feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,166 @@
|
||||
<?php
|
||||
// +----------------------------------------------------------------------
|
||||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||||
// +----------------------------------------------------------------------
|
||||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||||
// +----------------------------------------------------------------------
|
||||
// | Author: ywxapp<admin@ywxapp.cn>
|
||||
// +----------------------------------------------------------------------
|
||||
declare (strict_types = 1);
|
||||
|
||||
namespace addon\articles\controller;
|
||||
|
||||
use addon\articles\model\Article;
|
||||
use addon\articles\model\ArticleCategory;
|
||||
use addon\articles\model\ArticleTopic;
|
||||
use think\facade\Request;
|
||||
|
||||
/**
|
||||
* 站点地图（前台 SEO 用）
|
||||
*
|
||||
* 文章数 ≤ 5000：sitemap.xml 直接输出全部 URL（urlset）
|
||||
* 文章数 > 5000：sitemap.xml 输出 sitemap index，文章拆到 sitemap-<n>.xml 分片
|
||||
* （单文件 URL 上限 5 万条、体积 50MB，这里按 5000 条分片留足余量）
|
||||
*
|
||||
* 收录范围：插件首页 / 分类 / 专题 / 已发布且未删除的文章（草稿与待审不收录）
|
||||
*
|
||||
* @author ywxapp <admin@ywxapp.cn>
|
||||
*/
|
||||
class Sitemap extends ArticlesFrontend
|
||||
{
|
||||
/** 单个 sitemap 文件最多包含的 URL 数 */
|
||||
const MAX_PER_FILE = 5000;
|
||||
|
||||
/**
|
||||
* /articles/sitemap.xml
|
||||
*/
|
||||
public function index()
|
||||
{
|
||||
$base = Request::domain();
|
||||
$total = Article::scope('normal')->count();
|
||||
|
||||
// 首页 / 分类 / 专题（条目少，始终放在索引或主文件中）
|
||||
$static = [
|
||||
['loc' => $base . (string) url('articles/index/index'), 'priority' => '1.0', 'lastmod' => date('Y-m-d')],
|
||||
['loc' => $base . (string) url('articles/topic/index'), 'priority' => '0.7'],
|
||||
];
|
||||
foreach (ArticleCategory::allEnable() as $c) {
|
||||
$static[] = [
|
||||
'loc' => $base . (string) url('articles/category/index', ['id' => $c->id]),
|
||||
'priority' => '0.6',
|
||||
];
|
||||
}
|
||||
foreach (ArticleTopic::scope('enable')->select() as $t) {
|
||||
$static[] = [
|
||||
'loc' => $base . (string) url('articles/topic/' . $t->id),
|
||||
'priority' => '0.7',
|
||||
];
|
||||
}
|
||||
|
||||
// 文章过多 → 输出 sitemap index（静态条目放主文件，文章分片）
|
||||
if ($total > self::MAX_PER_FILE) {
|
||||
$pages = (int) ceil($total / self::MAX_PER_FILE);
|
||||
$maps = $static;
|
||||
for ($i = 1; $i <= $pages; $i++) {
|
||||
// 分片文件 URL 手工拼接：url() 会追加 .html 后缀，不能用于 .xml
|
||||
$maps[] = [
|
||||
'loc' => $base . '/articles/sitemap-' . $i . '.xml',
|
||||
'lastmod' => date('Y-m-d'),
|
||||
'priority' => '0.8',
|
||||
];
|
||||
}
|
||||
return response(self::renderIndex($maps), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||||
}
|
||||
|
||||
// 常规：单文件输出（静态 + 全部文章）
|
||||
$items = $static;
|
||||
foreach (Article::scope('normal')->field('id,update_at')->order('id', 'desc')->select() as $a) {
|
||||
$items[] = [
|
||||
'loc' => $base . (string) url('articles/read/' . $a->id),
|
||||
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
|
||||
'priority' => '0.8',
|
||||
];
|
||||
}
|
||||
|
||||
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||||
}
|
||||
|
||||
/**
|
||||
* 文章分片：/articles/sitemap-<page>.xml
|
||||
*/
|
||||
public function chunk($page = 1)
|
||||
{
|
||||
$page = max(1, (int) $page);
|
||||
$base = Request::domain();
|
||||
$total = Article::scope('normal')->count();
|
||||
|
||||
$pages = max(1, (int) ceil($total / self::MAX_PER_FILE));
|
||||
if ($page > $pages) {
|
||||
// 越界分片返回空 urlset，避免搜索引擎误判为错误
|
||||
return response(self::renderUrlset([]), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||||
}
|
||||
|
||||
$articles = Article::scope('normal')
|
||||
->field('id,update_at')
|
||||
->order('id', 'desc')
|
||||
->page($page, self::MAX_PER_FILE)
|
||||
->select();
|
||||
|
||||
$items = [];
|
||||
foreach ($articles as $a) {
|
||||
$items[] = [
|
||||
'loc' => $base . (string) url('articles/read/' . $a->id),
|
||||
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
|
||||
'priority' => '0.8',
|
||||
];
|
||||
}
|
||||
|
||||
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||||
}
|
||||
|
||||
/**
|
||||
* 渲染 urlset
|
||||
*/
|
||||
private static function renderUrlset(array $items): string
|
||||
{
|
||||
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
|
||||
. '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
|
||||
|
||||
foreach ($items as $item) {
|
||||
$xml .= " <url>\n";
|
||||
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
|
||||
if (!empty($item['lastmod'])) {
|
||||
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
|
||||
}
|
||||
$xml .= ' <priority>' . ($item['priority'] ?? '0.5') . "</priority>\n";
|
||||
$xml .= " </url>\n";
|
||||
}
|
||||
|
||||
return $xml . '</urlset>';
|
||||
}
|
||||
|
||||
/**
|
||||
* 渲染 sitemap index
|
||||
*/
|
||||
private static function renderIndex(array $items): string
|
||||
{
|
||||
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
|
||||
. '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
|
||||
|
||||
foreach ($items as $item) {
|
||||
$xml .= " <sitemap>\n";
|
||||
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
|
||||
if (!empty($item['lastmod'])) {
|
||||
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
|
||||
}
|
||||
$xml .= " </sitemap>\n";
|
||||
}
|
||||
|
||||
return $xml . '</sitemapindex>';
|
||||
}
|
||||
|
||||
private static function esc(string $value): string
|
||||
{
|
||||
return htmlspecialchars($value, ENT_XML1 | ENT_QUOTES, 'UTF-8');
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user