feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,185 @@
|
||||
<?php
|
||||
/**
|
||||
* 一次性脚本：把本地模板 zip 直接提交到官方市场（type=template）。
|
||||
* 配合 scripts/package_template.php 使用：先打包出 runtime/templates/<name>-<ver>.zip，
|
||||
* 再本脚本 POST 到 /appmall/api/addon/submit（与开发者控制台「提交应用」同一条 submit 链路）。
|
||||
*
|
||||
* 用法：
|
||||
* php scripts/submit_template.php <zip> <token> [api_url] [--title=...] [--price=...] [--category=...]
|
||||
* [--author=...] [--tags=...] [--logo=...] [--description=...] [--changelog=...]
|
||||
* [--require_framework=...] [-k]
|
||||
* - api_url 缺省 https://www.ywxapp.cn（生产）；本地可用 http://localhost:端口
|
||||
* - -k 不校验 SSL（本地自签证书调试用）
|
||||
* - 元数据优先取命令行覆盖项，否则从 zip 内 template.json 读取
|
||||
*
|
||||
* 例：
|
||||
* php scripts/submit_template.php runtime/templates/myblog-1.0.0.zip YOUR_TOKEN
|
||||
* php scripts/submit_template.php runtime/templates/myblog-1.0.0.zip YOUR_TOKEN http://localhost:8080 -k
|
||||
*
|
||||
* 提交接口返回：code=1 成功（读 msg），code=0 失败（读 msg/message）。
|
||||
*/
|
||||
declare(strict_types=1);
|
||||
|
||||
// ===================== 解析参数 =====================
|
||||
$insecure = false;
|
||||
$opts = [
|
||||
'title' => null,
|
||||
'price' => null,
|
||||
'category' => null,
|
||||
'author' => null,
|
||||
'tags' => null,
|
||||
'logo' => null,
|
||||
'description' => null,
|
||||
'changelog' => null,
|
||||
'require_framework' => null,
|
||||
];
|
||||
$pos = [];
|
||||
foreach (array_slice($argv, 1) as $a) {
|
||||
if ($a === '-k') {
|
||||
$insecure = true;
|
||||
continue;
|
||||
}
|
||||
if (strpos($a, '--') === 0 && strpos($a, '=') !== false) {
|
||||
[$k, $v] = explode('=', $a, 2);
|
||||
$k = substr($k, 2);
|
||||
if (array_key_exists($k, $opts)) {
|
||||
$opts[$k] = $v;
|
||||
} else {
|
||||
fwrite(STDERR, "未知选项: --{$k}\n");
|
||||
exit(1);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
$pos[] = $a;
|
||||
}
|
||||
|
||||
$zip = $pos[0] ?? '';
|
||||
$token = $pos[1] ?? '';
|
||||
$apiUrl = $pos[2] ?? 'https://www.ywxapp.cn';
|
||||
|
||||
if ($zip === '' || $token === '') {
|
||||
fwrite(STDERR, "用法: php scripts/submit_template.php <zip> <token> [api_url] [--title=...] ... [-k]\n");
|
||||
exit(1);
|
||||
}
|
||||
$zip = realpath($zip);
|
||||
if (!is_file($zip)) {
|
||||
fwrite(STDERR, "zip 不存在: {$pos[0]}\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
// ===================== 读取 zip 内 template.json =====================
|
||||
if (!class_exists('ZipArchive')) {
|
||||
fwrite(STDERR, "ZipArchive 扩展不可用\n");
|
||||
exit(1);
|
||||
}
|
||||
$z = new ZipArchive();
|
||||
if ($z->open($zip) !== true) {
|
||||
fwrite(STDERR, "无法打开 zip: {$zip}\n");
|
||||
exit(1);
|
||||
}
|
||||
$jsonName = null;
|
||||
for ($i = 0; $i < $z->numFiles; $i++) {
|
||||
$n = $z->statIndex($i)['name'];
|
||||
if ($n === 'template.json' || preg_match('#^templates/[^/]+/template\.json$#', $n)) {
|
||||
$jsonName = $n;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if ($jsonName === null) {
|
||||
fwrite(STDERR, "zip 内缺少 template.json（须为 templates/<名称>/template.json 结构）\n");
|
||||
exit(1);
|
||||
}
|
||||
$meta = json_decode((string) $z->getFromName($jsonName), true);
|
||||
$z->close();
|
||||
if (!is_array($meta)) {
|
||||
fwrite(STDERR, "template.json 解析失败\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
// 模板标识：根目录 template.json 取 meta.name；templates/<name>/template.json 取目录名
|
||||
if (preg_match('#^template\.json$#', $jsonName)) {
|
||||
$name = $meta['name'] ?? '';
|
||||
} else {
|
||||
$segs = explode('/', $jsonName);
|
||||
$name = $segs[1] ?? ($meta['name'] ?? '');
|
||||
}
|
||||
|
||||
// ===================== 元数据合并（命令行覆盖优先） =====================
|
||||
$version = $meta['version'] ?? '';
|
||||
$title = $opts['title'] ?? ($meta['title'] ?? $name);
|
||||
$author = $opts['author'] ?? ($meta['author'] ?? '');
|
||||
$category = $opts['category'] ?? ($meta['category'] ?? '');
|
||||
$tags = $opts['tags'] ?? ($meta['tags'] ?? '');
|
||||
$price = (string) ($opts['price'] ?? ($meta['price'] ?? 0));
|
||||
$logo = $opts['logo'] ?? ($meta['logo'] ?? '');
|
||||
$description = $opts['description'] ?? ($meta['description'] ?? '');
|
||||
$changelog = $opts['changelog'] ?? ($meta['changelog'] ?? '');
|
||||
$requireFramework = $opts['require_framework'] ?? ($meta['require_framework'] ?? '');
|
||||
|
||||
// 基础校验（与 api/Market::submit 一致）
|
||||
if (!preg_match('/^[a-zA-Z0-9_]+$/', $name)) {
|
||||
fwrite(STDERR, "标识格式不正确（仅字母数字下划线）: {$name}\n");
|
||||
exit(1);
|
||||
}
|
||||
if (!preg_match('/^\d+\.\d+\.\d+$/', $version)) {
|
||||
fwrite(STDERR, "版本号格式不正确（需 x.y.z）: {$version}\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
echo "[提交] name={$name} version={$version} title={$title}\n";
|
||||
echo "[提交] 目标: {$apiUrl}/appmall/api/addon/submit (type=template)\n";
|
||||
|
||||
// ===================== 发起 multipart 提交 =====================
|
||||
if (!function_exists('curl_init')) {
|
||||
fwrite(STDERR, "curl 扩展不可用\n");
|
||||
exit(1);
|
||||
}
|
||||
$post = [
|
||||
'token' => $token,
|
||||
'type' => 'template',
|
||||
'name' => $name,
|
||||
'version' => $version,
|
||||
'title' => $title,
|
||||
'author' => $author,
|
||||
'category' => $category,
|
||||
'tags' => $tags,
|
||||
'price' => $price,
|
||||
'logo' => $logo,
|
||||
'description' => $description,
|
||||
'changelog' => $changelog,
|
||||
'require_framework' => $requireFramework,
|
||||
'file' => new CURLFile($zip, 'application/zip', basename($zip)),
|
||||
];
|
||||
|
||||
$ch = curl_init($apiUrl . '/appmall/api/addon/submit');
|
||||
curl_setopt_array($ch, [
|
||||
CURLOPT_POST => true,
|
||||
CURLOPT_POSTFIELDS => $post,
|
||||
CURLOPT_RETURNTRANSFER => true,
|
||||
CURLOPT_TIMEOUT => 3600,
|
||||
CURLOPT_CONNECTTIMEOUT => 30,
|
||||
CURLOPT_SSL_VERIFYPEER => !$insecure,
|
||||
CURLOPT_SSL_VERIFYHOST => $insecure ? 0 : 2,
|
||||
]);
|
||||
$resp = curl_exec($ch);
|
||||
if ($resp === false) {
|
||||
fwrite(STDERR, "curl 错误: " . curl_error($ch) . "\n");
|
||||
curl_close($ch);
|
||||
exit(1);
|
||||
}
|
||||
$httpCode = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
$data = json_decode((string) $resp, true);
|
||||
if (!is_array($data)) {
|
||||
fwrite(STDERR, "非 JSON 响应 (HTTP {$httpCode}):\n{$resp}\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
// submit 成功 code=1
|
||||
if (($data['code'] ?? 0) === 1) {
|
||||
echo "提交成功: " . ($data['msg'] ?? '') . "\n";
|
||||
exit(0);
|
||||
}
|
||||
echo "提交失败: " . ($data['msg'] ?? ($data['message'] ?? "HTTP {$httpCode}")) . "\n";
|
||||
exit(1);
|
||||
Reference in new issue
Block a user