Merge branch 'hotfix/security' into release/security

@@ -77,7 +77,7 @@ exports.index = (req, res, next) => {
  */
  */
 exports.tags = (req, res, next) => {
 exports.tags = (req, res, next) => {
 
 
-    let query = req.query.query = escape(req.query.query);
+    let query = req.query.query = (req.query.query || '').replace(/<|>/ig, '');
     let page = req.query.page || 1;
     let page = req.query.page || 1;
     let pageSize = req.query.pageSize || 20;
     let pageSize = req.query.pageSize || 20;
     let type = req.query.type || 0;
     let type = req.query.type || 0;

@@ -215,7 +215,8 @@ const renren = {
 const cancelBind = (req, res) => {
 const cancelBind = (req, res) => {
     let type = req.params.type;
     let type = req.params.type;
 
 
-    if (!(req.get('Refer') || '').match(/yohobuy.com/)) {
+
+    if (!(req.get('Referer') || '').match(/yohobuy.com/)) {
         return res.send({
         return res.send({
             code: 501,
             code: 501,
             message: '非法请求'
             message: '非法请求'

@@ -44,6 +44,10 @@ const bind = {
             title: '联合登录补全信息'
             title: '联合登录补全信息'
         });
         });
     },
     },
+    captchaSuccess: (req, res) => {
+        req.session.type = 'relateStep1';
+        return res.json({code: 200, message: '验证成功'});
+    },
     noregist: (req, res) => {
     noregist: (req, res) => {
         let mobile = req.body.mobile;
         let mobile = req.body.mobile;
         let sourceType = req.body.sourceType;
         let sourceType = req.body.sourceType;
@@ -69,6 +73,10 @@ const bind = {
         let openId = req.body.openId;
         let openId = req.body.openId;
         let area = req.body.area;
         let area = req.body.area;
 
 
+        if (req.session.verifyCode !== 'relateStep1') {
+            return next();
+        }
+
         // UserService.findByMobileAsync(area, mobile).then(user => {
         // UserService.findByMobileAsync(area, mobile).then(user => {
         //     if (user) {
         //     if (user) {
         //         return {
         //         return {
@@ -113,6 +121,8 @@ const bind = {
             title: '绑定手机号'
             title: '绑定手机号'
         };
         };
 
 
+        req.session.type = '';
+
         res.render('bind/success', data);
         res.render('bind/success', data);
     },
     },
     bindCheck: (req, res, next) => {
     bindCheck: (req, res, next) => {
@@ -121,6 +131,10 @@ const bind = {
         let area = req.body.area || '86';
         let area = req.body.area || '86';
         let sourceType = req.body.sourceType;
         let sourceType = req.body.sourceType;
 
 
+        if (req.session.type !== 'relateStep1') {
+            return res.json({code: 400, message: '非法请求'});
+        }
+
         if (mobile && openId && area && sourceType) {
         if (mobile && openId && area && sourceType) {
 
 
             /**
             /**
@@ -170,6 +184,10 @@ const bind = {
         let mobile = req.body.mobile;
         let mobile = req.body.mobile;
         let area = req.body.area;
         let area = req.body.area;
 
 
+        if (req.session.type !== 'relateStep1') {
+            return res.json({code: 400, message: '非法请求'});
+        }
+
         bindService.sendBindMsg(area, mobile).then(result => {
         bindService.sendBindMsg(area, mobile).then(result => {
             if (result && result.code) {
             if (result && result.code) {
                 return res.json(result);
                 return res.json(result);

@@ -65,9 +65,10 @@ router.get('/passport/login/renren/callback', login.renren.callback);
 router.get('/passport/login/account', login.common.needCaptcha);
 router.get('/passport/login/account', login.common.needCaptcha);
 
 
 // 第三方登录后绑定
 // 第三方登录后绑定
-router.get('/passport/thirdlogin/index', bind.indexPage);
+router.get('/passport/thirdlogin/index', captcha.tryGeetest, bind.indexPage);
 router.get('/passport/thirdlogin/bindsuccess', bind.bindSuccess);
 router.get('/passport/thirdlogin/bindsuccess', bind.bindSuccess);
 router.post('/passport/thirdlogin/noregist', bind.noregist);
 router.post('/passport/thirdlogin/noregist', bind.noregist);
+router.post('/passport/thirdlogin/checkCaptcha', captcha.requiredAPI, bind.captchaSuccess); // 图形验证码成功
 router.post('/passport/thirdlogin/relate', bind.relate);
 router.post('/passport/thirdlogin/relate', bind.relate);
 
 
 router.post('/passport/autouserinfo/bindCheck', bind.bindCheck);
 router.post('/passport/autouserinfo/bindCheck', bind.bindCheck);

@@ -4,7 +4,7 @@
         <span class="yoho">YOHO!FAMILY</span>
         <span class="yoho">YOHO!FAMILY</span>
     </h3>
     </h3>
 
 
-    <p class="safeword">为了您的账户安全，请您完善账户信息，以便为您提供更优质的服务</p>
+    <p class="safeword">**为了您的账户安全，请您完善账户信息，以便为您提供更优质的服务</p>
     <form action="" id="bindmobileform" method="post">
     <form action="" id="bindmobileform" method="post">
         <input type="hidden" value="{{openId}}" id="openId" name="openId"/>
         <input type="hidden" value="{{openId}}" id="openId" name="openId"/>
         <input type="hidden" value="{{sourceType}}" id="sourceType" name="sourceType"/>
         <input type="hidden" value="{{sourceType}}" id="sourceType" name="sourceType"/>
@@ -41,6 +41,12 @@
                 </div>
                 </div>
             </div>
             </div>
         </div>
         </div>
+
+        <div class="yohobindrow" style="height: 100px;">
+            <div class="name phonetag"></div>
+            <div id="captcha" style="display: inline-block; position: relative;">
+            </div>
+        </div>
     </form>
     </form>
 
 
     <div class="protoctolwrapper">
     <div class="protoctolwrapper">
@@ -121,3 +127,5 @@
     </div>
     </div>
     <div class="backdrop" style="display:none"></div>
     <div class="backdrop" style="display:none"></div>
 </div>
 </div>
+
+{{> gee-captcha}}

@@ -5,6 +5,7 @@
  */
  */
 var $ = require('yoho-jquery');
 var $ = require('yoho-jquery');
 var phoneRegx = require('../common/mail-phone-regx').phoneRegx;
 var phoneRegx = require('../common/mail-phone-regx').phoneRegx;
+var Captcha = require('../../plugins/captcha');
 
 
 var nopermissionoption = $('#nopermissionmessage').html(); // 倒计时dom
 var nopermissionoption = $('#nopermissionmessage').html(); // 倒计时dom
 var sendmessagehtml = $('.validatewrapper').html(); // 发送短信dom
 var sendmessagehtml = $('.validatewrapper').html(); // 发送短信dom
@@ -17,6 +18,8 @@ var $wrapper = $('.bindwrapper'),
     $phoneTip = $wrapper.find('.phone-err-tip'),
     $phoneTip = $wrapper.find('.phone-err-tip'),
     $nextBtn = $wrapper.find('.yohobindbtn');
     $nextBtn = $wrapper.find('.yohobindbtn');
 
 
+var captcha = new Captcha('#captcha', {checkURI: '/passport/thirdlogin/checkCaptcha'}).init();
+
 require('../../simple-header');
 require('../../simple-header');
 
 
 /**
 /**
@@ -229,6 +232,7 @@ function sendMessageValidate() {
             return;
             return;
         }
         }
         circleTime($('#mobile').val());
         circleTime($('#mobile').val());
+
         $.ajax({
         $.ajax({
             type: 'POST',
             type: 'POST',
             url: '/passport/autouserinfo/sendBindMsg',
             url: '/passport/autouserinfo/sendBindMsg',
@@ -323,6 +327,8 @@ function nextStep() {
         }
         }
         openId = $('#openId').val() || '29803EC6D4AAC3AAB8ABDB6AE829D579';
         openId = $('#openId').val() || '29803EC6D4AAC3AAB8ABDB6AE829D579';
         sourceType = $('#sourceType').val() || 'qq';
         sourceType = $('#sourceType').val() || 'qq';
+
+        captcha.check().then(function() {
             $.ajax({
             $.ajax({
                 type: 'post',
                 type: 'post',
                 url: '/passport/autouserinfo/bindCheck',
                 url: '/passport/autouserinfo/bindCheck',
@@ -347,7 +353,7 @@ function nextStep() {
                         $('#registphone').text(mobile);
                         $('#registphone').text(mobile);
                         $('#username').text(username);
                         $('#username').text(username);
                         if (headImg === '') {
                         if (headImg === '') {
-                        $('#userphoto').attr('src', 'https://img10.static.yhbimg.com/headimg/2013/11/28/09/' +
+                            $('#userphoto').attr('src', 'http://img10.static.yhbimg.com/headimg/2013/11/28/09/' +
                                 '01cae078abe5fe320c88cdf4c220212688.gif?imageView/2/w/100/h/100');
                                 '01cae078abe5fe320c88cdf4c220212688.gif?imageView/2/w/100/h/100');
                         } else {
                         } else {
                             $('#userphoto').attr('src', headImg);
                             $('#userphoto').attr('src', headImg);
@@ -360,19 +366,17 @@ function nextStep() {
                         });
                         });
                         $('#alreayregist').show();
                         $('#alreayregist').show();
                     } else if (data.code === 203) {
                     } else if (data.code === 203) {
-
                         // 已注册 可关联
                         // 已注册 可关联
                         $('#bindmobileform').attr('action', data.data.next);
                         $('#bindmobileform').attr('action', data.data.next);
                         $('#bindmobileform').submit();
                         $('#bindmobileform').submit();
                     } else if (data.code === 205) {
                     } else if (data.code === 205) {
-
                         // 未注册 不可关联
                         // 未注册 不可关联
                         username = data.data.user.username;
                         username = data.data.user.username;
                         headImg = data.data.user.headImg;
                         headImg = data.data.user.headImg;
                         $('#registphonetwo').text(mobile);
                         $('#registphonetwo').text(mobile);
                         $('#username1').text(username);
                         $('#username1').text(username);
                         if (headImg === '') {
                         if (headImg === '') {
-                        $('#userphoto1').attr('src', 'https://img10.static.yhbimg.com/headimg/2013/11/28/09/' +
+                            $('#userphoto1').attr('src', 'http://img10.static.yhbimg.com/headimg/2013/11/28/09/' +
                                 '01cae078abe5fe320c88cdf4c220212688.gif?imageView/2/w/100/h/100');
                                 '01cae078abe5fe320c88cdf4c220212688.gif?imageView/2/w/100/h/100');
                         } else {
                         } else {
                             $('#userphoto1').attr('src', headImg);
                             $('#userphoto1').attr('src', headImg);
@@ -394,6 +398,7 @@ function nextStep() {
             }
             }
         });
         });
         });
         });
+    });
 }
 }
 
 
 $wrapper.on('keydown', '.phonenum', function(e) {
 $wrapper.on('keydown', '.phonenum', function(e) {

@@ -37,8 +37,12 @@
 .bindwrapper {
 .bindwrapper {
     margin: 0 auto;
     margin: 0 auto;
     padding-top: 122px;
     padding-top: 122px;
-    min-height: 450px;
+    min-height: 550px;
     width: 980px;
     width: 980px;
+
+    .img-check-tip {
+        top: 110px !important;
+    }
 }
 }
 
 
 .welcomeword {
 .welcomeword {