From 699448b3deb04d77f0240bd4d65752dd873da00d Mon Sep 17 00:00:00 2001
From: PGwind <3451914595@qq.com>
Date: Fri, 31 Jul 2026 23:13:45 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20=E4=BF=AE=E5=A4=8D=E6=A8=A1?=
 =?UTF-8?q?=E6=9D=BF=E9=A2=84=E8=A7=88=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E8=AF=BB=E5=8F=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 template/preview.php | 161 ++++++++++++++++++++++++-------------------
 1 file changed, 92 insertions(+), 69 deletions(-)

diff --git a/template/preview.php b/template/preview.php
index 16789bf..34e55e3 100644
--- a/template/preview.php
+++ b/template/preview.php
@@ -1,84 +1,107 @@
 <?php
-$theme = empty($_GET['theme']) ? '' : $_GET['theme'];
-$file = empty($_GET['file']) ? '' : $_GET['file'];
-//获取评论模板
-function getTemplate($templateDir = 'default',$template = 'owner.html')
-    {
-        $filePath = dirname(__FILE__) . '/' . $templateDir . '/' . $template;
+header('Cache-Control: no-store');
+header("Content-Security-Policy: script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'");
+header('Referrer-Policy: no-referrer');
+header('X-Content-Type-Options: nosniff');
 
-        if (!file_exists($filePath)) {//如果模板文件缺失就调用根目录下的default文件夹中用于垫底的模板
-             return '预览的主题文件夹或主题文件不存在';
-        }
+$theme = isset($_GET['theme']) && is_string($_GET['theme']) ? trim($_GET['theme']) : 'default';
+$file = isset($_GET['file']) && is_string($_GET['file']) ? trim($_GET['file']) : 'owner.html';
+$allowedFiles = ['owner.html', 'guest.html', 'notice.html'];
+$templateRoot = realpath(__DIR__);
+$themeDir = preg_match('/\A[A-Za-z0-9_-]+\z/D', $theme)
+    ? realpath(__DIR__ . DIRECTORY_SEPARATOR . $theme)
+    : false;
+$filePath = $themeDir && in_array($file, $allowedFiles, true)
+    ? realpath($themeDir . DIRECTORY_SEPARATOR . $file)
+    : false;
 
-$content=file_get_contents($filePath);
-$content=preg_replace('#<\?php#', '<!--', $content);
-$content=preg_replace('#\?>#', '-->', $content);
-$demouser = array(
-    array('name' => '月宅', 'md5' => 'bf413cdf4570464b971cb6e0f0a0437a'),
-    array('name' => '念', 'md5' => '138be792998aef019362d52276290752'),
-    array('name' => 'Jochen', 'md5' => '076176b67617855818a00f3e5f963262'),
-    array('name' => '吃猫的鱼', 'md5' => 'e2909ce0b9d612c601733aea588c0097'),
-    array('name' => '清酒', 'md5' => '60dfa69a58fae040fb0feb753bef1535'),
-    array('name' => '凡涛', 'md5' => 'b8f7b5a08bcba93c2c3eff7b1c5a7c32'),
-);
+if (
+    false === $templateRoot
+    || false === $themeDir
+    || dirname($themeDir) !== $templateRoot
+    || false === $filePath
+    || dirname($filePath) !== $themeDir
+    || !is_file($filePath)
+) {
+    http_response_code(404);
+    exit('预览的主题文件夹或主题文件不存在');
+}
 
-// 随机选择两个不同的数组元素
-$index1 = rand(0, count($demouser) - 1);
-$index2 = array_rand(array_diff_key($demouser, [$index1 => '']));
-
-$search = array(
-            '{title}',//文章标题
-            '{PostAuthor}',//文章作者昵称
-            '{time}',//评论发出时间
-            '{commentText}',//评论内容
-            '{author}',//评论人昵称
-            '{mail}',//评论者邮箱
-            '{md5}',//评论者邮箱
-            '{ip}',//评论者ip
-            '{permalink}',//评论楼层链接
-            '{siteUrl}',//网站地址
-            '{siteTitle}',//网站标题
-            '{Pname}',//父级评论昵称
-            '{Ptext}',//父级评论内容
-            '{Pmail}',//父级评论邮箱
-            '{Ptime}',//父级评论时间
-            '{Pmd5}',//父级评论邮箱md5
-            '{url}',//当前模板文件夹路径
-            '{manageurl}',//后台管理评论的入口链接
-            '{status}', //评论状态
-        );
-        $replace = array(
-            'CommentNotifier邮件提醒插件',
-            '泽泽社长',
-            date('Y-m-d H:i:s'),
-            '这个插件真好用！',
-            $demouser[$index1]['name'],
-            '10000@qq.com',
-            $demouser[$index1]['md5'],
-            '172.0.0.1',
-            'https://github.com/jrotty/CommentNotifier',
-            'https://typecho.fans',
-            '泽泽社',
-            $demouser[$index2]['name'],
-            '这个插件真好用!',
-            'zezeshe@foxmail.com',
-            date('Y-m-d H:i:s'),
-            $demouser[$index2]['md5'],
-            './' . $templateDir.'/',
-            'https://typecho.fans',
-            '通过'
-        );
-        return str_replace($search, $replace, $content);
+function renderCommentNotifierPreviewTemplate(string $filePath, string $templateDir): string
+{
+    $content = file_get_contents($filePath);
+    if (false === $content) {
+        return '预览文件读取失败';
     }
+
+    $content = preg_replace('#<\?php#', '<!--', $content);
+    $content = preg_replace('#\?>#', '-->', $content);
+    $demoUsers = [
+        ['name' => '月宅', 'md5' => 'bf413cdf4570464b971cb6e0f0a0437a'],
+        ['name' => '念', 'md5' => '138be792998aef019362d52276290752'],
+        ['name' => 'Jochen', 'md5' => '076176b67617855818a00f3e5f963262'],
+        ['name' => '吃猫的鱼', 'md5' => 'e2909ce0b9d612c601733aea588c0097'],
+        ['name' => '清酒', 'md5' => '60dfa69a58fae040fb0feb753bef1535'],
+        ['name' => '凡涛', 'md5' => 'b8f7b5a08bcba93c2c3eff7b1c5a7c32'],
+    ];
+
+    $index1 = rand(0, count($demoUsers) - 1);
+    $index2 = array_rand(array_diff_key($demoUsers, [$index1 => '']));
+    $search = [
+        '{title}',
+        '{PostAuthor}',
+        '{time}',
+        '{commentText}',
+        '{author}',
+        '{mail}',
+        '{md5}',
+        '{ip}',
+        '{permalink}',
+        '{siteUrl}',
+        '{siteTitle}',
+        '{Pname}',
+        '{Ptext}',
+        '{Pmail}',
+        '{Ptime}',
+        '{Pmd5}',
+        '{url}',
+        '{manageurl}',
+        '{status}',
+    ];
+    $replace = [
+        'CommentNotifier邮件提醒插件',
+        '泽泽社长',
+        date('Y-m-d H:i:s'),
+        '这个插件真好用！',
+        $demoUsers[$index1]['name'],
+        '10000@qq.com',
+        $demoUsers[$index1]['md5'],
+        '172.0.0.1',
+        'https://github.com/jrotty/CommentNotifier',
+        'https://typecho.fans',
+        '泽泽社',
+        $demoUsers[$index2]['name'],
+        '这个插件真好用!',
+        'zezeshe@foxmail.com',
+        date('Y-m-d H:i:s'),
+        $demoUsers[$index2]['md5'],
+        './' . $templateDir . '/',
+        'https://typecho.fans',
+        '通过',
+    ];
+    return str_replace($search, $replace, $content);
+}
+
+$previewContent = renderCommentNotifierPreviewTemplate($filePath, $theme);
 ?>
 <html lang="zh-CN">
 <head> 
 <meta charset="UTF-8">
 <meta name="renderer" content="webkit">
 <meta name="viewport" content="width=device-width,user-scalable=no,viewport-fit=cover,initial-scale=1, maximum-scale=1">
-<title>预览<?php echo $file; ?> - <?php echo $theme; ?>主题</title>
+<title>预览<?php echo htmlspecialchars($file, ENT_QUOTES, 'UTF-8'); ?> - <?php echo htmlspecialchars($theme, ENT_QUOTES, 'UTF-8'); ?>主题</title>
 </head>
 <body>
-<?php echo getTemplate($theme,$file);?>
+<?php echo $previewContent; ?>
 </body>
 </html>