fix(hwobs): 升级华为OBS云储存

addons/hwobs/controller/Index.php

@@ -39,6 +39,14 @@ class Index extends Controller
         $name = $this->request->post('name');
         $md5 = $this->request->post('md5');
         $chunk = $this->request->post('chunk');
+        $name = xss_clean($name);
+
+        // 检查文件后缀
+        $extension = strtolower(pathinfo($name, PATHINFO_EXTENSION));
+        $allowedExtensions = explode(',', strtolower($config['mimetype']));
+        if (!in_array($extension, $allowedExtensions) || in_array($extension, ['php', 'html', 'htm', 'phar', 'phtml']) || preg_match("/^php(.*)/i", $extension)) {
+            $this->error('不允许的文件类型');
+        }
 
         $key = (new Upload())->getSavekey($config['savekey'], $name, $md5);
         $key = ltrim($key, "/");
@@ -86,7 +94,6 @@ class Index extends Controller
         $params['headers'] = $headers;
         $params['date'] = $date;
         $this->success('', null, $params);
-        return;
     }
 
     /**