feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,229 @@
|
||||
<?php
|
||||
// +----------------------------------------------------------------------
|
||||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||||
// +----------------------------------------------------------------------
|
||||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||||
// +----------------------------------------------------------------------
|
||||
// | Author: ywxapp<admin@ywxapp.cn>
|
||||
// +----------------------------------------------------------------------
|
||||
declare (strict_types = 1);
|
||||
|
||||
namespace addon\articles\controller\api;
|
||||
|
||||
// 注意：本类就叫 Article，模型必须起别名，否则「类名已被占用」致命错误
|
||||
use addon\articles\model\Article as ArticleModel;
|
||||
use addon\articles\model\ArticleCategory;
|
||||
use addon\articles\model\ArticleComment;
|
||||
use addon\articles\model\ArticleTag;
|
||||
use think\facade\Cache;
|
||||
use ywxapp\controller\ApiBase;
|
||||
use ywxapp\service\AddonService;
|
||||
|
||||
/**
|
||||
* 文章CMS 对外 API
|
||||
*
|
||||
* 鉴权：继承 ApiBase（默认需登录）；列表/详情/分类/标签/搜索放行游客，
|
||||
* 评论必须登录（$noNeedLogin 未包含 comment）。
|
||||
*
|
||||
* URL：/articles/api/articles 等（见 route/app.php）
|
||||
*/
|
||||
class Article extends ApiBase
|
||||
{
|
||||
/** 免登录方法（评论不在其中，必须登录） */
|
||||
protected $noNeedLogin = ['index', 'read', 'categories', 'tags', 'search'];
|
||||
|
||||
/**
|
||||
* 文章列表
|
||||
* 参数：page / cid / tid
|
||||
*/
|
||||
public function index()
|
||||
{
|
||||
$page = (int) input('page/d', 1);
|
||||
$cid = (int) input('cid/d', 0);
|
||||
$tid = (int) input('tid/d', 0);
|
||||
|
||||
$where = [];
|
||||
if ($cid > 0) {
|
||||
$where['cid'] = $cid;
|
||||
}
|
||||
if ($tid > 0) {
|
||||
$where['tid'] = $tid;
|
||||
}
|
||||
|
||||
$list = ArticleModel::listArticles($where, $page, $this->pageSize());
|
||||
|
||||
$rows = [];
|
||||
foreach ($list->items() as $a) {
|
||||
$rows[] = [
|
||||
'id' => $a->id,
|
||||
'title' => $a->title,
|
||||
'summary' => $a->summary,
|
||||
'cover_image' => $a->cover_image,
|
||||
'cid' => $a->cid,
|
||||
'category' => $a->category_name ?? '',
|
||||
'view_count' => (int) $a->view_count,
|
||||
'comment_count' => (int) $a->comment_count,
|
||||
'create_at' => $a->create_at,
|
||||
];
|
||||
}
|
||||
|
||||
$this->apiSuccess($rows, 'success', $list->total());
|
||||
}
|
||||
|
||||
/**
|
||||
* 文章详情（正文已在入库时做过白名单净化，可安全下发）
|
||||
*/
|
||||
public function read($id = 0)
|
||||
{
|
||||
$id = (int) ($id ?: input('id/d', 0));
|
||||
$article = ArticleModel::getDetail($id);
|
||||
|
||||
if (!$article) {
|
||||
$this->apiError('文章不存在或已下线', 404, null, 404);
|
||||
}
|
||||
|
||||
ArticleModel::where('id', $id)->inc('view_count')->update();
|
||||
|
||||
$tags = [];
|
||||
foreach ($article->tags as $t) {
|
||||
$tags[] = ['id' => $t->id, 'name' => $t->name];
|
||||
}
|
||||
|
||||
$this->apiSuccess([
|
||||
'id' => $article->id,
|
||||
'title' => $article->title,
|
||||
'content' => $article->content,
|
||||
'summary' => $article->summary,
|
||||
'cover_image' => $article->cover_image,
|
||||
'author' => $article->author,
|
||||
'cid' => $article->cid,
|
||||
'category' => $article->category_name ?? '',
|
||||
'view_count' => (int) $article->view_count,
|
||||
'comment_count' => (int) $article->comment_count,
|
||||
'create_at' => $article->create_at,
|
||||
'tags' => $tags,
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* 分类列表
|
||||
*/
|
||||
public function categories()
|
||||
{
|
||||
$rows = [];
|
||||
foreach (ArticleCategory::allEnable() as $c) {
|
||||
$rows[] = [
|
||||
'id' => $c->id,
|
||||
'name' => $c->name,
|
||||
'alias' => $c->alias,
|
||||
'description' => $c->description,
|
||||
];
|
||||
}
|
||||
$this->apiSuccess($rows, 'success', count($rows));
|
||||
}
|
||||
|
||||
/**
|
||||
* 标签列表
|
||||
*/
|
||||
public function tags()
|
||||
{
|
||||
$rows = [];
|
||||
foreach (ArticleTag::where('delete_at', 0)->order('id', 'desc')->select() as $t) {
|
||||
$rows[] = ['id' => $t->id, 'name' => $t->name, 'alias' => $t->alias];
|
||||
}
|
||||
$this->apiSuccess($rows, 'success', count($rows));
|
||||
}
|
||||
|
||||
/**
|
||||
* 搜索
|
||||
*/
|
||||
public function search()
|
||||
{
|
||||
$keyword = trim((string) input('keyword/s', ''));
|
||||
$page = (int) input('page/d', 1);
|
||||
|
||||
$list = ArticleModel::listArticles(['keyword' => $keyword], $page, $this->pageSize());
|
||||
|
||||
$rows = [];
|
||||
foreach ($list->items() as $a) {
|
||||
$rows[] = [
|
||||
'id' => $a->id,
|
||||
'title' => $a->title,
|
||||
'summary' => $a->summary,
|
||||
'cid' => $a->cid,
|
||||
'category' => $a->category_name ?? '',
|
||||
'create_at' => $a->create_at,
|
||||
];
|
||||
}
|
||||
|
||||
$this->apiSuccess($rows, 'success', $list->total());
|
||||
}
|
||||
|
||||
/**
|
||||
* 发表评论（需登录）
|
||||
*/
|
||||
public function comment()
|
||||
{
|
||||
$aid = (int) input('aid/d', 0);
|
||||
$content = trim((string) input('content/s', ''));
|
||||
|
||||
if ($aid <= 0 || $content === '') {
|
||||
$this->apiError('参数错误');
|
||||
}
|
||||
|
||||
$len = mb_strlen($content, 'UTF-8');
|
||||
if ($len < 2) {
|
||||
$this->apiError('评论内容太短');
|
||||
}
|
||||
if ($len > 500) {
|
||||
$this->apiError('评论内容不能超过 500 字');
|
||||
}
|
||||
|
||||
// 目标文章必须存在且已发布
|
||||
$article = ArticleModel::where('id', $aid)->where('status', 1)->where('delete_at', 0)->find();
|
||||
if (!$article) {
|
||||
$this->apiError('文章不存在或未发布');
|
||||
}
|
||||
|
||||
$cfg = AddonService::config('articles');
|
||||
$needAudit = !empty($cfg['comment_audit']);
|
||||
$interval = max(0, (int) ($cfg['comment_interval'] ?? 10));
|
||||
|
||||
$uid = (int) $this->uid();
|
||||
$lockKey = 'articles_comment_lock:' . $uid;
|
||||
if ($interval > 0 && Cache::get($lockKey, 0)) {
|
||||
$this->apiError('评论太频繁，请稍后再试');
|
||||
}
|
||||
|
||||
ArticleComment::create([
|
||||
'uid' => $uid,
|
||||
'aid' => $aid,
|
||||
'pid' => 0,
|
||||
'content' => $content,
|
||||
'status' => $needAudit ? 0 : 1,
|
||||
'ip' => (string) $this->request->ip(),
|
||||
'user_agent' => mb_substr((string) $this->request->header('user-agent', ''), 0, 255),
|
||||
'create_at' => time(),
|
||||
'update_at' => time(),
|
||||
]);
|
||||
|
||||
if (!$needAudit) {
|
||||
ArticleModel::where('id', $aid)->inc('comment_count')->update();
|
||||
}
|
||||
if ($interval > 0) {
|
||||
Cache::set($lockKey, 1, $interval);
|
||||
}
|
||||
|
||||
$this->apiSuccess(null, $needAudit ? '评论已提交，等待审核' : '评论成功');
|
||||
}
|
||||
|
||||
/**
|
||||
* 每页条数（取自插件配置）
|
||||
*/
|
||||
private function pageSize(): int
|
||||
{
|
||||
$cfg = AddonService::config('articles');
|
||||
$size = (int) ($cfg['page_size'] ?? 10);
|
||||
return $size > 0 ? min($size, 50) : 10;
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user