feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -8,6 +8,7 @@ use think\db\exception\DbException;
|
||||
use think\exception\ValidateException;
|
||||
use ywxapp\controller\BackendBase;
|
||||
use ywxapp\model\MebmberScore as ScoreModel;
|
||||
use ywxapp\service\ScoreService;
|
||||
use app\backend\validate\Score as ScoreValidate;
|
||||
|
||||
/**
|
||||
@@ -22,40 +23,83 @@ class Score extends BackendBase
|
||||
{
|
||||
$this->model = new ScoreModel();
|
||||
// 触发 score_rule / score_log 自愈
|
||||
ScoreModel::ensureSchema();
|
||||
ScoreModel::ensureSchema();
|
||||
}
|
||||
|
||||
// ============ 积分规则 ============
|
||||
public function index()
|
||||
{
|
||||
$page = $this->request->param('page/d', 1);
|
||||
$limit = $this->request->param('limit/d', 15);
|
||||
$name = $this->request->param('name', '');
|
||||
$page = $this->request->param('page/d', 1);
|
||||
$limit = $this->request->param('limit/d', 15);
|
||||
$title = $this->request->param('title', '');
|
||||
$action = $this->request->param('action', '');
|
||||
|
||||
if ($this->request->isAjax()) {
|
||||
$query = $this->model->newQuery();
|
||||
if ($name !== '') {
|
||||
$query->where('name', 'like', '%' . $name . '%');
|
||||
if ($title !== '') {
|
||||
$query->where('title', 'like', '%' . $title . '%');
|
||||
}
|
||||
if ($action !== '') {
|
||||
$query->where('action', $action);
|
||||
}
|
||||
$list = $query->order('sort', 'desc')
|
||||
->paginate(['page' => $page, 'list_rows' => $limit]);
|
||||
$typeList = ScoreModel::typeList();
|
||||
$typeList = ScoreModel::typeList();
|
||||
$limitTypeList = ScoreService::limitTypeList();
|
||||
$items = $list->items();
|
||||
foreach ($items as &$item) {
|
||||
$item['type_text'] = $typeList[$item['type']] ?? '-';
|
||||
$item['type_text'] = $typeList[$item['type']] ?? '-';
|
||||
$item['limit_text'] = self::limitText($item, $limitTypeList);
|
||||
$item['addon_text'] = empty($item['addon']) ? '核心' : $item['addon'];
|
||||
}
|
||||
$this->result->setCount($list->total())->success($items);
|
||||
}
|
||||
$this->assign('typeList', ScoreModel::typeList());
|
||||
$this->assign('limitTypeList', ScoreService::limitTypeList());
|
||||
$this->assign('uniqueTypeList', ScoreService::uniqueTypeList());
|
||||
$this->assign('actionList', ScoreService::actions());
|
||||
return $this->fetch();
|
||||
}
|
||||
|
||||
/**
|
||||
* 可用动作下拉数据（核心预置 + 插件注册 + 规则表已使用）
|
||||
*/
|
||||
public function actions()
|
||||
{
|
||||
$list = ScoreService::actions();
|
||||
$data = [];
|
||||
foreach ($list as $key => $item) {
|
||||
$data[] = [
|
||||
'action' => $key,
|
||||
'title' => $item['title'],
|
||||
'addon' => $item['addon'],
|
||||
];
|
||||
}
|
||||
$this->result->success($data);
|
||||
}
|
||||
|
||||
/**
|
||||
* 限次文案：不限 / 每日 N 次 ...
|
||||
*/
|
||||
protected static function limitText(array $item, array $limitTypeList): string
|
||||
{
|
||||
$type = (int) ($item['limit_type'] ?? 0);
|
||||
$times = (int) ($item['limit_times'] ?? 0);
|
||||
if ($type === 0 || $times <= 0) {
|
||||
return '不限';
|
||||
}
|
||||
return ($limitTypeList[$type] ?? '-') . ' ' . $times . ' 次';
|
||||
}
|
||||
|
||||
public function save()
|
||||
{
|
||||
if (! $this->request->isPost()) {
|
||||
$this->result->error('请求方式错误', 405);
|
||||
}
|
||||
$params = $this->request->only(['name', 'action', 'type', 'value', 'sort', 'status'], 'post');
|
||||
$params = $this->request->only(
|
||||
['title', 'action', 'type', 'value', 'addon', 'limit_type', 'limit_times', 'unique_type', 'remark', 'sort', 'status'],
|
||||
'post'
|
||||
);
|
||||
try {
|
||||
validate(ScoreValidate::class)->check($params);
|
||||
$this->model->create($params);
|
||||
@@ -82,7 +126,10 @@ class Score extends BackendBase
|
||||
if (! ($this->request->isAjax() && $this->request->isPut())) {
|
||||
$this->result->error('请求方式错误', 405);
|
||||
}
|
||||
$params = $this->request->param();
|
||||
$params = $this->request->only(
|
||||
['id', 'title', 'action', 'type', 'value', 'addon', 'limit_type', 'limit_times', 'unique_type', 'remark', 'sort', 'status'],
|
||||
'param'
|
||||
);
|
||||
$id = $params['id'] ?? null;
|
||||
$info = $this->model->find($id);
|
||||
if (! $info) {
|
||||
@@ -170,10 +217,12 @@ class Score extends BackendBase
|
||||
{
|
||||
$page = $this->request->param('page/d', 1);
|
||||
$limit = $this->request->param('limit/d', 15);
|
||||
$uid = $this->request->param('uid/d', 0);
|
||||
$uid = $this->request->param('uid/d', 0);
|
||||
$action = $this->request->param('action', '');
|
||||
$source = $this->request->param('source', '');
|
||||
|
||||
if ($this->request->isAjax()) {
|
||||
$res = ScoreModel::logList($uid, $page, $limit);
|
||||
$res = ScoreModel::logList($uid, $page, $limit, ['action' => $action, 'source' => $source]);
|
||||
$typeList = ScoreModel::typeList();
|
||||
foreach ($res['list'] as &$item) {
|
||||
$item['type_text'] = $item['type'] == 2 ? '支出' : '收入';
|
||||
|
||||
Reference in new issue
Block a user