fix bug: 任何Key均可获取用户信息 by Gtary

splendidmata · Feb 27, 2020 · 69e4d22 · 69e4d22
1 parent e350d32
commit 69e4d22
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/app/Middleware/Mod_Mu.php b/app/Middleware/Mod_Mu.php
@@ -28,6 +28,13 @@ public function __invoke($request, $response, $next)
         $keys = Config::getMuKey();
         $auth = in_array($key, $keys);
 
+        if ($auth == false) {
+            $res['ret'] = 0;
+            $res['data'] = 'token is invalid';
+            $response->getBody()->write(json_encode($res));
+            return $response;
+        }
+
         if (Config::get('checkNodeIp') === true){
             $node = Node::where('node_ip', 'LIKE', $_SERVER['REMOTE_ADDR'] . '%')->first();
             if ($auth === false || ($node === null && $_SERVER['REMOTE_ADDR'] != '127.0.0.1')) {

diff --git a/resources/views/malio/auth/register.tpl b/resources/views/malio/auth/register.tpl
@@ -50,7 +50,7 @@
                         {$i18n->get('please-fill-in-your-nickname')}
                       </div>
                     </div>
-                    {if $enable_email_verify == 'false'}
+                    {if $enable_email_verify == false}
                       {if $malio_config['enable_register_email_restrict'] == true}
                       <div class="form-group col-lg-6 col-sm-12 col-xs-12">
                         <label for="email">{$i18n->get('email')}</label>
@@ -202,7 +202,7 @@
                   </div>
                   {/if}
 
-                  {if $config['register_mode'] == 'invite' && $enable_email_verify == 'false'}
+                  {if $config['register_mode'] == 'invite' && $enable_email_verify == false}
                   <div class="row">
                     <div class="form-group col-lg-6 col-sm-12 col-xs-12">
                       <label for="code" class="d-block">{$i18n->get('invitation-code')} {if $malio_config['code_required'] == false}({$i18n->get('optional')}){/if}</label>