fix: 更新 composer.json，添加 dev 依赖；优化 ConfigProvider 和 Authorize 类的代码

friendsofhyperf · Dec 2, 2024 · 24f9c14 · 24f9c14
1 parent 20d00ad
commit 24f9c14
Show file tree

Hide file tree

Showing 5 changed files with 8 additions and 19 deletions.
diff --git a/composer.json b/composer.json
@@ -5,6 +5,7 @@
         "web-tinker",
         "hyperf",
         "tinker",
+        "dev",
         "debug",
         "development"
     ],

diff --git a/src/ConfigProvider.php b/src/ConfigProvider.php
@@ -38,18 +38,6 @@ public function __invoke()
                     'source' => __DIR__ . '/../publish/web-tinker.php',
                     'destination' => BASE_PATH . '/config/autoload/web-tinker.php',
                 ],
-                // [
-                //     'id' => 'view',
-                //     'description' => 'The view for web-tinker.',
-                //     'source' => __DIR__ . '/../resources/views/web-tinker.blade.php',
-                //     'destination' => BASE_PATH . '/resources/views/vendor/web-tinker/web-tinker.blade.php',
-                // ],
-                // [
-                //     'id' => 'assets',
-                //     'description' => 'The assets for web-tinker.',
-                //     'source' => __DIR__ . '/../publish/assets',
-                //     'destination' => BASE_PATH . '/public/vendor/web-tinker',
-                // ],
             ],
         ];
     }

diff --git a/src/Controller/WebTinkerController.php b/src/Controller/WebTinkerController.php
@@ -91,7 +91,11 @@ public function renderStaticFile(RequestInterface $request, ResponseInterface $r
         ));
 
         if (! isset($this->staticFiles[$file])) {
-            if (! $file || ! file_exists($file)) {
+            if (
+                ! $file // Invalid file
+                || str_contains($file, '../') // Prevent directory traversal
+                || ! file_exists($file) // File not found
+            ) {
                 return $response->html('')->withStatus(404);
             }
             $this->staticFiles[$file] = [

diff --git a/src/Listener/RegisterRoutesListener.php b/src/Listener/RegisterRoutesListener.php
@@ -22,7 +22,7 @@
 class RegisterRoutesListener implements ListenerInterface
 {
     public function __construct(
-        protected DispatcherFactory $dispatcherFactory,
+        protected DispatcherFactory $dispatcherFactory, // Don't remove this line
         protected ConfigInterface $config
     ) {
     }

diff --git a/src/Middleware/Authorize.php b/src/Middleware/Authorize.php
@@ -35,10 +35,6 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
 
     protected function allowedToUseTinker(): bool
     {
-        if (! $this->config->get('web-tinker.enabled', false)) {
-            return false;
-        }
-
-        return true;
+        return (bool) $this->config->get('web-tinker.enabled', false);
     }
 }