fix: 修复安全漏洞并清理死代码

安全修复：
- HandleActionController: 添加 is_subclass_of 校验，防止任意类实例化
- RenderableController: 添加 LazyRenderable 接口校验，防止任意类实例化
- TinymceController: 添加路径遍历防护和磁盘白名单校验

代码清理：
- EloquentRepository: 移除 Laravel 5.8 兼容代码，直接使用 getForeignKeyName()

Author: PrintNow

src/Http/Controllers/HandleActionController.php

@@ -42,7 +42,7 @@ protected function resolveActionInstance(Request $request): Action
 
         $actionClass = str_replace('_', '\\', $request->get('_action'));
 
-        if (! class_exists($actionClass)) {
+        if (! class_exists($actionClass) || ! is_subclass_of($actionClass, Action::class)) {
             throw new AdminException("Action [{$actionClass}] does not exist.");
         }
 

src/Http/Controllers/RenderableController.php

@@ -51,6 +51,10 @@ protected function newRenderable(Request $request): LazyRenderable
 
         $class = str_replace('_', '\\', $class);
 
+        if (! class_exists($class) || ! is_subclass_of($class, LazyRenderable::class)) {
+            throw new \InvalidArgumentException("Renderable [{$class}] does not exist or does not implement LazyRenderable.");
+        }
+
         $renderable = new $class();
 
         $renderable->payload($request->all());

src/Http/Controllers/TinymceController.php

@@ -12,7 +12,7 @@ class TinymceController
     public function upload(Request $request)
     {
         $file = $request->file('file');
-        $dir = trim($request->get('dir'), '/');
+        $dir = $this->sanitizeDir($request->get('dir'));
         $disk = $this->disk();
 
         $newName = $this->generateNewName($file);
@@ -27,13 +27,34 @@ protected function generateNewName(UploadedFile $file)
         return uniqid(md5($file->getClientOriginalName()), true).'.'.$file->getClientOriginalExtension();
     }
 
+    /**
+     * Sanitize directory path to prevent path traversal.
+     */
+    protected function sanitizeDir(?string $dir): string
+    {
+        $dir = trim($dir ?? '', '/');
+
+        // 移除路径遍历字符
+        $dir = str_replace(['../', '..\\', '..'], '', $dir);
+
+        // 确保路径不以点开头（隐藏文件）
+        $dir = ltrim($dir, '.');
+
+        return $dir ?: 'uploads';
+    }
+
     /**
      * @return \Illuminate\Contracts\Filesystem\Filesystem|FilesystemAdapter
      */
     protected function disk()
     {
         $disk = request()->get('disk') ?: config('admin.upload.disk');
 
+        // 验证磁盘配置存在
+        if (! config("filesystems.disks.{$disk}")) {
+            $disk = config('admin.upload.disk', 'local');
+        }
+
         return Storage::disk($disk);
     }
 }

src/Repositories/EloquentRepository.php

@@ -872,9 +872,8 @@ protected function updateRelation(Form $form, EloquentModel $model, array $relat
                     $parent->save();
 
                     // When in creating, associate two models
-                    $foreignKeyMethod = version_compare(app()->version(), '5.8.0', '<') ? 'getForeignKey' : 'getForeignKeyName';
-                    if (! $model->{$relation->{$foreignKeyMethod}()}) {
-                        $model->{$relation->{$foreignKeyMethod}()} = $parent->getKey();
+                    if (! $model->{$relation->getForeignKeyName()}) {
+                        $model->{$relation->getForeignKeyName()} = $parent->getKey();
 
                         $model->save();
                     }