From 29d700b30d375eb3d0c070eae74aeb394ad6ff95 Mon Sep 17 00:00:00 2001
From: pbootcms <pbootcms@protonmail.com>
Date: Sat, 27 Jun 2026 01:19:40 +0800
Subject: [PATCH] =?UTF-8?q?fix=20#32=20=E4=BF=AE=E5=A4=8D=E7=AB=99?=
 =?UTF-8?q?=E7=82=B9=E6=A0=87=E7=AD=BE=E8=BE=93=E5=87=BA=20PHP=20=E6=A0=87?=
 =?UTF-8?q?=E7=AD=BE=E9=A3=8E=E9=99=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/home/controller/ParserController.php | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/apps/home/controller/ParserController.php b/apps/home/controller/ParserController.php
index e539c60..73fb995 100644
--- a/apps/home/controller/ParserController.php
+++ b/apps/home/controller/ParserController.php
@@ -252,13 +252,15 @@ public function parserSiteLabel($content)
                         break;
                     case 'statistical':
                         if (isset($data->statistical)) {
-                            $content = str_replace($matches[0][$i], filter_html(decode_string($data->statistical)), $content);
+                            $statistical = filter_html(decode_string($data->statistical));
+                            $content = str_replace($matches[0][$i], $this->sanitizePhpOpenTag($statistical), $content);
                         } else {
                             $content = str_replace($matches[0][$i], '', $content);
                         }
                     case 'copyright':
                         if (isset($data->copyright)) {
-                            $content = str_replace($matches[0][$i], $this->adjustLabelData($params, decode_string($data->copyright)), $content);
+                            $copyright = $this->adjustLabelData($params, decode_string($data->copyright));
+                            $content = str_replace($matches[0][$i], $this->sanitizePhpOpenTag($copyright), $content);
                         } else {
                             $content = str_replace($matches[0][$i], '', $content);
                         }
@@ -276,6 +278,15 @@ public function parserSiteLabel($content)
         return $content;
     }
 
+    // 转义 PHP 开标签，防止站点信息被还原为可执行 PHP 代码
+    protected function sanitizePhpOpenTag($content)
+    {
+        if (! is_string($content) || $content === '') {
+            return $content;
+        }
+        return preg_replace('/<\?(?:php|=)?/i', '&lt;?', $content);
+    }
+
     // 解析公司标签
     public function parserCompanyLabel($content)
     {
@@ -4083,4 +4094,4 @@ protected function checkLabelLevel($params)
         }
         return true;
     }
-}
\ No newline at end of file
+}