🌈冰激凌内容管理系统🍦,实现MacWK资源站，社区图片视频圈子CMS，支持网页端移动端小程序🌟适合做 资讯商城，社区论坛，聊天交友 社区，博客，圈子，论坛，图片，视频，社交。
Home Page: https://www.icecms.cn
License: GNU Affero General Public License v3.0
I love to make friends. so if you want to say hi, I'll be happy to meet you more!😊
⭐️ From NgShow
作者你好 是页面的代码没更新吗 页面运行起来很多报错，跟演示效果长得不一样呀
msg: "nested exception is org.apache.ibatis.reflection.ReflectionException: Could not set property 'updateTime' of 'class com.ttice.icewkment.entity.Resource' with value 'Fri Dec 16 09:12:59 UTC 2022' Cause: java.lang.IllegalArgumentException: argument type mismatch"
前端传的时间对的，以及数据库，需要改一下后端
api:/api/User/ChangeUser/(self_token)
Calling this interface, we can modify the information of any user by modifying the UserID field.there will be no validation
Try to log in to user test39, it goes well
It is obvious that developers only modify user information through UserID without any judgment and filtering
和macwk.com差别太大了，希望做的差不多就好
项目 'IceWk-uniApp' 开始编译...
请注意运行模式下，因日志输出、sourcemap以及未压缩源码等原因，性能和包体积，均不及发行模式。若要正式发布，请点击发行菜单或使用cli发布命令进行发布
小程序各家浏览器内核及自定义组件实现机制存在差异，可能存在样式布局兼容问题，参考：https://uniapp.dcloud.io/matter?id=mp
正在编译中...
Browserslist: caniuse-lite is outdated. Please run:
npx update-browserslist-db@latest
Why you should do it regularly: https://github.com/browserslist/update-db#readme
at subPage/commen/post.vue:1
Module build failed (from ./node_modules/@dcloudio/webpack-uni-mp-loader/lib/script.js):
Error: 组件 bgyxedit 引用错误，仅支持 import 方式引入组件
at /Applications/HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli/node_modules/@dcloudio/webpack-uni-mp-loader/lib/babel/util.js:38:13
at Array.forEach ()
at parseComponents (/Applications/HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli/node_modules/@dcloudio/webpack-uni-mp-loader/lib/babel/util.js:32:9)
The impact code in IceCMS/IceWk-ment/src/main/java/com/ttice/icewkment/controller/UserController.java：
if(!claims){
//前端接收后进行处理
Result.fail(403,"Token已过期",null);
}
//验证之前密码是否正确
QueryWrapper wrapper = new QueryWrapper<>();
wrapper.eq("user_id",userid);
User usercheak = userMapper.selectOne(wrapper);
String password = usercheak.getPassword();
if(Objects.equals(password, yuanPassWord)) {
User user = new User();
user.setUserId(userid);
user.setPassword(NewPassWord);
userMapper.updateById(user);
return Result.succ(200, "修改成功", null);
}
Changing the password does not need to verify the current jwt, so after getting this api address, Hacker can change the password by brute force cracking ，especially when the user password is weak。
After the administrator open the following page, and click the the Submit request, square message with ID 264 will be deleted.
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.146.129:8181/square/DelectSquareById/264">
<input type="submit" value="Submit request" />
</form>
</body>
</html>
该cms的ui还是不错的，但是功能还不是太完善，能否增添一些功能，谢谢🙏🙏
There is a Stored-XSS vulnerability in IceCMS v1.0.0
api : /Websquare/create/circle
planet - circle
POC：
The payload is <img src=1 onerror=alert(1)>
In the updateimage path of the imageApi file, the upload file type is not restricted, causing any file to be uploaded. At the same time, it is set to store the file locally if there is no remote bucket.
APIPath：IceWk-vues/src/api/updateImage.js
updateImage Path： IceWk-ment/src/main/java/com/ttice/icewkment/controller/ImageApi.java
vue.runtime.esm.js:619 [Vue warn]: Property or method "input" is not defined on the instance but referenced during render. Make sure that this property is reactive, either in the data option, or for class-based components, by initializing the property. See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.
found in
---> at src/admin/ResourceList.vue
at src/layout/components/AppMain.vue
at src/layout/index.vue
at src/App.vue
warn @ vue.runtime.esm.js:619
2vue.runtime.esm.js:619 [Vue warn]: Property or method "handleAdd" is not defined on the instance but referenced during render. Make sure that this property is reactive, either in the data option, or for class-based components, by initializing the property. See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.
found in
---> at src/admin/ResourceList.vue
at src/layout/components/AppMain.vue
at src/layout/index.vue
at src/App.vue
warn @ vue.runtime.esm.js:619
vue.runtime.esm.js:619 [Vue warn]: Property or method "handleDelete" is not defined on the instance but referenced during render. Make sure that this property is reactive, either in the data option, or for class-based components, by initializing the property. See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.
found in
大神，
说明文档里，圈的选项里，有大量图片无法显示！！！
二开无忧授权版(¥ 199) 是否是开放全部代码 并且能用作商用,会不会锁住部分代码 和性价比最高企业版(¥ 2999) 本质上是功能的区别吗? 源码方面的"开源"和"全部源码"是有什么区别的
【腾讯云】尊敬的腾讯云用户，您好！您的腾讯云账号XXXXXXXXXXXXXX下的服务器：XXXXXXXXXXXXXXXX[CentOS-YO0q]，实例ID：XXXXXXXXXX，地域：华北地区 (北京)，时间：2023-05-12 06:27:51(GMT+8:00)，检测到存在待处理的应用漏洞：Apache Shiro 身份验证绕过漏洞(CVE-2022-32532)，威胁等级：严重，可能会给黑客留下可乘之机
【腾讯云】尊敬的腾讯云用户，您好！您的腾讯云账号（账号ID：XXXXXXXXXXX）下的服务器：XXXXXXXXXXXXXXX [CentOS-YO0q]，实例ID：XXXXXXXXXXXXXXXXX，地域：华北地区 (北京)，时间：2023-05-07 04:18:03(GMT+8:00)，检测到存在待处理的应急漏洞：FastJson代码执行漏洞(CVE-2022-25845)，威胁等级：严重，可能会给黑客留下可乘之机
This api does not require login, obtains user information through user_id, and returns the user name, password, and email address in plain text.
It is like the preview address provided by the project, macwk.cc, and the backend service address is macwk.cc/api through the request body. So we can get any user information, including the administrator.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.