字符串输入处理

application/service/ArticleService.php

@@ -184,8 +184,11 @@ class ArticleService
             return DataReturn($ret, -1);
         }
 
+        // 编辑器内容
+        $content = isset($_POST['content']) ? $_POST['content'] : '';
+
         // 数据
-        $content = ResourcesService::ContentStaticReplace($params['content'], 'add');
+        $content = ResourcesService::ContentStaticReplace($content, 'add');
         $image = self::MatchContentImage($content);
         $data = [
             'title'                 => $params['title'],

application/service/CustomViewService.php

@@ -190,8 +190,11 @@ class CustomViewService
             return DataReturn($ret, -1);
         }
 
+        // 编辑器内容
+        $content = isset($_POST['content']) ? $_POST['content'] : '';
+
         // 数据
-        $content = ResourcesService::ContentStaticReplace($params['content'], 'add');
+        $content = ResourcesService::ContentStaticReplace($content, 'add');
         $image = self::MatchContentImage($content);
         $data = [
             'title'         => $params['title'],

application/service/GoodsService.php

@@ -955,6 +955,9 @@ class GoodsService
             return $attachment;
         }
 
+        // 编辑器内容
+        $content_web = isset($_POST['content_web']) ? $_POST['content_web'] : '';
+
         // 基础数据
         $data = [
             'title'                     => $params['title'],
@@ -967,7 +970,7 @@ class GoodsService
             'buy_max_number'            => isset($params['buy_max_number']) ? intval($params['buy_max_number']) : 0,
             'is_deduction_inventory'    => isset($params['is_deduction_inventory']) ? intval($params['is_deduction_inventory']) : 0,
             'is_shelves'                => isset($params['is_shelves']) ? intval($params['is_shelves']) : 0,
-            'content_web'               => ResourcesService::ContentStaticReplace($params['content_web'], 'add'),
+            'content_web'               => ResourcesService::ContentStaticReplace($content_web, 'add'),
             'images'                    => isset($photo['data'][0]) ? $photo['data'][0] : '',
             'photo_count'               => count($photo['data']),
             'is_home_recommended'       => isset($params['is_home_recommended']) ? intval($params['is_home_recommended']) : 0,

config/app.php

@@ -41,7 +41,7 @@ return [
     // 是否开启多语言
     'lang_switch_on'         => false,
     // 默认全局过滤方法 用逗号分隔多个
-    'default_filter'         => '',
+    'default_filter'         => 'htmlspecialchars',
     // 默认语言
     'default_lang'           => 'zh-cn',
     // 应用类库后缀