后台接口无需登录就能进行操作

[jshensh]

curl 'http://example.com/root_create_user' -H 'Pragma: no-cache' -H 'Origin: http://example.com' -H 'Accept-Encoding: gzip, deflate' -H 'Accept-Language: zh-CN,zh;q=0.8' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'Accept: */*' -H 'Cache-Control: no-cache' -H 'X-Requested-With: XMLHttpRequest' -H 'Connection: keep-alive' -H 'Referer: http://example.com/admin' --data 'username=test233&password=test&realname=test&email=test233%40test.com' --compressed

[woider]

if (session('admin')['rank'] != 0) {
    return false;
}

应该是身份验证时出了BUG，PHP中（null != 0）结果为 false。
这里应改为 if (session('admin')['rank'] !== 0)

[zengxiankun]

后台的网址是多少？