-eye mr-1"></i><script src="{dede:field name='phpurl'/}/count.php?view=yes&aid={dede:field name='id'/}&mid={dede:field name='mid'/}"></script>次</span>
 						</div>
+						<div class="py-3">{dede:pagetitle/}</div>
 						<div class="py-3">{dede:field.body/}</div>
 						<div class="py-3">作者：{dede:adminname/}</div>
 						<nav class="py-3">

src/user/inc/inc_pwd_functions.php

@@ -86,7 +86,7 @@ function newmail($mid, $userid, $mailto, $type, $send)
                 sendmail($mailto, $mailtitle, $mailbody, $headers);
                 return ShowMsg('验证码已经发送到原来的邮箱，请注意查收', 'login.php', '', '5000');
             } else if ($send == 'N') {
-                return ShowMsg('稍后前往修改页', $cfg_basehost.$cfg_memberurl."/resetpassword.php?dopost=getpasswd&id=".$mid."&key=".$randval);
+                return ShowMsg('稍后前往密码修改页', $cfg_basehost.$cfg_memberurl."/resetpassword.php?dopost=getpasswd&id=".$mid."&key=".$randval);
             }
         } else {
             return ShowMsg('修改失败，请联系管理员', 'login.php');
@@ -99,7 +99,7 @@ function newmail($mid, $userid, $mailto, $type, $send)
                 sendmail($mailto, $mailtitle, $mailbody, $headers);
                 ShowMsg('修改验证码已经发送到原来的邮箱请查收', 'login.php');
             } elseif ($send === 'N') {
-                return ShowMsg('稍后前往修改页', $cfg_basehost.$cfg_memberurl."/resetpassword.php?dopost=getpasswd&id=".$mid."&key=".$randval);
+                return ShowMsg('稍后前往密码修改页', $cfg_basehost.$cfg_memberurl."/resetpassword.php?dopost=getpasswd&id=".$mid."&key=".$randval);
             }
         } else {
             ShowMsg('修改失败，请与管理员联系', 'login.php');