From b17dd3cfeb4ee3abcaf4b54a22dec26a893f8c01 Mon Sep 17 00:00:00 2001
From: Eyre_S <sukazyo@outlook.com>
Date: Fri, 19 May 2023 18:05:07 +0800
Subject: [PATCH] refix file safety problem by php open_basedir

---
 config.php                | 7 +++++++
 constant.php              | 2 +-
 index.php                 | 1 +
 src/Resource/Resource.php | 3 ---
 src/Utils/PageParse.php   | 2 +-
 5 files changed, 10 insertions(+), 5 deletions(-)
 create mode 100644 config.php

diff --git a/config.php b/config.php
new file mode 100644
index 0000000..00c2dfa
--- /dev/null
+++ b/config.php
@@ -0,0 +1,7 @@
+<?php
+
+ini_set(
+	'open_basedir',
+	!($open_basedir = ini_get('open_basedir')) ? "" : "$open_basedir:" .
+		__DIR__
+);
diff --git a/constant.php b/constant.php
index 627e44d..1f961fa 100644
--- a/constant.php
+++ b/constant.php
@@ -2,6 +2,6 @@
 
 const APP_NAME = "ph-Bookshelf";
 
-const VERSION = "0.5.0-alpha6";
+const VERSION = "0.5.0-alpha7";
 const CHANNEL = "suk-ws";
 const BRANCH = "config-v2.0";
diff --git a/index.php b/index.php
index 868a30c..571ffdf 100644
--- a/index.php
+++ b/index.php
@@ -1,5 +1,6 @@
 <?php
 
+require "./config.php";
 require "./constant.php";
 require "./vendor/autoload.php";
 
diff --git a/src/Resource/Resource.php b/src/Resource/Resource.php
index 3c4624e..d7d56e0 100644
--- a/src/Resource/Resource.php
+++ b/src/Resource/Resource.php
@@ -7,8 +7,5 @@ class Resource {
 	public static function getRealRootPath (): string {
 		return realpath("./");
 	}
-	public static function checkSafety (string $checked): bool {
-		return str_starts_with(realpath($checked), self::getRealRootPath());
-	}
 	
 }
diff --git a/src/Utils/PageParse.php b/src/Utils/PageParse.php
index d3f24e6..5649c4b 100644
--- a/src/Utils/PageParse.php
+++ b/src/Utils/PageParse.php
@@ -22,7 +22,7 @@ class PageParse {
 		// 将utf8编码转换成gbk编码，否则，中文名称的文件无法打开
 		//		$filePath = iconv('UTF-8', 'gbk', $filePath);
 		// 检查文件是否可读
-		if (!is_file($filePath) || !is_readable($filePath) || !Resource::checkSafety($filePath)) {
+		if (!is_file($filePath) || !is_readable($filePath)) {
 			exit("File Can't Read!");
 		}
 		// 判定文件类型