code

service/login.class.php

@@ -1596,8 +1596,19 @@ class login {
                 exit();
             }
         } else {
+            $msg = 'verifcation_Invalid';
+            if(empty($AES_encrypted)){
+                $msg="Invalid link. Please use the original link from your activation email.";
+            } else {
+                $secret_key_exist = common::excuteOneSql("select secret_key from customer_service_secret_key where secret_key = '$verifcation_code' limit 1");
+                if(!empty($secret_key_exist)){
+                    $msg="Link expired (valid for 7 days).  Use \"Forgot Password\" on the login page to reset and activate.";
+                } else {
+                    $msg="Account already activated.  Please log in with your existing password.";
+                }
+            }
             $data = array(
-                'msg' => 'verifcation_Invalid',
+                'msg' => $msg,
                 'data' => ''
             );
         }

service/ocean_order.class.php

@@ -232,8 +232,7 @@ class ocean_order {
             }
 
             try {
-                $allow_extend = "|.pdf|.xlsx|.docx|";
-                //$allow_extend = "|.pdf|";
+                $allow_extend = "|.pdf|.xlsx|.docx|.xls|.doc|";
                 $file_name = $_FILES['file']["name"];
                 $errorMsg = "";
                 $sql = "";
@@ -257,22 +256,25 @@ class ocean_order {
                         $errorMsg = $_FILES['file']["name"][$i].', File type error.';
                         continue;
                     }
+                    
+                    //检查xlsx,docx 文档的是否异常,  doc 和xls放过
+                    if($exten == 'xlsx' || $exten == 'docx'){
+                        //MIME 类型校验（关键！防伪装）
+                        $tmpName = $_FILES['file']['tmp_name'][$i];
+                        $finfo = finfo_open(FILEINFO_MIME_TYPE);
+                        $mimeType = finfo_file($finfo, $tmpName);
+                        finfo_close($finfo);
+
+                        $allowedMimes = [
+                            'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',     // .xlsx
+                            'application/vnd.openxmlformats-officedocument.wordprocessingml.document', // .docx
+                            'application/pdf'                                                       // .pdf
+                        ];
 
-                    //MIME 类型校验（关键！防伪装）
-                    $tmpName = $_FILES['file']['tmp_name'][$i];
-                    $finfo = finfo_open(FILEINFO_MIME_TYPE);
-                    $mimeType = finfo_file($finfo, $tmpName);
-                    finfo_close($finfo);
-
-                    $allowedMimes = [
-                        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',     // .xlsx
-                        'application/vnd.openxmlformats-officedocument.wordprocessingml.document', // .docx
-                        'application/pdf'                                                       // .pdf
-                    ];
-
-                    if (!in_array($mimeType, $allowedMimes)) {
-                        $errorMsg = "Invalid file format. Please upload a genuine .xlsx, .docx, or .pdf file.";
-                        continue;
+                        if (!in_array($mimeType, $allowedMimes)) {
+                            $errorMsg = "Invalid file format. Please upload a genuine .xlsx, .docx, or .pdf file.";
+                            continue;
+                        }
                     }
 
                     $filename = $bol."_".$format['standard']."_V".($i+1+$num). "." . $exten;

utils/utils.class.php

@@ -892,8 +892,12 @@ class utils {
     }
 
     public static function hasMacros($filePath) {
-        //$extension = pathinfo($filePath, PATHINFO_EXTENSION);
         //在 MIME 校验之后，再加一层 ZIP 宏检测（同时查 xl/ 和 word/）
+        $extension = pathinfo($filePath, PATHINFO_EXTENSION);
+        if($extension == 'xls' || $extension == 'doc'){
+            return false;
+        }
+
         $zip = new ZipArchive();
         if ($zip->open($filePath) !== true) {
             // 无法打开为 ZIP：可能是 .xls/.doc 或损坏文件