feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,130 @@
|
||||
<?php
|
||||
// +----------------------------------------------------------------------
|
||||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||||
// +----------------------------------------------------------------------
|
||||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||||
// +----------------------------------------------------------------------
|
||||
// | Author: ywxapp<admin@ywxapp.cn>
|
||||
// +----------------------------------------------------------------------
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace ywxapp\command;
|
||||
|
||||
use think\console\Command;
|
||||
use think\console\Input;
|
||||
use think\console\Output;
|
||||
use think\console\input\Option;
|
||||
use think\facade\Db;
|
||||
use ywxapp\service\FileStorageService;
|
||||
|
||||
/**
|
||||
* 附件孤儿清理
|
||||
*
|
||||
* 「孤儿」= 磁盘上存在、但 common_attachment 里没有对应记录的文件：
|
||||
* 上传成功却落库失败、记录被硬删、手工拷进去的文件都会留下这类残留。
|
||||
*
|
||||
* 默认只统计不删除（安全），加 --delete 才真正清理；删除同样走
|
||||
* FileStorageService::delete()，OSS / FTP 等自定义存储由 FileDelete 事件接管。
|
||||
*
|
||||
* 用法：
|
||||
* php think attachment:clean # 只看不删
|
||||
* php think attachment:clean --delete # 真删
|
||||
* php think attachment:clean --days=30 # 只处理 30 天前的文件
|
||||
*
|
||||
* @author ywxapp <admin@ywxapp.cn>
|
||||
*/
|
||||
class AttachmentCleanCommand extends Command
|
||||
{
|
||||
protected function configure()
|
||||
{
|
||||
$this->setName('attachment:clean')
|
||||
->addOption('delete', null, Option::VALUE_NONE, '真正删除孤儿文件（默认只统计）')
|
||||
->addOption('days', null, Option::VALUE_OPTIONAL, '只处理 N 天前的文件（按修改时间），0=不限')
|
||||
->addOption('dir', null, Option::VALUE_OPTIONAL, '扫描目录，默认 public/storage')
|
||||
->setDescription('清理磁盘上没有附件记录的孤儿文件（默认只统计不删除）');
|
||||
}
|
||||
|
||||
protected function execute(Input $input, Output $output)
|
||||
{
|
||||
$doDelete = (bool) $input->getOption('delete');
|
||||
$days = max(0, (int) $input->getOption('days'));
|
||||
$root = rtrim((string) ($input->getOption('dir') ?: public_path() . 'storage'), '/\\');
|
||||
|
||||
if (!is_dir($root)) {
|
||||
$output->writeln('<error>目录不存在：' . $root . '</error>');
|
||||
return 1;
|
||||
}
|
||||
|
||||
// 库里所有在用的相对路径
|
||||
$known = [];
|
||||
try {
|
||||
$rows = Db::name('common_attachment')->where('delete_at', 0)->field('path')->select()->toArray();
|
||||
} catch (\Throwable $e) {
|
||||
$output->writeln('<error>附件表不可用：' . $e->getMessage() . '</error>');
|
||||
return 1;
|
||||
}
|
||||
foreach ($rows as $r) {
|
||||
$known[ltrim(str_replace('\\', '/', (string) $r['path']), '/')] = true;
|
||||
}
|
||||
|
||||
$deadline = $days > 0 ? (time() - $days * 86400) : 0;
|
||||
$orphans = [];
|
||||
$total = 0;
|
||||
$size = 0;
|
||||
|
||||
$it = new \RecursiveIteratorIterator(
|
||||
new \RecursiveDirectoryIterator($root, \FilesystemIterator::SKIP_DOTS),
|
||||
\RecursiveIteratorIterator::SELF_FIRST
|
||||
);
|
||||
foreach ($it as $file) {
|
||||
if (! $file->isFile()) {
|
||||
continue;
|
||||
}
|
||||
$total++;
|
||||
$rel = ltrim(str_replace('\\', '/', substr($file->getPathname(), strlen($root) + 1)), '/');
|
||||
if (isset($known[$rel])) {
|
||||
continue;
|
||||
}
|
||||
if ($deadline && $file->getMTime() > $deadline) {
|
||||
continue;
|
||||
}
|
||||
$orphans[] = $rel;
|
||||
$size += $file->getSize();
|
||||
}
|
||||
|
||||
$output->writeln('扫描目录：' . $root);
|
||||
$output->writeln('磁盘文件：' . $total . '，已登记附件：' . count($known) . '，孤儿：' . count($orphans));
|
||||
$output->writeln('孤儿占用：' . round($size / 1024 / 1024, 2) . ' MB');
|
||||
|
||||
foreach (array_slice($orphans, 0, 20) as $rel) {
|
||||
$output->writeln(' ' . $rel);
|
||||
}
|
||||
if (count($orphans) > 20) {
|
||||
$output->writeln(' … 另有 ' . (count($orphans) - 20) . ' 个');
|
||||
}
|
||||
|
||||
if (! $doDelete) {
|
||||
$output->writeln('<comment>未删除（如需清理请加 --delete）</comment>');
|
||||
return 0;
|
||||
}
|
||||
if (empty($orphans)) {
|
||||
$output->writeln('<info>没有需要清理的孤儿文件</info>');
|
||||
return 0;
|
||||
}
|
||||
|
||||
$storage = new FileStorageService();
|
||||
$ok = 0;
|
||||
foreach ($orphans as $rel) {
|
||||
try {
|
||||
if ($storage->delete($rel)) {
|
||||
$ok++;
|
||||
}
|
||||
} catch (\Throwable $e) {
|
||||
// 单个失败不中断
|
||||
}
|
||||
}
|
||||
$output->writeln('<info>已删除 ' . $ok . ' / ' . count($orphans) . ' 个孤儿文件</info>');
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user