YwxApp/YwxAppThink
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用

Browse Source 
安全（P0）
- 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签
  （ywxapp.framework_package_verify，默认开启）
- JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive
- 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php）
- 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed 2026-10-22 00:53:39 +08:00
1 parent 1d49e6f5ee
commit 18101cf11a
636 files changed
+58517 -9519
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

addon/docs/controller/backend/Doc.php
+71 -11
View File
@@ -206,10 +206,17 @@ class Doc extends BackendBase
$ids = $this->descendantIds((int) $doc->id);
$ids[] = (int) $doc->id;
foreach ($ids as $docId) {
DocSearchService::remove((int) $docId);
// 事务化：文档表 + 搜索索引，任何一步失败回滚
try {
Db::transaction(function () use ($ids) {
foreach ($ids as $docId) {
DocSearchService::remove((int) $docId);
}
DocsDoc::whereIn('id', $ids)->delete();
});
} catch (\Throwable $e) {
return $this->result->error('删除失败：' . $e->getMessage());
}
DocsDoc::whereIn('id', $ids)->delete();
DocTreeService::clearCache();
return $this->result->success(null, '删除成功，共移除 ' . count($ids) . ' 篇');
@@ -217,6 +224,11 @@ class Doc extends BackendBase
/**
* 拖拽排序：接收有序的 id 数组与父级关系
*
* 安全要点：
* 1. 校验节点归属（project/version），防止前端把任意文档塞进别人的树
* 2. 禁止自身成环（pid = self 或 pid 命中后代），避免树渲染栈溢出
* 3. 操作整体事务：中间失败回滚
*/
public function sort()
{
@@ -227,15 +239,55 @@ class Doc extends BackendBase
return $this->result->error('排序数据为空');
}
foreach ($nodes as $index => $node) {
$docId = (int) ($node['id'] ?? 0);
if ($docId <= 0) {
continue;
// 取第一个有效节点的项目/版本作为作用域（前端应保证 nodes 同源）
$first = null;
foreach ($nodes as $n) {
if ((int) ($n['id'] ?? 0) > 0) {
$first = DocsDoc::find((int) $n['id']);
if ($first) {
break;
}
}
DocsDoc::where('id', $docId)->update([
'pid' => (int) ($node['pid'] ?? 0),
'sort' => (int) ($node['sort'] ?? $index),
]);
}
if (!$first) {
return $this->result->error('排序数据无效，找不到对应文档');
}
$projectId = (int) $first->project_id;
$versionId = (int) $first->version_id;
try {
Db::transaction(function () use ($nodes, $projectId, $versionId) {
foreach ($nodes as $index => $node) {
$docId = (int) ($node['id'] ?? 0);
if ($docId <= 0) {
continue;
}
$doc = DocsDoc::where('id', $docId)
->where('project_id', $projectId)
->where('version_id', $versionId)
->find();
if (!$doc) {
throw new \RuntimeException('文档 #' . $docId . ' 不在指定项目/版本范围内');
}
$newPid = (int) ($node['pid'] ?? 0);
if ($newPid === $docId) {
throw new \RuntimeException('文档 #' . $docId . ' 不能把自己设为父级');
}
if ($newPid > 0 && $this->isDescendant($docId, $newPid)) {
throw new \RuntimeException('文档 #' . $docId . ' 的新父级属于其后代，会形成环');
}
DocsDoc::where('id', $docId)->update([
'pid' => $newPid,
'sort' => (int) ($node['sort'] ?? $index),
]);
}
});
} catch (\Throwable $e) {
return $this->result->error($e->getMessage());
}
DocTreeService::clearCache();
@@ -273,6 +325,14 @@ class Doc extends BackendBase
return $this->result->error('请选择目标项目与版本');
}
// 校验：version_id 必须属于 project_id，防止前端篡改导入到无关项目
$version = DocsVersion::where('id', $versionId)
->where('project_id', $projectId)
->find();
if (!$version) {
return $this->result->error('所选版本不属于该项目');
}
$file = $this->request->file('file');
if (!$file) {
return $this->result->error('请选择要导入的文件');
addon/docs/controller/backend/Project.php
+15 -7
View File
@@ -15,6 +15,7 @@ use addon\docs\model\DocsProject;
use addon\docs\model\DocsVersion;
use addon\docs\service\DocSearchService;
use addon\docs\service\DocTreeService;
use think\facade\Db;
use ywxapp\controller\BackendBase;
/**
@@ -149,14 +150,21 @@ class Project extends BackendBase
return $this->result->error('项目不存在');
}
$docIds = DocsDoc::where('project_id', $id)->column('id');
foreach ($docIds as $docId) {
DocSearchService::remove((int) $docId);
}
// 事务化级联：项目 / 版本 / 文档 / 搜索索引，任何一步失败整体回滚
try {
Db::transaction(function () use ($id) {
$docIds = DocsDoc::where('project_id', $id)->column('id');
foreach ($docIds as $docId) {
DocSearchService::remove((int) $docId);
}
DocsDoc::where('project_id', $id)->delete();
DocsVersion::where('project_id', $id)->delete();
$project->delete();
DocsDoc::where('project_id', $id)->delete();
DocsVersion::where('project_id', $id)->delete();
DocsProject::where('id', $id)->delete();
});
} catch (\Throwable $e) {
return $this->result->error('删除失败：' . $e->getMessage());
}
DocTreeService::clearCache();
return $this->result->success(null, '删除成功');
addon/docs/controller/backend/Version.php
+14 -6
View File
@@ -15,6 +15,7 @@ use addon\docs\model\DocsProject;
use addon\docs\model\DocsVersion;
use addon\docs\service\DocSearchService;
use addon\docs\service\DocTreeService;
use think\facade\Db;
use ywxapp\controller\BackendBase;
/**
@@ -156,13 +157,20 @@ class Version extends BackendBase
return $this->result->error('该项目仅剩一个版本，不能删除');
}
$docIds = DocsDoc::where('version_id', $id)->column('id');
foreach ($docIds as $docId) {
DocSearchService::remove((int) $docId);
}
// 事务化级联：版本 / 文档 / 搜索索引
try {
Db::transaction(function () use ($id, $version) {
$docIds = DocsDoc::where('version_id', $id)->column('id');
foreach ($docIds as $docId) {
DocSearchService::remove((int) $docId);
}
DocsDoc::where('version_id', $id)->delete();
$version->delete();
DocsDoc::where('version_id', $id)->delete();
DocsVersion::where('id', $id)->delete();
});
} catch (\Throwable $e) {
return $this->result->error('删除失败：' . $e->getMessage());
}
DocTreeService::clearCache();
return $this->result->success(null, '删除成功');