feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,137 @@
|
||||
<!--
|
||||
* @Author: YwxApp <ywx@ywxapp.cn>
|
||||
* @Description: 主框架发布/下载展示页（公开，仅中心站）
|
||||
-->
|
||||
<!DOCTYPE html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>主框架下载 - {$market_name}</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<link href="/assets/layui/css/layui.css" rel="stylesheet">
|
||||
<style>
|
||||
:root {
|
||||
--brand: #4f46e5; --brand-2: #7c3aed; --ink: #1f2329;
|
||||
--muted: #8a8f99; --line: #eceef2; --bg: #f5f6fa;
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body {
|
||||
margin: 0; background: var(--bg); color: var(--ink);
|
||||
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", sans-serif;
|
||||
-webkit-font-smoothing: antialiased;
|
||||
}
|
||||
.brandbar {
|
||||
height: 56px; display: flex; align-items: center; gap: 10px;
|
||||
padding: 0 24px; background: #fff; border-bottom: 1px solid var(--line);
|
||||
position: sticky; top: 0; z-index: 20;
|
||||
}
|
||||
.brandbar .logo {
|
||||
width: 30px; height: 30px; border-radius: 8px;
|
||||
background: linear-gradient(135deg, var(--brand), var(--brand-2));
|
||||
display: grid; place-items: center; color: #fff; font-weight: 700;
|
||||
}
|
||||
.brandbar .name { font-weight: 600; font-size: 16px; }
|
||||
.brandbar .nav { margin-left: auto; display: flex; gap: 22px; font-size: 14px; }
|
||||
.brandbar .nav a { color: var(--muted); text-decoration: none; transition: color .2s; }
|
||||
.brandbar .nav a:hover, .brandbar .nav a.on { color: var(--brand); }
|
||||
|
||||
.hero {
|
||||
padding: 54px 24px 46px; text-align: center; color: #fff;
|
||||
background: linear-gradient(135deg, #4f46e5 0%, #7c3aed 55%, #9333ea 100%);
|
||||
position: relative; overflow: hidden;
|
||||
}
|
||||
.hero::after {
|
||||
content: ""; position: absolute; inset: 0;
|
||||
background:
|
||||
radial-gradient(420px 220px at 12% 0%, rgba(255,255,255,.18), transparent 60%),
|
||||
radial-gradient(380px 200px at 88% 100%, rgba(255,255,255,.12), transparent 60%);
|
||||
}
|
||||
.hero h1 { margin: 0 0 10px; font-size: 32px; position: relative; }
|
||||
.hero p { margin: 0; opacity: .92; font-size: 15px; position: relative; }
|
||||
|
||||
.wrap { max-width: 960px; margin: 36px auto 60px; padding: 0 24px; }
|
||||
.ver-card {
|
||||
background: #fff; border: 1px solid var(--line); border-radius: 16px;
|
||||
padding: 22px 26px; margin-bottom: 18px;
|
||||
transition: transform .22s, box-shadow .22s, border-color .22s;
|
||||
}
|
||||
.ver-card:hover { transform: translateY(-4px); box-shadow: 0 16px 36px rgba(79,70,229,.14); border-color: transparent; }
|
||||
.ver-top { display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 8px; }
|
||||
.ver-title { font-size: 20px; font-weight: 600; }
|
||||
.ver-title .v { color: #16a34a; }
|
||||
.ver-date { color: var(--muted); font-size: 13px; }
|
||||
.ver-sub { color: #6b7280; font-size: 14px; margin: 10px 0 14px; }
|
||||
.ver-sub b { color: var(--ink); }
|
||||
.ver-log {
|
||||
background: #f7f8fa; border: 1px solid var(--line); border-radius: 10px;
|
||||
padding: 12px 14px; font-size: 13px; color: #555; white-space: pre-wrap;
|
||||
margin-bottom: 16px; max-height: 160px; overflow: auto;
|
||||
}
|
||||
.dl-btns { display: flex; gap: 10px; flex-wrap: wrap; }
|
||||
.dl-btns a {
|
||||
text-decoration: none; font-size: 13px; color: #fff; padding: 9px 16px; border-radius: 9px;
|
||||
background: linear-gradient(135deg, var(--brand), var(--brand-2)); transition: opacity .2s, transform .1s;
|
||||
}
|
||||
.dl-btns a:hover { opacity: .9; }
|
||||
.dl-btns a:active { transform: scale(.97); }
|
||||
.dl-btns a.install { background: linear-gradient(135deg, #722ed1, #9254de); }
|
||||
.empty { text-align: center; color: var(--muted); padding: 60px 0; }
|
||||
footer { text-align: center; color: var(--muted); font-size: 12px; padding: 26px; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="brandbar">
|
||||
<div class="logo">Y</div>
|
||||
<div class="name">{$market_name}</div>
|
||||
<div class="nav">
|
||||
<a href="{:url('store/index')}">应用市场</a>
|
||||
<a href="{:url('framework/index')}" class="on">主框架</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="hero">
|
||||
<h1>YwxApp 主框架下载</h1>
|
||||
<p>完整安装包用于全新部署，整包 / 补丁用于已安装站点的在线升级。</p>
|
||||
</div>
|
||||
|
||||
<div class="wrap">
|
||||
{if empty($list)}
|
||||
<div class="empty">暂未发布任何框架版本。</div>
|
||||
{else}
|
||||
{foreach $list as $item}
|
||||
<div class="ver-card">
|
||||
<div class="ver-top">
|
||||
<div class="ver-title">{$item.title|default='主框架'} <span class="v">v{$item.version}</span></div>
|
||||
<div class="ver-date">发布于 {$item.create_at_fmt} · 下载 {$item.download_count} 次</div>
|
||||
</div>
|
||||
{if $item.patch_from}
|
||||
<div class="ver-sub">增量补丁适用基础版本：<b>{$item.patch_from}</b></div>
|
||||
{/if}
|
||||
{if $item.changelog}
|
||||
<div class="ver-log">{$item.changelog}</div>
|
||||
{/if}
|
||||
<div class="dl-btns">
|
||||
{if $item.has_full}
|
||||
<a href="/appmall/api/framework/download?version={$item.version}&type=full">
|
||||
<i class="layui-icon layui-icon-download-circle"></i> 下载整包（升级）
|
||||
</a>
|
||||
{/if}
|
||||
{if $item.has_patch}
|
||||
<a href="/appmall/api/framework/download?version={$item.version}&type=patch">
|
||||
<i class="layui-icon layui-icon-download-circle"></i> 下载补丁（升级）
|
||||
</a>
|
||||
{/if}
|
||||
{if $item.has_install}
|
||||
<a class="install" href="/appmall/api/framework/download?version={$item.version}&type=install">
|
||||
<i class="layui-icon layui-icon-download-circle"></i> 下载完整安装包（全新部署）
|
||||
</a>
|
||||
{/if}
|
||||
</div>
|
||||
</div>
|
||||
{/foreach}
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
<footer>© {:date('Y')} {$market_name} · 由 YwxApp 框架强力驱动</footer>
|
||||
</body>
|
||||
</html>
|
||||
Reference in new issue
Block a user