v2.0.29-20230705

2025-08-10 08:51:49 +00:00 · 2023-07-05 16:16:21 +08:00
parent 82e8321432
commit 0bc6f7bea5
37 changed files with 180 additions and 43 deletions
--- a/index.php
+++ b/index.php
@@ -34,8 +34,8 @@ if($db_config['type'] == 'sqlite'){
 $global_config = unserialize( get_db("global_config", "v", ["k" => "o_config"]) ); //全局配置
 $c = Get('c');
 $libs = $global_config['Libs'];
-$layui['js']  = $libs.'/Layui/v2.8.3/layui.js';
-$layui['css'] = $libs.'/Layui/v2.8.3/css/layui.css';
+$layui['js']  = $libs.'/Layui/v2.8.10/layui.js';
+$layui['css'] = $libs.'/Layui/v2.8.10/css/layui.css';
 define('libs',$global_config['Libs']);
 define('SysVer',Get_Version());
 define('Debug',$global_config['Debug'] == 1);
--- a/static/Layui/v2.8.10/css/layui.css
+++ b/static/Layui/v2.8.10/css/layui.css
--- a/static/Layui/v2.8.10/font/iconfont.eot
+++ b/static/Layui/v2.8.10/font/iconfont.eot
--- a/static/Layui/v2.8.10/font/iconfont.svg
+++ b/static/Layui/v2.8.10/font/iconfont.svg
--- a/static/Layui/v2.8.10/font/iconfont.ttf
+++ b/static/Layui/v2.8.10/font/iconfont.ttf
--- a/static/Layui/v2.8.10/font/iconfont.woff
+++ b/static/Layui/v2.8.10/font/iconfont.woff
--- a/static/Layui/v2.8.10/font/iconfont.woff2
+++ b/static/Layui/v2.8.10/font/iconfont.woff2
--- a/static/Layui/v2.8.10/layui.js
+++ b/static/Layui/v2.8.10/layui.js
--- a/static/Layui/v2.8.3/css/layui-icon.css
+++ b/static/Layui/v2.8.3/css/layui-icon.css
--- a/static/Layui/v2.8.3/css/layui.css
+++ b/static/Layui/v2.8.3/css/layui.css
--- a/static/Layui/v2.8.3/layui.js
+++ b/static/Layui/v2.8.3/layui.js
--- a/system/ATool.php
+++ b/system/ATool.php
@@ -218,7 +218,7 @@ function echo_Atool(){
 <head>
    <meta charset="UTF-8">
    <title>ATool 工具箱</title>
-    <link rel="stylesheet" href="../static/Layui/v2.8.3/css/layui.css">
+    <link rel="stylesheet" href="../static/Layui/v2.8.10/css/layui.css">
    <style>
        html, body {min-width: 1200px;background-color: #fff;position: relative;}
        .page-wrapper {width: 1200px;margin: 0 auto;padding: 0 15px;}
@@ -269,7 +269,7 @@ function echo_Atool(){
        <a class="layui-btn layui-btn-primary layui-btn-xs" lay-event="set_user_name">改账号</a>
    </div>
 </script>
-<script src="../static/Layui/v2.8.3/layui.js"></script>
+<script src="../static/Layui/v2.8.10/layui.js"></script>
 <script src="../static/jquery/jquery-3.6.0.min.js"></script>
 <script src="../static/jquery/jquery.md5.js"></script>
 <script src="../templates/admin/js/public.js?v=<?php echo time();?>"></script>
@@ -398,7 +398,7 @@ function echo_verify(){ ?>
 <head>
    <meta charset="UTF-8">
    <title>ATool 工具箱</title>
-    <link rel="stylesheet" href="../static/Layui/v2.8.3/css/layui.css">
+    <link rel="stylesheet" href="../static/Layui/v2.8.10/css/layui.css">
    <link rel="stylesheet" href="../static/Other/login.css">
 </head>
 <body>
@@ -423,7 +423,7 @@ function echo_verify(){ ?>
    </div>
 </div>
 <script src = "../static/jquery/jquery-3.6.0.min.js"></script>
-<script src = "../static/Layui/v2.8.3/layui.js"></script>
+<script src = "../static/Layui/v2.8.10/layui.js"></script>
 <script src = '../static/jquery/jquery.md5.js'></script>
 <script>
    layui.use(['form','jquery'], function () {
--- a/system/MySQL/install.sql
+++ b/system/MySQL/install.sql
@@ -260,3 +260,16 @@ CREATE TABLE IF NOT EXISTS `user_share` (
  PRIMARY KEY (`id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

+-- 图标缓存
+CREATE TABLE IF NOT EXISTS `global_icon` (
+  `id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+  `url_md5` varchar(32) NOT NULL COMMENT 'url_md5',
+  `url` text NOT NULL COMMENT 'url',
+  `ico_url` text NOT NULL COMMENT 'url_ico',
+  `add_time` int(10) UNSIGNED NOT NULL COMMENT '创建时间',
+  `update_time` int(10) UNSIGNED NOT NULL COMMENT '更新时间',
+  `file_name` text NOT NULL COMMENT '文件名',
+  `file_mime` text NOT NULL COMMENT 'MIME类型',
+  `extend` text NOT NULL COMMENT '预留扩展',
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8mb4;
--- a/system/SQLite/install.sql
+++ b/system/SQLite/install.sql
@@ -38,7 +38,6 @@ CREATE TABLE IF NOT EXISTS "updatadb_logs" (
 INSERT INTO "updatadb_logs" ("file_name", "update_time", "status", "extra") VALUES ('20230417.php', '1681719049', 'TRUE', '');
 INSERT INTO "updatadb_logs" ("file_name", "update_time", "status", "extra") VALUES ('20230420.php', '1681977368', 'TRUE', '');
 INSERT INTO "updatadb_logs" ("file_name", "update_time", "status", "extra") VALUES ('20230522.php', '1684762253', 'TRUE', '');
-INSERT INTO "updatadb_logs" ("file_name", "update_time", "status", "extra") VALUES ('20230605.php', '1685960298', 'TRUE', '');

 -- 创建用户表
 CREATE TABLE IF NOT EXISTS "global_user" (
@@ -225,3 +224,18 @@ CREATE TABLE IF NOT EXISTS "user_share" (
  "data" TEXT,
  "pv" integer(1) DEFAULT "0"
 );
+
+-- 图标缓存
+CREATE TABLE IF NOT EXISTS "global_icon" (
+  "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+  "url_md5" text(32) NOT NULL DEFAULT "",
+  "url" text NOT NULL DEFAULT "",
+  "ico_url" text NOT NULL DEFAULT "",
+  "add_time" integer(10) NOT NULL,
+  "update_time" integer(10) NOT NULL,
+  "file_name" text NOT NULL DEFAULT "",
+  "file_mime" text NOT NULL DEFAULT "",
+  "extend" text NOT NULL DEFAULT "",
+  CONSTRAINT "id" UNIQUE ("id" ASC)
+);
+
--- a/system/admin.php
+++ b/system/admin.php
@@ -221,7 +221,7 @@ if ($page == 'menu') {
          [
            ['title'=>'系统设置','href'=>'root/sys_setting','icon'=>'fa fa-gears'],
            ['title'=>'授权管理','href'=>'root/vip','icon'=>'fa fa-diamond'],
-            ['title'=>'默认设置','href'=>'root/default_setting','icon'=>'fa fa-heart-o'],
+            //['title'=>'默认设置','href'=>'root/default_setting','icon'=>'fa fa-heart-o'],
            ['title'=>'用户管理','href'=>'root/user_control','icon'=>'fa fa-user'],
            ['title'=>'用户分组','href'=>'root/users_control','icon'=>'fa fa-users'],
            ['title'=>'注册管理','href'=>'root/reg_control','icon'=>'fa fa-user-plus'],
@@ -269,6 +269,7 @@ function load_static($type){
    }elseif($type == 'js.layui'){
        echo 
 '<script src="'.$GLOBALS['layui']['js'].'" charset="utf-8"></script>
+<script src="./templates/admin/js/lay-config.js?v='.$GLOBALS['Ver'].'" charset="utf-8"></script>
 <script>layui.config({version:"'.$GLOBALS['Ver'].'"})</script>
 ';
    }
--- a/system/api.php
+++ b/system/api.php
@@ -1559,7 +1559,16 @@ function read_data(){
        msg(1,$log);
    //输出phpinfo信息
    }elseif($_GET['type'] == 'phpinfo'){
-        phpinfo();
+        session_start();
+        if($_SESSION['phpinfo_id'] != $_GET['pid']){
+            exit('验证失败,请刷新页面后重试!');
+        }elseif(Get_MD5_Password($_GET["p"],$GLOBALS['USER_DB']["RegTime"]) === $GLOBALS['USER_DB']["Password"]){
+            $_COOKIE = [];
+            $_SERVER['HTTP_COOKIE'] = 'privacy';
+            phpinfo();
+        }else{
+            exit('密码验证失败,请重试!');
+        }
    }
 }

--- a/system/api_root.php
+++ b/system/api_root.php
@@ -547,6 +547,7 @@ function write_sys_settings(){
        'global_header'=>['empty'=>true],
        'global_footer'=>['empty'=>true],
        'api_extend'=>['empty'=>true],
+        'c_code'=>['int'=>true,'min'=>0,'max'=>1,'msg'=>'自定义代码参数错误'],
        //更新设置
        'Update_Source'=>['empty'=>true],
        'Update_Overtime'=>['int'=>true,'min'=>3,'max'=>60,'msg'=>'资源超时参数错误'],
--- a/system/index.php
+++ b/system/index.php
@@ -10,6 +10,10 @@ if(!is_login && ($global_config['Privacy'] == 1 || !check_purview('Common_home',
 }
 //载入站点设置
 $site = unserialize(get_db('user_config','v',['uid'=>UID,'k'=>'s_site']));
+//如果没有权限则清除自定义代码
+if(!check_purview('header',1)){$site['custom_header'] = '';}
+if(!check_purview('footer',1)){$site['custom_footer'] = '';}
+
 $site['Title']  =  $site['title'].(empty($site['subtitle'])?'':' - '.$site['subtitle']);
 //免费用户请保留版权,谢谢!
 $copyright = empty($global_config['copyright'])?'<a target="_blank" href="https://gitee.com/tznb/TwoNav">Copyright © TwoNav</a>':$global_config['copyright'];
--- a/system/install.php
+++ b/system/install.php
@@ -4,8 +4,8 @@ if(!defined('DIR')){header('HTTP/1.1 404 Not Found');header("status: 404 Not Fou
 //初始化
 session_name('TwoNav_initial');
 session_start();
-$layui['js']  = './static/Layui/v2.8.3/layui.js';
-$layui['css'] = './static/Layui/v2.8.3/css/layui.css';
+$layui['js']  = './static/Layui/v2.8.10/layui.js';
+$layui['css'] = './static/Layui/v2.8.10/css/layui.css';

 //判断请求类型
 if($_SERVER['REQUEST_METHOD'] === 'POST'){
@@ -284,7 +284,7 @@ function Write_Config(){
    //写站点配置
    $o_config['Login'] = 'login'; //登录入口
    $o_config['Register'] = 'register'; //注册入口
-    $o_config['RegOption'] = '1'; //注册配置
+    $o_config['RegOption'] = '0'; //注册配置
    $o_config['Libs'] = './static'; //静态库路径
    $o_config['Default_User'] = $_POST['User']; //默认用户
    $o_config['XSS_WAF'] = '1'; //防XSS脚本
@@ -294,6 +294,7 @@ function Write_Config(){
    $o_config['Maintenance'] = '0'; //维护模式
    $o_config['Sub_domain'] = '0'; //二级域名
    $o_config['copyright'] = ''; //版权信息
+    $o_config['c_code'] = '0'; //禁用默认用户使用自定义代码
    
    insert_db("global_config", ["k" => "o_config","v" => $o_config,"d" => '网站配置']);  
    
--- a/system/public.php
+++ b/system/public.php
@@ -642,6 +642,10 @@ function is_Duplicated($array, $field){
 //检查权限(有权限返回true 没有权限时根传递参数1是返回false 2是直接返回错误信息)
 function check_purview($name,$return_type){
    global $USER_DB;
+    //230705新增,禁止判断默认用户是否可以使用自定义代码
+    if($USER_DB['UserGroup'] == 'default' && $GLOBALS['global_config']['c_code'] != '1' && ( $name == 'header' || $name == 'footer' )){
+        return false;
+    }
    if($USER_DB['UserGroup'] == 'root' || $USER_DB['UserGroup'] == 'default'){
        return true;
    }
--- a/system/version.txt
+++ b/system/version.txt
@@ -1 +1 @@
-v2.0.28-20230624
+v2.0.29-20230705
--- a/templates/admin/page/LoginDevice.php
+++ b/templates/admin/page/LoginDevice.php
@@ -2,7 +2,7 @@
 <body>
 <div class="layuimini-container">
    <div class="layuimini-main">
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!-- 操作列 -->
--- a/templates/admin/page/Token.php
+++ b/templates/admin/page/Token.php
@@ -3,8 +3,45 @@
 <div class="layuimini-container">
    <div class="layuimini-main">
        <div class="layui-form layuimini-form layui-form-pane">
-            <blockquote class="layui-elem-quote layui-text" style="">注意: Token(令牌),是您访问API的凭证 (不了解&不需要请勿设置) ,等同于您的账号密码,请妥善保管</blockquote>
-            <div class="layui-form-item">
+            
+            <div class="layui-collapse" lay-accordion>
+              <div class="layui-colla-item" >
+                <div class="layui-colla-title">注意事项</div>
+                <div class="layui-colla-content layui-show">
+                    <blockquote class="layui-elem-quote layui-text" style="">Token(令牌),是您访问API的凭证 (不了解&不需要请勿设置) ,等同于您的账号密码,请妥善保管</blockquote>
+                </div>
+              </div>
+              <div class="layui-colla-item">
+                <div class="layui-colla-title">API模式的差别</div>
+                <div class="layui-colla-content">
+                  <p>安全模式: 仅提供TwoNav自身的API接口,访客(未登录/Token为空)无法调用!</p>
+                  <p>兼容模式: 兼容部分OneNav的API接口,以便于其他插件调用!不允许访客调用!</p>
+                  <p>兼容模式+开放: 在兼容模式的基础上允许访客调用API获取共有数据!</p>
+                  <p>如果你未使用相关扩展插件,则无需修改模式并将Token删除,以提高账号的安全性!</p>
+                </div>
+              </div>
+              <div class="layui-colla-item">
+                <div class="layui-colla-title">如何使用Chrome浏览器扩展 [非官方]</div>
+                <div class="layui-colla-content">
+                    前言:  由于浏览器扩展插件非TwoNav所开发适配,如存在Bug或无法使用属正常现象!<br />
+                    安装:  谷歌应用商店下载<a href="https://chrome.google.com/webstore/detail/onenav/omlkjgkogkfpjbdigianpdbjncdchdco?hl=zh-CN&authuser=0" >OneNav</a>并安装 ( 已知0.9.24可用,其他版本未知 )<br />
+                    设置S: 1.TwoNav后台>右上角账号>安全设置>API模式>设为<兼容模式>或<兼容模式+开放> 2.在本页面获取Token<br />
+                    设置C: 插件API设置>填入域名和Token并保存>完成<br />
+                    常见问题1: 对于单用户使用,确保系统设置中默认用户是当前用户即可!多用户使用时需开启二级域名功能并将域名替换成用户的二级域名,注意结尾不需要带/
+                </div>
+              </div>
+              <div class="layui-colla-item">
+                <div class="layui-colla-title">如何使用uTools扩展插件 [非官方]</div>
+                <div class="layui-colla-content">
+                  <p>前言: 由于uTools扩展插件非TwoNav所开发适配,如存在Bug或无法使用属正常现象!</p>
+                  <p>安装: 在uTools插件应用市场>搜索OneNav>点击获取 </p>
+                  <p>设置S: 1.TwoNav后台>右上角账号>安全设置>API模式>设为<兼容模式>或<兼容模式+开放> 2.在本页面获取SecretKey ( 即插件设置中的API KEY )</p>
+                  <p>设置C: 打开uTools中的OneNav,点击右下角小齿轮>输入网站地址/用户名/API KEY</p>
+                </div>
+              </div>
+            </div>
+            
+            <div class="layui-form-item" style="margin-top: 15px;">
                <label class="layui-form-label required">登录密码</label>
                <div class="layui-input-block">
                    <input type="password" name="Password" lay-verify="required" lay-reqtext="请输入登录密码" placeholder="请输入登录密码"  class="layui-input">
@@ -29,6 +66,7 @@
                    <button class="layui-btn layui-btn-danger" lay-submit lay-filter="delete">删除</button>
                </div>
            </div>
+
        </div>
    </div>
 </div>
--- a/templates/admin/page/category_list.php
+++ b/templates/admin/page/category_list.php
@@ -5,7 +5,7 @@
 <body>
 <div class="layuimini-container">
    <div class="layuimini-main">
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!-- 操作列 -->
--- a/templates/admin/page/expand/apply-admin.php
+++ b/templates/admin/page/expand/apply-admin.php
@@ -20,7 +20,7 @@ $title='收录管理';$awesome=true; require dirname(__DIR__).'/header.php';
        <script type="text/html" id="link_operate">
            <a class="layui-btn layui-btn-xs" lay-event="operation">操作 <i class="layui-icon layui-icon-down"></i></a>
        </script>
-        <table id="apply_list" class="layui-table" lay-filter="apply_list" style="margin: -3px 0;"></table>
+        <table id="apply_list" class="layui-table" lay-filter="apply_list" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!--设置-->
--- a/templates/admin/page/link_sort.php
+++ b/templates/admin/page/link_sort.php
@@ -13,7 +13,7 @@
            </div>
        </div>
        
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!-- 表头工具栏 -->
--- a/templates/admin/page/pwd_group.php
+++ b/templates/admin/page/pwd_group.php
@@ -5,7 +5,7 @@
 <body>
 <div class="layuimini-container">
    <div class="layuimini-main">
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!-- 操作列 -->
--- a/templates/admin/page/root/default_setting.php
+++ b/templates/admin/page/root/default_setting.php
@@ -9,7 +9,7 @@ $LoginConfig = unserialize( get_db("global_config", "v", ["k" => "LoginConfig"])
    <div class="layuimini-main">
    <form class="layui-form" lay-filter="form">
        <div class="layui-form layuimini-form layui-form-pane">
-            <blockquote class="layui-elem-quote layui-text" style="">1.本页功能<a href="https://gitee.com/tznb/OneNav/wikis/%E8%AE%A2%E9%98%85%E6%9C%8D%E5%8A%A1%E6%8C%87%E5%BC%95" target="_blank">授权用户</a>专享<br />2.用户注册后默认使用此方案<br />3.如果您不理解选项的作用请勿乱改   </blockquote>
+            <blockquote class="layui-elem-quote layui-text" style="">1.本页功能<a href="https://gitee.com/tznb/OneNav/wikis/%E8%AE%A2%E9%98%85%E6%9C%8D%E5%8A%A1%E6%8C%87%E5%BC%95" target="_blank">授权用户</a>专享<br />2.用户注册后默认使用此方案<br />3.此功能不会修改现有用户的配置<br />4.如果您不理解选项的作用请勿乱改   </blockquote>
            <fieldset class="layui-elem-field layui-field-title"><legend>安全设置</legend></fieldset>
            
            <div class="layui-form-item">
--- a/templates/admin/page/root/reg_control.php
+++ b/templates/admin/page/root/reg_control.php
@@ -9,7 +9,7 @@ $user_groups = select_db('user_group',['id','code','name'],'');
 <body>
 <div class="layuimini-container">
    <div class="layuimini-main">
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!-- 表头工具栏 -->
--- a/templates/admin/page/root/sys_log.php
+++ b/templates/admin/page/root/sys_log.php
@@ -28,7 +28,7 @@ require(dirname(__DIR__).'/header.php');
        <div class="layui-inline layui-form" style="padding-bottom: 5px;">
            <button class="layui-btn layui-btn-normal " id="search" style="height: 36px;">搜索</button>
        </div>
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>

--- a/templates/admin/page/root/sys_setting.php
+++ b/templates/admin/page/root/sys_setting.php
@@ -2,9 +2,17 @@
 if($USER_DB['UserGroup'] != 'root'){$content='您没有权限访问此页面'; require(DIR.'/templates/admin/page/404.php');exit;}
 $title='系统设置';require(dirname(__DIR__).'/header.php');
 ?>
+<style>
+.layui-btn-container .layui-btn{border-width: 1px; border-style: solid; border-color: #FF5722!important; color: #FF5722!important;background: none;height: 30px; line-height: 30px; padding: 0 10px; font-size: 12px;}
+</style>
 <body>
 <div class="layuimini-container">
    <div class="layuimini-main">
+        <div class="layui-btn-container">
+            <button type="button" class="layui-btn" layuimini-content-href="root/default_setting" data-title="默认设置">默认设置</button>
+            <button type="button" class="layui-btn" layuimini-content-href="root/mail_set" data-title="邮件配置">邮件配置</button>
+            <button type="button" class="layui-btn" layuimini-content-href="root/icon_set" data-title="图标配置">图标配置</button>
+        </div>
    <form class="layui-form" lay-filter="form">
        <div class="layui-form layuimini-form layui-form-pane">
            <blockquote class="layui-elem-quote layui-text" style="">1.带*号的选项属<a href="https://gitee.com/tznb/OneNav/wikis/%E8%AE%A2%E9%98%85%E6%9C%8D%E5%8A%A1%E6%8C%87%E5%BC%95" target="_blank">授权用户</a>专享<br />2.原OneNav Extend的部分配置已下放到用户组配置中<br />3.如果您不理解选项的作用请勿乱改   </blockquote>
@@ -244,42 +252,52 @@ $title='系统设置';require(dirname(__DIR__).'/header.php');
                <div class="layui-form-mid layui-word-aux">自定义链接的扩展信息(需自行添加字段,目前仅用于自定义过渡页)</div>
            </div>
            
-            <fieldset class="layui-elem-field layui-field-title" style="margin-top: 30px;"><legend>长度限制</legend></fieldset>
+            <fieldset class="layui-elem-field layui-field-title" style="margin-top: 30px;"><legend>相关限制</legend></fieldset>
            <blockquote class="layui-elem-quote layui-text" style="">程序采用UTF8编码,一个汉字约占用3个字节!英文字母和数组占用1个字节!值为0表示不限制!</blockquote>
            <div class="layui-form-item">
                <label class="layui-form-label required">分类名称</label>
                <div class="layui-input-inline">
                    <input type="number" name="c_name" autocomplete="off" value="0" class="layui-input">
                </div>
-                <div class="layui-form-mid layui-word-aux">单位:字节。</div>
+                <div class="layui-form-mid layui-word-aux">字符长度限制,单位:字节。</div>
            </div>
            <div class="layui-form-item">
                <label class="layui-form-label required">分类描述</label>
                <div class="layui-input-inline">
                    <input type="number" name="c_desc" autocomplete="off" value="0" class="layui-input">
                </div>
-                <div class="layui-form-mid layui-word-aux">单位:字节。</div>
+                <div class="layui-form-mid layui-word-aux">字符长度限制,单位:字节。</div>
            </div>
            <div class="layui-form-item">
                <label class="layui-form-label required">链接名称</label>
                <div class="layui-input-inline">
                    <input type="number" name="l_name" autocomplete="off" value="0" class="layui-input">
                </div>
-                <div class="layui-form-mid layui-word-aux">单位:字节。</div>
+                <div class="layui-form-mid layui-word-aux">字符长度限制,单位:字节。</div>
            </div>
            <div class="layui-form-item">
                <label class="layui-form-label required">链接地址</label>
                <div class="layui-input-inline">
                    <input type="number" name="l_url" autocomplete="off" value="0" class="layui-input">
                </div>
-                <div class="layui-form-mid layui-word-aux">单位:字节。</div>
+                <div class="layui-form-mid layui-word-aux">字符长度限制,单位:字节。</div>
            </div>
            <div class="layui-form-item">
                <label class="layui-form-label required">链接描述</label>
                <div class="layui-input-inline">
                    <input type="number" name="l_desc" autocomplete="off" value="0" class="layui-input">
                </div>
-                <div class="layui-form-mid layui-word-aux">单位:字节。</div>
+                <div class="layui-form-mid layui-word-aux">字符长度限制,单位:字节。</div>
+            </div>
+            <div class="layui-form-item">
+                <label class="layui-form-label required">自定义代码</label>
+                <div class="layui-input-inline">
+                    <select name="c_code" lay-filter="c_code">
+                        <option value="0" selected="">禁止</option>
+                        <option value="1" >允许</option>
+                    </select>
+                </div>
+                <div class="layui-form-mid layui-word-aux">是否允许默认用户组使用自定义代码!允许存在安全隐患!</div>
            </div>
            
            <div class="layui-form-item">
@@ -289,17 +307,25 @@ $title='系统设置';require(dirname(__DIR__).'/header.php');
    </form>
    </div>
 </div>
+<script src = "<?php echo $libs;?>/jquery/jquery-3.6.0.min.js"></script>
 <?php load_static('js.layui');?>
 <script>
-layui.use(['jquery','form'], function () {
+layui.use(['jquery','form','miniTab'], function () {
    var form = layui.form;
    var layer = layui.layer;
    var $ = layui.jquery;
-    
+    var miniTab = layui.miniTab;
+    miniTab.listen();
    //表单赋值
    form.val('form', <?php echo json_encode($global_config);?>);
    form.val('form', <?php echo json_encode(unserialize( get_db("global_config", "v", ["k" => "length_limit"])));?>);
-
+    
+    //危险提示
+    form.on('select(c_code)', function(data){
+        if (data.value === '1') {
+            layer.alert("允许使用自定义代码存在安全隐患<br />除非您信任使用者!否则建议禁止<br />同时请避免在登录管理员账号时浏览其他用户的主页", { title: '危险提示:' })
+        }
+    });
    //监听提交
    form.on('submit(save)', function (data) {
        $.post('./index.php?c=api&method=write_sys_settings&u='+u,data.field,function(data,status){
--- a/templates/admin/page/root/tool.php
+++ b/templates/admin/page/root/tool.php
@@ -1,6 +1,8 @@
 <?php 
 if($USER_DB['UserGroup'] != 'root'){$content='您没有权限访问此页面'; require(DIR.'/templates/admin/page/404.php');exit;}
 $title='站长工具'; 
+session_start();
+$_SESSION['phpinfo_id'] = Get_Rand_Str(8);
 if(function_exists("opcache_reset")){
    opcache_reset(); //清理PHP缓存
 }
@@ -28,8 +30,6 @@ require(dirname(__DIR__).'/header.php');
            <button type="button" class="layui-btn" layuimini-content-href="root/sys_log" data-title="系统日志">系统日志</button>
            <button type="button" class="layui-btn" layuimini-content-href="updatelog" data-title="更新日志">更新日志</button>
            <button type="button" class="layui-btn" layuimini-content-href="root/import_data" data-title="导入数据">导入数据</button>
-            <button type="button" class="layui-btn" layuimini-content-href="root/mail_set" data-title="邮件配置">邮件配置</button>
-            <button type="button" class="layui-btn" layuimini-content-href="root/icon_set" data-title="图标配置">图标配置</button>
        </div>
        <pre class="layui-code" id="console_log" >
 1.功能都集中在上方的按钮了,需要那个就点击那个!
@@ -49,6 +49,7 @@ require(dirname(__DIR__).'/header.php');
 <script src = "<?php echo $libs;?>/jquery/jquery-3.6.0.min.js"></script>
 <script src = "./templates/admin/js/public.js?v=<?php echo $Ver;?>"></script>
 <script src = "<?php echo $libs?>/Other/ClipBoard.min.js"></script>
+<script src = '<?php echo $libs?>/jquery/jquery.md5.js'></script>
 <?php load_static('js');?>
 <script>
 layui.use(['layer','form','miniTab'], function () {
@@ -106,6 +107,17 @@ layui.use(['layer','form','miniTab'], function () {
    });
    //phpinfo
    $('.phpinfo').on('click', function(){
+        index = layer.prompt({formType: 1,value: '',title: '输入登录密码:',shadeClose: false,"success":function(){
+            $("input.layui-layer-input").on('keydown',function(e){if(e.which == 13) {echo_phpinfo();}});
+        }},function(){
+            echo_phpinfo()
+        }); 
+    });
+    
+    function echo_phpinfo(){
+        let p = $("input.layui-layer-input").val();
+        if(p == ''){ return false;}
+        layer.close(index);
        layer.open({
            title: 'phpinfo',
            type: 2,
@@ -114,9 +126,9 @@ layui.use(['layer','form','miniTab'], function () {
            maxmin:false,
            shadeClose: true,
            area: ['100%', '100%'],
-            content: get_api('read_data','phpinfo'),
+            content: get_api('read_data','phpinfo')+'&p='+$.md5(p)+'&pid=<?php echo $_SESSION['phpinfo_id'] ;?>'
        });
-    });
+    }
    //伪静态
    $('.rewrite').on('click', function(){
        let pathname = window.location.pathname;
--- a/templates/admin/page/root/user_control.php
+++ b/templates/admin/page/root/user_control.php
@@ -28,7 +28,7 @@ $user_groups = select_db('user_group',['id','code','name'],'');
        <div class="layui-inline layui-form" style="padding-bottom: 5px;">
            <button class="layui-btn layui-btn-normal " id="search" style="height: 36px;">搜索</button>
        </div>
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>

--- a/templates/admin/page/root/users_control.php
+++ b/templates/admin/page/root/users_control.php
@@ -6,7 +6,7 @@ require(dirname(__DIR__).'/header.php');
 <body>
 <div class="layuimini-container">
    <div class="layuimini-main">
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <script type="text/html" id="tool">
--- a/templates/admin/page/share.php
+++ b/templates/admin/page/share.php
@@ -38,7 +38,7 @@
        <div class="layui-inline layui-form" style="padding-bottom: 5px;">
            <button class="layui-btn layui-btn-normal " id="search" style="height: 36px;">搜索</button>
        </div>
-        <table id="table" class="layui-table" lay-filter="table" style="margin: -3px 0;"></table>
+        <table id="table" class="layui-table" lay-filter="table" style="margin: 1px 0;"></table>
    </div>
 </div>
 <!-- 操作列 -->
--- a/templates/admin/page/updatelog.php
+++ b/templates/admin/page/updatelog.php
@@ -2,6 +2,21 @@
 <body>
 <div class="layuimini-container">
 <div class="layuimini-main" style=" margin-left: 20px;">
+    <li class="layui-timeline-item">
+        <i class="layui-icon layui-timeline-axis"></i>
+        <div class="layui-timeline-content layui-text">
+            <h4 class="layui-timeline-title">v2.0.29-20230705</h4>
+            <ul>
+                <li>[升级] Layui v2.8.3 升级到 v2.8.10</li>
+                <li>[修复] 全新安装v2.0.22 - v2.0.28,未创建图标缓存表导致图标拉取失败的bug <a href="https://gitee.com/tznb/TwoNav/releases/tag/v2.0.22-20230523" target="_blank">手动修复说明</a></li>
+                <li>[变更] 默认设置和站长工具中邮件配置/图标配置,移入系统设置中</li>
+                <li>[新增] Token页面新增使用说明</li>
+                <li>[安全] 优化安全性,站长工具>phpinfo使用时需输入密码核验,并移除Cookie相关信息!</li>
+                <li>[安全] 系统设置中长度限制改为相关限制,并加入默认用户组禁止使用自定义代码的开关!默认为禁止!并在开启时提示站长存在安全隐患!</li>
+                <li>[安全] 系统安装后默认禁止注册,如需开启请在系统设置>注册配置>设为开放注册</li>
+            </ul>
+        </div>
+    </li>
    <li class="layui-timeline-item">
        <i class="layui-icon layui-timeline-axis"></i>
        <div class="layui-timeline-content layui-text">
--- a/templates/transit/default/index.php
+++ b/templates/transit/default/index.php
@@ -110,7 +110,7 @@ foreach ($link['url_standby'] as $key => $url_standby){

 <?php if( empty($link['url_standby']) ) { ?>

-				<div class="spinner-border"></div> 即将打开，请稍等...
+				<div class="spinner-border" style="margin-top: 16px;"></div> 即将打开，请稍等...
 <?php }else{ ?>
 				<div class="alert alert-primary" style="margin-top: 16px;">
 					<strong>存在备用链接，请手动点击您要打开的链接！</strong>