fix: nav

apps/home/model/ParserModel.php

@@ -58,6 +58,7 @@ class ParserModel extends Model
     // 单个分类信息，不区分语言，兼容跨语言
     public function getSort($scode)
     {
+        $scode = escape_string($scode);
         $field = array(
             'a.*',
             'c.name AS parentname',
@@ -262,6 +263,7 @@ class ParserModel extends Model
     // 列表内容,带分页，不区分语言，兼容跨语言
     public function getLists($scode, $num, $order, $filter = array(), $tags = array(), $select = array(), $fuzzy = true, $start = 1, $lfield = null, $lg = null)
     {
+        $scode = escape_string($scode);
         $ext_table = false;
         if ($lfield) {
             $lfield .= ',id,outlink,type,scode,sortfilename,filename,urlname'; // 附加必须字段
@@ -376,6 +378,7 @@ class ParserModel extends Model
     // 列表内容，不带分页，不区分语言，兼容跨语言
     public function getList($scode, $num, $order, $filter = array(), $tags = array(), $select = array(), $fuzzy = true, $start = 1, $lfield = null, $lg = null)
     {
+        $scode = escape_string($scode);
         $ext_table = false;
         if ($lfield) {
             $lfield .= ',id,outlink,type,scode,sortfilename,filename,urlname'; // 附加必须字段
@@ -490,6 +493,7 @@ class ParserModel extends Model
     // 内容详情，不区分语言，兼容跨语言
     public function getContent($id)
     {
+        $id = escape_string($id);
         $field = array(
             'a.*',
             'b.name as sortname',
@@ -533,6 +537,7 @@ class ParserModel extends Model
         $result = parent::table('ay_content a')->field($field)
             ->where("a.id='$id' OR a.filename='$id'")
             ->where('a.status=1')
+            ->where("a.date<'" . date('Y-m-d H:i:s') . "'")
             ->join($join)
             ->decode()
             ->find();
@@ -542,6 +547,7 @@ class ParserModel extends Model
     // 单篇详情,不区分语言，兼容跨语言
     public function getAbout($scode)
     {
+        $scode = escape_string($scode);
         $field = array(
             'a.*',
             'b.name as sortname',
@@ -592,11 +598,18 @@ class ParserModel extends Model
     }
 
     // 指定内容多图
-    public function getContentPics($id)
+    public function getContentPics($id, $field)
     {
-        $result = parent::table('ay_content')->field("pics,picstitle")
-            ->where("id='$id'")
-            ->where('status=1')
+        $join = array(
+            'ay_content_ext b',
+            'a.id=b.contentid',
+            'LEFT'
+        );
+        $result = parent::table('ay_content a')->field($field . ',picstitle')
+            ->join($join)
+            ->where("a.id='$id'")
+            ->where('a.status=1')
+            ->where("a.date<'" . date('Y-m-d H:i:s') . "'")
             ->find();
         return $result;
     }
@@ -614,6 +627,7 @@ class ParserModel extends Model
         $result = parent::table('ay_content')->field('scode,tags')
             ->where("id='$id'")
             ->where('status=1')
+            ->where("date<'" . date('Y-m-d H:i:s') . "'")
             ->find();
         return $result;
     }
@@ -693,6 +707,7 @@ class ParserModel extends Model
                 ->in('a.scode', $scodes)
                 ->where("a.acode='" . get_lg() . "'")
                 ->where('a.status=1')
+                ->where("a.date<'" . date('Y-m-d H:i:s') . "'")
                 ->order('a.id DESC')
                 ->find();
         }
@@ -736,6 +751,7 @@ class ParserModel extends Model
                 ->in('a.scode', $scodes)
                 ->where("a.acode='" . get_lg() . "'")
                 ->where('a.status=1')
+                ->where("a.date<'" . date('Y-m-d H:i:s') . "'")
                 ->order('a.id ASC')
                 ->find();
         }

apps/home/model/SitemapModel.php

@@ -67,7 +67,8 @@ class SitemapModel extends Model
         
         $where = array(
             'a.status=1',
-            'c.type=2'
+            'c.type=2',
+            "a.date<'" . date('Y-m-d H:i:s') . "'"
         );
         
         return parent::table('ay_content a')->field($fields)