YwxApp/YwxAppThink
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用

Browse Source 
安全（P0）
- 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签
  （ywxapp.framework_package_verify，默认开启）
- JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive
- 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php）
- 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed 2026-10-22 00:53:39 +08:00
1 parent 1d49e6f5ee
commit 18101cf11a
636 files changed
+58517 -9519
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

addon/blog/controller/Article.php
+38 -6
View File
@@ -93,21 +93,28 @@ class Article extends BlogFrontend
*/
public function detail($id)
{
// 详情页必须校验审核状态，否则待审/驳回文章可通过直接访问 URL 打开
$article = ArticleModel::with(['user', 'category', 'tags'])
->where('id', $id)
->where('status', 1)
->where('audit_status', 2)
->find();
if (!$article) {
return $this->error('文章不存在或已被删除');
// 软 404 会被搜索引擎收录：显式返回 HTTP 404
return $this->result->setStatusCode(404)->error('文章不存在或已被删除', 404);
}
// 浏览量去重：同一访客（IP + UA）24 小时内同一篇只计一次，避免刷新刷量
if (!$this->viewed((int) $article->id)) {
$article->view_count += 1;
$article->save();
}
$article->view_count += 1;
$article->save();
// 注意：BlogComment 只定义了 user()（无 member()），写 'member' 会 Call to undefined method
$comments = CommentModel::with([
'member',
'children' =>
'user',
'children' =>
function ($q) {
$q->with(['user'])->where('status', 1)->order('create_at', 'asc');
},
@@ -238,6 +245,12 @@ class Article extends BlogFrontend
'id' => $comment->id,
'content' => $comment->content,
'create_at' => date('Y-m-d H:i', $comment->create_at),
// 前端渲染取 d.user.*，键名必须一致（原先返回 member）
'user' => [
'uid' => $comment->user->uid,
'nickname' => $comment->user->nickname,
'avatar' => $comment->user->avatar ?? '/static/images/avatar.png'
],
'member' => [
'uid' => $comment->user->uid,
'nickname' => $comment->user->nickname,
@@ -287,6 +300,7 @@ class Article extends BlogFrontend
$articles = ArticleModel::with(['user', 'category', 'tags'])
->where('uid', $id)
->where('status', 1)
->where('audit_status', 2)
->order('create_at', 'desc')
->paginate(10);
@@ -298,4 +312,22 @@ class Article extends BlogFrontend
'articles' => $articles,
]);
}
/**
* 浏览量去重判定（true = 24 小时内同一访客已计过）
*/
private function viewed(int $articleId): bool
{
$fingerprint = md5(
(string) $this->request->ip() . '|' . (string) $this->request->header('user-agent', '')
);
$key = 'blog_view:' . $articleId . ':' . $fingerprint;
if (\think\facade\Cache::get($key, 0)) {
return true;
}
\think\facade\Cache::set($key, 1, 86400);
return false;
}
}
addon/blog/controller/BlogFrontend.php
+26 -1
View File
@@ -23,7 +23,7 @@ class BlogFrontend extends FrontendBase
{
// 博客前台为公开页面，不做强制登录拦截
protected $noNeedLogin = ['*'];
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
public function _initialize()
@@ -67,5 +67,30 @@ class BlogFrontend extends FrontendBase
// 主题色：后台「基本设置」可配置，默认 #2d6cdf
'theme_color' => \think\facade\Config::get('site.theme_color', '#2d6cdf'),
]);
// 访客统计写入（blog_visit 原先只有读、没有写，导致统计页恒空）
$this->recordVisit();
}
/**
* 记录一次访问：同一访客同一 URL 30 分钟内只记一次
*/
private function recordVisit(): void
{
$url = $this->request->url(true);
$key = 'blog_visit:' . md5((string) $this->request->ip() . '|' . $url);
if (\think\facade\Cache::get($key)) {
return;
}
// 签名：record($url, $referer = '', $userAgent = '')，IP 由模型内部 getClientIp() 获取
\addon\blog\model\BlogVisit::record(
$url,
(string) $this->request->server('HTTP_REFERER', ''),
(string) $this->request->header('user-agent', '')
);
\think\facade\Cache::set($key, 1, 1800);
}
}
addon/blog/controller/Comment.php
+51 -7
View File
@@ -40,6 +40,12 @@ class Comment extends BlogFrontend
}
$uid = $this->auth->model->uid;
// 限流：同一用户 N 秒内只能发一条，防灌水/刷屏（0 = 不限）
$interval = max(0, (int) config('blog.comment_interval', 10));
if ($interval > 0 && \think\facade\Cache::get('blog_comment_lock:' . $uid)) {
return json(['code' => 0, 'msg' => '评论太频繁，请稍后再试']);
}
$data = Request::post();
$validate = new \think\Validate([
@@ -52,9 +58,14 @@ class Comment extends BlogFrontend
return json(['code' => 0, 'msg' => $validate->getError()]);
}
$article = ArticleModel::find($data['article_id']);
// 只能给「已发布 + 审核通过」的文章评论：
// 否则草稿/待审/驳回文章会成为垃圾评论入口，也泄露未公开内容
$article = ArticleModel::where('id', $data['article_id'])
->where('status', 1)
->where('audit_status', 2)
->find();
if (!$article) {
return json(['code' => 0, 'msg' => '文章不存在']);
return json(['code' => 0, 'msg' => '文章不存在或不可评论']);
}
if ($data['parent_id'] > 0) {
@@ -64,21 +75,32 @@ class Comment extends BlogFrontend
}
}
// 先做 HTML 白名单净化（防 XSS），再做敏感词替换
$content = \addon\blog\library\HtmlSanitizer::clean((string) $data['content']);
$sensitiveWords = ['垃圾', '广告', '违法', '政治'];
$content = str_replace($sensitiveWords, '***', $data['content']);
$content = str_replace($sensitiveWords, '***', $content);
$comment = new CommentModel();
$comment->uid = $uid;
$comment->aid = $data['article_id'];
$comment->pid = $data['parent_id'] ?? 0;
$comment->content = $content;
$comment->status = 1;
// 评论审核：need_audit 开启时先审后发（0=待审核，见 install.sql 注释），否则直接显示
$needAudit = (int) config('blog.need_audit');
$comment->status = $needAudit ? 0 : 1;
$comment->ip = Request::ip();
$comment->user_agent = Request::server('HTTP_USER_AGENT');
$comment->save();
$article->comment_count = Db::raw('comment_count + 1');
$article->save();
// 只有直接显示的评论才计数；待审核的等后台审核通过后再累加
if (!$needAudit) {
$article->comment_count = Db::raw('comment_count + 1');
$article->save();
}
if ($interval > 0) {
\think\facade\Cache::set('blog_comment_lock:' . $uid, 1, $interval);
}
return json([
'code' => 1,
@@ -87,6 +109,13 @@ class Comment extends BlogFrontend
'id' => $comment->id,
'content' => $comment->content,
'create_at' => $comment->create_text,
// 前端渲染取 d.user.*，键名必须一致（原先返回 member，导致新评论显示 undefined）
'user' => [
'uid' => $uid,
'nickname' => $this->auth->model->nickname,
'avatar' => $this->auth->model->avatar ?? '/static/images/avatar.png'
],
// 保留 member 兼容旧前端
'member' => [
'uid' => $uid,
'nickname' => $this->auth->model->nickname,
@@ -116,17 +145,32 @@ class Comment extends BlogFrontend
return json(['code' => 0, 'msg' => '无权限操作']);
}
// 先统计将被删除的条数（含子评论），避免计数漂移（原先固定 -1）
$deletedCount = $this->countWithChildren((int) $id);
$this->deleteCommentWithChildren($id);
$article = ArticleModel::find($comment->aid);
if ($article) {
$article->comment_count = Db::raw('comment_count - 1');
$article->comment_count = Db::raw('comment_count - ' . max(1, $deletedCount));
$article->save();
}
return json(['code' => 1, 'msg' => '评论已删除']);
}
/**
* 递归统计评论及其子评论的条数
*/
private function countWithChildren(int $id): int
{
$count = 1;
$childIds = CommentModel::where('pid', $id)->column('id');
foreach ($childIds as $childId) {
$count += $this->countWithChildren((int) $childId);
}
return $count;
}
/**
* 递归删除评论及其子评论
*/
addon/blog/controller/Index.php
+11 -2
View File
@@ -54,8 +54,12 @@ class Index extends BlogFrontend
}
if (empty($data) || $articlesEmpty) {
// 获取最新文章
// 必须同时为「审核通过」，否则待审/驳回文章会被后台批量发布推到前台
// 列表排除正文（longtext），字段由 listFields() 动态生成（避开 bind + field 的坑）
$articles = ArticleModel::with(['user', 'category', 'tags'])
->field(ArticleModel::listFields())
->where('status', 1)
->where('audit_status', 2)
->order('create_at', 'desc')
->limit(10)
->select();
@@ -137,15 +141,18 @@ class Index extends BlogFrontend
$category = CategoryModel::find($id);
if (! $category) {
return $this->result->error('分类不存在');
// 软 404 会被搜索引擎收录：显式返回 HTTP 404
return $this->result->setStatusCode(404)->error('分类不存在', 404);
}
$page = Request::param('page', 1);
$pageSize = 10;
$articles = ArticleModel::with(['user', 'tags'])
->field(ArticleModel::listFields())
->where('cid', $id)
->where('status', 1)
->where('audit_status', 2)
->order('create_at', 'desc')
->paginate([
'list_rows' => $pageSize,
@@ -173,7 +180,8 @@ class Index extends BlogFrontend
$tag = TagModel::find($id);
if (! $tag) {
return $this->result->error('标签不存在');
// 软 404 会被搜索引擎收录：显式返回 HTTP 404
return $this->result->setStatusCode(404)->error('标签不存在', 404);
}
$page = Request::param('page', 1);
@@ -182,6 +190,7 @@ class Index extends BlogFrontend
$articles = $tag->articles()
->with(['user', 'category'])
->where('status', 1)
->where('audit_status', 2)
->order('create_at', 'desc')
->paginate([
'list_rows' => $pageSize,
addon/blog/controller/Interaction.php
+2 -1
View File
@@ -100,7 +100,8 @@ class Interaction extends FrontendBase
if ($favorite) {
$favorite->delete();
$article->favorite_count = max(0, $favorite->favorite_count - 1);
// 注意：取文章的收藏数（$favorite 是收藏记录模型，没有 favorite_count 列）
$article->favorite_count = max(0, (int) $article->favorite_count - 1);
$action = 'cancel';
} else {
$favorite = new FavoriteModel();
addon/blog/controller/Rss.php
+6 -2
View File
@@ -12,6 +12,7 @@ namespace addon\blog\controller;
use ywxapp\controller\FrontendBase;
use addon\blog\model\BlogArticle as ArticleModel;
use think\facade\Config;
use think\facade\Request;
use think\facade\Response;
use think\facade\View;
@@ -32,7 +33,7 @@ class Rss extends FrontendBase
* Summary of needRight
* @var array
*/
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
/**
* 控制器初始化 _initialize
@@ -50,8 +51,10 @@ class Rss extends FrontendBase
$page = Request::param('page', 1);
$pageSize = 20;
// RSS 同样只输出「已发布 + 审核通过」的文章
$articles = ArticleModel::with(['user', 'category'])
->where('status', 1)
->where('audit_status', 2)
->order('create_at', 'desc')
->page($page, $pageSize)
->select();
@@ -104,7 +107,8 @@ class Rss extends FrontendBase
public function reader()
{
$siteName = Config::get('site.name', 'TP-Blog');
$rssUrl = Config::get('site.url', 'http://localhost') . '/rss';
// 注意：必须带插件前缀 /blog，否则指向站点根的 /rss（不存在）
$rssUrl = Config::get('site.url', 'http://localhost') . (string) url('blog/rss/index');
return View::fetch('index/rss/reader', [
'siteName' => $siteName,
addon/blog/controller/Sitemap.php
+151
View File
@@ -0,0 +1,151 @@
<?php
// +----------------------------------------------------------------------
// | YwxApp [ WE CAN DO IT JUST THINK ]
// +----------------------------------------------------------------------
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
// +----------------------------------------------------------------------
// | Author: ywxapp<admin@ywxapp.cn>
// +----------------------------------------------------------------------
declare (strict_types = 1);
namespace addon\blog\controller;
use addon\blog\model\BlogArticle;
use addon\blog\model\BlogCategory;
use think\facade\Request;
use ywxapp\controller\FrontendBase;
/**
* 站点地图（前台 SEO 用）
*
* 收录范围：首页 / 分类 / 已发布且审核通过的文章（草稿、待审、驳回均不收录）
*
* 文章 ≤ 5000：sitemap.xml 直接输出 urlset
* 文章 > 5000：sitemap.xml 输出 sitemap index，文章拆到 sitemap-<n>.xml
*/
class Sitemap extends FrontendBase
{
/** 单个 sitemap 文件最多 URL 数 */
const MAX_PER_FILE = 5000;
public function index()
{
$base = Request::domain();
$total = $this->query()->count();
$static = [
['loc' => $base . (string) url('blog/index/index'), 'priority' => '1.0', 'lastmod' => date('Y-m-d')],
];
foreach (BlogCategory::where('status', 1)->select() as $c) {
$static[] = [
'loc' => $base . (string) url('blog/index/category', ['id' => $c->id]),
'priority' => '0.6',
];
}
if ($total > self::MAX_PER_FILE) {
$pages = (int) ceil($total / self::MAX_PER_FILE);
$maps = $static;
for ($i = 1; $i <= $pages; $i++) {
// 分片 URL 必须手工拼接：url() 会追加 .html 后缀，不能用于 .xml
$maps[] = [
'loc' => $base . '/blog/sitemap-' . $i . '.xml',
'lastmod' => date('Y-m-d'),
'priority' => '0.8',
];
}
return response(self::renderIndex($maps), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
}
$items = $static;
foreach ($this->query()->field('id,update_at')->order('create_at', 'desc')->select() as $a) {
$items[] = [
'loc' => $base . (string) url('blog/article/detail', ['id' => $a->id]),
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
'priority' => '0.8',
];
}
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
}
/**
* 文章分片：/blog/sitemap-<page>.xml
*/
public function chunk($page = 1)
{
$page = max(1, (int) $page);
$base = Request::domain();
$total = $this->query()->count();
$pages = max(1, (int) ceil($total / self::MAX_PER_FILE));
if ($page > $pages) {
return response(self::renderUrlset([]), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
}
$articles = $this->query()
->field('id,update_at')
->order('create_at', 'desc')
->page($page, self::MAX_PER_FILE)
->select();
$items = [];
foreach ($articles as $a) {
$items[] = [
'loc' => $base . (string) url('blog/article/detail', ['id' => $a->id]),
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
'priority' => '0.8',
];
}
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
}
/**
* 对外可见文章的查询条件：已发布 + 审核通过 + 未删除
*/
private function query()
{
return BlogArticle::where('status', 1)->where('audit_status', 2);
}
private static function renderUrlset(array $items): string
{
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
. '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
foreach ($items as $item) {
$xml .= " <url>\n";
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
if (!empty($item['lastmod'])) {
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
}
$xml .= ' <priority>' . ($item['priority'] ?? '0.5') . "</priority>\n";
$xml .= " </url>\n";
}
return $xml . '</urlset>';
}
private static function renderIndex(array $items): string
{
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
. '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
foreach ($items as $item) {
$xml .= " <sitemap>\n";
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
if (!empty($item['lastmod'])) {
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
}
$xml .= " </sitemap>\n";
}
return $xml . '</sitemapindex>';
}
private static function esc(string $value): string
{
return htmlspecialchars($value, ENT_XML1 | ENT_QUOTES, 'UTF-8');
}
}
addon/blog/controller/backend/Article.php
+3 -3
View File
@@ -26,7 +26,7 @@ use ywxapp\controller\BackendBase;
class Article extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
@@ -108,7 +108,7 @@ class Article extends BackendBase
{
$article = ArticleModel::with(['tags'])->find($id);
if (! $article) {
return redirect('/blog/backend/article');
return redirect((string) url('blog/backend/article'));
}
$categories = CategoryModel::where('status', 1)->select();
@@ -170,7 +170,7 @@ class Article extends BackendBase
$article->tags()->sync($tagIds);
\addon\blog\service\BlogSearchService::sync($article->id);
return json(['code' => 1, 'msg' => '文章更新成功', 'url' => '/blog/backend/article']);
return json(['code' => 1, 'msg' => '文章更新成功', 'url' => (string) url('blog/backend/article')]);
}
/**
addon/blog/controller/backend/Category.php
+3 -3
View File
@@ -24,7 +24,7 @@ use ywxapp\controller\BackendBase;
class Category extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
@@ -111,7 +111,7 @@ class Category extends BackendBase
}
CategoryModel::create($data);
return json(['code' => 1, 'msg' => '分类添加成功', 'url' => '/blog/backend/category']);
return json(['code' => 1, 'msg' => '分类添加成功', 'url' => (string) url('blog/backend/category')]);
}
/**
@@ -153,7 +153,7 @@ class Category extends BackendBase
}
$category->save($data);
return json(['code' => 1, 'msg' => '分类更新成功', 'url' => '/blog/backend/category']);
return json(['code' => 1, 'msg' => '分类更新成功', 'url' => (string) url('blog/backend/category')]);
}
/**
addon/blog/controller/backend/Comment.php
+1 -1
View File
@@ -25,7 +25,7 @@ use ywxapp\controller\BackendBase;
class Comment extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
addon/blog/controller/backend/Dashboard.php
+1 -1
View File
@@ -26,7 +26,7 @@ use ywxapp\controller\BackendBase;
class Dashboard extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
addon/blog/controller/backend/Index.php
+1 -1
View File
@@ -22,7 +22,7 @@ use ywxapp\controller\BackendBase;
class Index extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
addon/blog/controller/backend/Setting.php
+64 -14
View File
@@ -32,7 +32,7 @@ class Setting extends BackendBase
* Summary of needRight
* @var array
*/
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
/**
* 控制器初始化 _initialize
@@ -46,10 +46,11 @@ class Setting extends BackendBase
*/
public function index()
{
// 配置改存统一插件配置表（不再读写 PHP 配置文件，避免任意代码写入）
$settings = [
'site' => Config::get('site'),
'seo' => Config::get('seo'),
'email' => Config::get('email'),
'site' => $this->getConfig('site'),
'seo' => $this->getConfig('seo'),
'email' => $this->getConfig('email'),
'upload' => Config::get('upload')
];
@@ -67,7 +68,7 @@ class Setting extends BackendBase
return json(['code' => 1, 'msg' => '基本设置已保存']);
}
$settings = Config::get('site');
$settings = $this->getConfig('site');
return View::fetch('setting/site', ['settings' => $settings]);
}
@@ -82,7 +83,7 @@ class Setting extends BackendBase
return json(['code' => 1, 'msg' => 'SEO设置已保存']);
}
$settings = Config::get('seo');
$settings = $this->getConfig('seo');
return View::fetch('setting/seo', ['settings' => $settings]);
}
@@ -97,21 +98,70 @@ class Setting extends BackendBase
return json(['code' => 1, 'msg' => '邮件设置已保存']);
}
$settings = Config::get('email');
$settings = $this->getConfig('email');
return View::fetch('setting/email', ['settings' => $settings]);
}
/**
* 保存配置
*/
/**
* 保存配置到统一插件配置表
*
* 之前的实现把 Request::post() 整个 var_export 写进 config/*.php，
* 等于允许任意 PHP 代码写入（RCE），且 app_path() 在插件上下文指向不存在的目录
* （写入静默失败）。改为走 AddonService::config() 存库。
*/
private function saveConfig($key, $data)
{
$configFile = app_path() . 'config/' . $key . '.php';
$content = "<?php\nreturn " . var_export($data, true) . ";\n";
file_put_contents($configFile, $content);
// 清除配置缓存
Config::set([], $key);
Cache::delete('config_' . $key);
// 分组白名单
if (!in_array($key, ['site', 'seo', 'email'], true)) {
return;
}
// 只接受标量值，键名做安全校验（防注入与数组嵌套）
$clean = [];
foreach ((array) $data as $k => $v) {
$k = (string) $k;
if (!preg_match('/^[a-zA-Z0-9_]+$/', $k)) {
continue;
}
if (is_scalar($v)) {
$clean[$k] = (string) $v;
} elseif (is_array($v)) {
$clean[$k] = json_encode($v, JSON_UNESCAPED_UNICODE);
}
}
if (empty($clean)) {
return;
}
// 以 "<分组>.<字段>" 形式存到插件配置表
$prefixed = [];
foreach ($clean as $k => $v) {
$prefixed[$key . '.' . $k] = $v;
}
\ywxapp\service\AddonService::config('blog', $prefixed);
\ywxapp\service\AddonService::clearConfigCache('blog');
}
/**
* 读取某分组的配置（从插件配置表还原为不带前缀的数组）
*/
private function getConfig($key)
{
$all = \ywxapp\service\AddonService::config('blog');
$prefix = $key . '.';
$out = [];
foreach ((array) $all as $k => $v) {
if (strpos((string) $k, $prefix) === 0) {
$out[substr((string) $k, strlen($prefix))] = $v;
}
}
return $out;
}
}
addon/blog/controller/backend/Stat.php
+1 -1
View File
@@ -27,7 +27,7 @@ use ywxapp\controller\BackendBase;
class Stat extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
addon/blog/controller/backend/Tag.php
+3 -3
View File
@@ -24,7 +24,7 @@ use think\Validate;
class Tag extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
@@ -94,7 +94,7 @@ class Tag extends BackendBase
}
TagModel::create($data);
return json(['code' => 1, 'msg' => '标签添加成功', 'url' => '/blog/backend/tag']);
return json(['code' => 1, 'msg' => '标签添加成功', 'url' => (string) url('blog/backend/tag')]);
}
/**
@@ -129,7 +129,7 @@ class Tag extends BackendBase
}
$tag->save($data);
return json(['code' => 1, 'msg' => '标签更新成功', 'url' => '/blog/backend/tag']);
return json(['code' => 1, 'msg' => '标签更新成功', 'url' => (string) url('blog/backend/tag')]);
}
/**
addon/blog/controller/backend/User.php
+5 -4
View File
@@ -21,10 +21,11 @@ use ywxapp\controller\BackendBase;
*
* @author ywxapp <admin@ywxapp.cn>
*/
class Member extends BackendBase
// 文件名是 User.php，类名必须一致（PSR-4），否则路由 backend.User/index 找不到类
class User extends BackendBase
{
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()
@@ -102,7 +103,7 @@ class Member extends BackendBase
{
$user = UserModel::find($id);
if (! $user) {
return redirect('/blog/backend/user');
return redirect((string) url('blog/backend/user'));
}
return View::fetch('user/edit', ['member' => $user]);
@@ -126,7 +127,7 @@ class Member extends BackendBase
$user->update_at = time();
$user->save();
return json(['code' => 1, 'msg' => '用户更新成功', 'url' => '/blog/backend/user']);
return json(['code' => 1, 'msg' => '用户更新成功', 'url' => (string) url('blog/backend/user')]);
}
/**
addon/blog/controller/member/Article.php
+15 -18
View File
@@ -26,7 +26,7 @@ use ywxapp\controller\MemberBase;
class Article extends MemberBase
{
protected $noNeedLogin = [];
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
// 当前登录会员 id（文章作者）；会员主键为 uid，需从模型取 uid
@@ -78,7 +78,7 @@ class Article extends MemberBase
$ts = strtotime((string) $t);
return $ts !== false ? date('Y-m-d H:i', $ts) : (string) $t;
})($a->create_at),
'detail_url' => (string) url('index/article/detail', ['id' => $a->id]),
'detail_url' => (string) url('blog/article/detail', ['id' => $a->id]),
'edit_url' => (string) url('blog/member.article/edit', ['id' => $a->id]),
];
}
@@ -133,20 +133,17 @@ class Article extends MemberBase
$tagIds = $this->parseTags(Request::post('tags'));
// 内容审核：开启 need_audit 时进入审核流（机审 + 人工复核）
// 内容审核：开启 need_audit 时进入人工审核队列
//
// 注意：这里原先调用 \addon\wxchat\service\AiAuditService::audit()，
// 但那是 wxchat 的「实名认证」服务（消费 real_name / id_card / 证件照），
// 与文章内容审核无关，且它是 static::audit(array)，此处还用实例调用了它——
// 结果就是开启审核后会员发文必然异常。现改为一律转人工复核。
$needAudit = (int) config('blog.need_audit');
$auditStatus = 2; // 默认通过（2=通过）
$auditStatus = 2; // 2=通过
$auditReason = '';
if ($needAudit) {
$ai = new \addon\wxchat\service\AiAuditService();
$res = $ai->audit(($data['title'] ?? '') . "\n" . ($data['content'] ?? ''));
if ($res['code'] === 0 && !empty($res['data']['blocked'])) {
$auditStatus = 3; // 机审命中违规：直接驳回
$auditReason = '机审不通过：' . ($res['data']['reason'] ?? '内容违规');
} elseif ($res['code'] === 0) {
$auditStatus = 1; // 机审通过：进入待审，等待人工复核
}
// AI 服务不可用：维持待审，转人工队列
$auditStatus = 1; // 1=待审，等待后台人工复核
}
$data['status'] = ($auditStatus === 2) ? 1 : 0; // 仅通过态对外可见
$data['audit_status'] = $auditStatus;
@@ -157,12 +154,12 @@ class Article extends MemberBase
\addon\blog\service\BlogSearchService::sync($article->id);
if ($auditStatus === 3) {
return json(['code' => 0, 'msg' => $auditReason, 'url' => '/blog/member/article']);
return json(['code' => 0, 'msg' => $auditReason, 'url' => (string) url('blog/member/article')]);
}
if ($needAudit && $auditStatus === 1) {
return json(['code' => 1, 'msg' => '发布成功，等待审核', 'url' => '/blog/member/article']);
return json(['code' => 1, 'msg' => '发布成功，等待审核', 'url' => (string) url('blog/member/article')]);
}
return json(['code' => 1, 'msg' => '文章发布成功', 'url' => '/blog/member/article']);
return json(['code' => 1, 'msg' => '文章发布成功', 'url' => (string) url('blog/member/article')]);
}
/**
@@ -175,7 +172,7 @@ class Article extends MemberBase
->where('uid', $this->uid())
->find();
if (! $article) {
return redirect('/blog/member/article');
return redirect((string) url('blog/member/article'));
}
$categories = CategoryModel::getAvailable($this->uid());
@@ -221,7 +218,7 @@ class Article extends MemberBase
$article->tags()->sync($tagIds);
\addon\blog\service\BlogSearchService::sync($article->id);
return json(['code' => 1, 'msg' => '文章更新成功', 'url' => '/blog/member/article']);
return json(['code' => 1, 'msg' => '文章更新成功', 'url' => (string) url('blog/member/article')]);
}
/**
addon/blog/controller/member/Category.php
+4 -4
View File
@@ -23,7 +23,7 @@ use ywxapp\controller\MemberBase;
class Category extends MemberBase
{
protected $noNeedLogin = [];
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
// 当前登录会员 id（会员主键为 uid）
@@ -100,7 +100,7 @@ class Category extends MemberBase
}
CategoryModel::create($data);
return json(['code' => 1, 'msg' => '分类添加成功', 'url' => '/blog/member/category']);
return json(['code' => 1, 'msg' => '分类添加成功', 'url' => (string) url('blog/member/category')]);
}
/**
@@ -112,7 +112,7 @@ class Category extends MemberBase
->where('uid', $this->uid())
->find();
if (! $category) {
return redirect('/blog/member/category');
return redirect((string) url('blog/member/category'));
}
$categories = CategoryModel::where(function ($query) {
@@ -151,7 +151,7 @@ class Category extends MemberBase
}
$category->save($data);
return json(['code' => 1, 'msg' => '分类更新成功', 'url' => '/blog/member/category']);
return json(['code' => 1, 'msg' => '分类更新成功', 'url' => (string) url('blog/member/category')]);
}
/**
addon/blog/controller/member/Index.php
+1 -1
View File
@@ -24,7 +24,7 @@ class Index extends MemberBase
{
// 会员中心强制登录（由 MemberBase 的 verifyAuth 统一校验）
protected $noNeedLogin = [];
protected $noNeedVerify = ['*'];
protected $noNeedVerify = [];
protected function initialize()