500 lines
18 KiB
PHP
500 lines
18 KiB
PHP
<?php
|
|
// +----------------------------------------------------------------------
|
|
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
|
// +----------------------------------------------------------------------
|
|
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
|
// +----------------------------------------------------------------------
|
|
// | Author: ywxapp<admin@ywxapp.cn>
|
|
// +----------------------------------------------------------------------
|
|
declare (strict_types = 1);
|
|
|
|
namespace addon\forum\controller\backend;
|
|
|
|
use think\facade\Config;
|
|
use think\Response;
|
|
use ywxapp\controller\BackendBase;
|
|
use ywxapp\service\AddonService;
|
|
|
|
/**
|
|
* UEditor 服务端统一入口（论坛发帖富文本）
|
|
*
|
|
* 按 action 参数分发：
|
|
* config 返回编辑器配置
|
|
* uploadimage 图片上传
|
|
* uploadfile 附件上传
|
|
* uploadvideo 视频上传
|
|
* listimage 图片管理器列表
|
|
* listfile 附件管理器列表
|
|
* catchimage 远程图片抓取（粘贴 Word 时把外链图落地）
|
|
*
|
|
* 全部参数（上传目录、允许类型、大小上限、抓取开关）均由后台「编辑器配置」页
|
|
* 持久化到插件配置表，运行期与 config.php 默认值合并后生效。
|
|
*
|
|
* @author ywxapp <admin@ywxapp.cn>
|
|
*/
|
|
class Ueditor extends BackendBase
|
|
{
|
|
/**
|
|
* 合并后的有效配置
|
|
*/
|
|
protected array $cfg = [];
|
|
|
|
/**
|
|
* 从 config.php 默认值 + 后台保存值（插件配置表）合并出当前配置
|
|
*/
|
|
protected function cfg(): array
|
|
{
|
|
if ($this->cfg) {
|
|
return $this->cfg;
|
|
}
|
|
$defaults = (array) Config::get('forum', []);
|
|
$saved = AddonService::config('forum');
|
|
$this->cfg = array_merge($defaults, $saved);
|
|
return $this->cfg;
|
|
}
|
|
|
|
/**
|
|
* 取逗号分隔扩展名列表为小写数组
|
|
*/
|
|
protected function extArray(string $key, array $fallback): array
|
|
{
|
|
$raw = $this->cfg()[$key] ?? '';
|
|
if (!is_string($raw) || $raw === '') {
|
|
return $fallback;
|
|
}
|
|
return array_values(array_filter(array_map(
|
|
fn($e) => strtolower(trim($e, " .\t\n\r\0\x0B")),
|
|
explode(',', $raw)
|
|
), fn($e) => $e !== ''));
|
|
}
|
|
|
|
/**
|
|
* 取图片/附件/视频的允许扩展名
|
|
*/
|
|
protected function imageExt(): array
|
|
{
|
|
return $this->extArray('editor_image_ext', ['jpg', 'jpeg', 'png', 'gif', 'bmp', 'webp']);
|
|
}
|
|
|
|
protected function fileExt(): array
|
|
{
|
|
return $this->extArray('editor_file_ext', ['zip', 'rar', '7z', 'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'md']);
|
|
}
|
|
|
|
protected function videoExt(): array
|
|
{
|
|
return $this->extArray('editor_video_ext', ['mp4', 'webm', 'ogg', 'mov']);
|
|
}
|
|
|
|
/**
|
|
* 取大小上限（MB -> 字节）
|
|
*/
|
|
protected function sizeBytes(string $key, int $mbFallback): int
|
|
{
|
|
$v = (int) ($this->cfg()[$key] ?? $mbFallback);
|
|
return max(1, $v) * 1048576;
|
|
}
|
|
|
|
/**
|
|
* 统一入口
|
|
*/
|
|
public function index()
|
|
{
|
|
$action = (string) $this->request->param('action', '');
|
|
|
|
switch ($action) {
|
|
case 'config':
|
|
return $this->jsonp($this->editorConfig());
|
|
case 'uploadimage':
|
|
return $this->jsonp($this->upload('upfile', $this->imageExt(), 'image'));
|
|
case 'uploadfile':
|
|
return $this->jsonp($this->upload('upfile', $this->fileExt(), 'file'));
|
|
case 'uploadvideo':
|
|
return $this->jsonp($this->upload('upfile', $this->videoExt(), 'video'));
|
|
case 'uploadscrawl':
|
|
return $this->jsonp($this->uploadScrawl());
|
|
case 'listimage':
|
|
return $this->jsonp($this->listFiles('image', $this->imageExt()));
|
|
case 'listfile':
|
|
return $this->jsonp($this->listFiles('file', $this->fileExt()));
|
|
case 'catchimage':
|
|
return $this->jsonp($this->catchImage());
|
|
default:
|
|
return $this->jsonp(['state' => '请求地址出错']);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* 输出 JSON，兼容 UEditor 的 jsonp 回调
|
|
*/
|
|
protected function jsonp(array $data): Response
|
|
{
|
|
$callback = (string) $this->request->param('callback', '');
|
|
$json = json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|
|
|
|
if ($callback !== '' && preg_match('/^[A-Za-z_][A-Za-z0-9_\.]*$/', $callback)) {
|
|
return Response::create($callback . '(' . $json . ')', 'html')
|
|
->contentType('application/javascript');
|
|
}
|
|
|
|
return Response::create($json, 'html')->contentType('application/json');
|
|
}
|
|
|
|
/**
|
|
* 编辑器服务端配置
|
|
*/
|
|
protected function editorConfig(): array
|
|
{
|
|
$prefix = '/' . trim($this->uploadDir(), '/') . '/';
|
|
$imageExt = $this->imageExt();
|
|
$fileExt = $this->fileExt();
|
|
$videoExt = $this->videoExt();
|
|
$imageSize = $this->sizeBytes('editor_image_size', 10);
|
|
$fileSize = $this->sizeBytes('editor_file_size', 50);
|
|
$videoSize = $this->sizeBytes('editor_video_size', 100);
|
|
|
|
return [
|
|
'imageActionName' => 'uploadimage',
|
|
'imageFieldName' => 'upfile',
|
|
'imageMaxSize' => $imageSize,
|
|
'imageAllowFiles' => array_map(fn($e) => '.' . $e, $imageExt),
|
|
'imageCompressEnable' => true,
|
|
'imageCompressBorder' => 1600,
|
|
'imageInsertAlign' => 'none',
|
|
'imageUrlPrefix' => '',
|
|
'imagePathFormat' => $prefix . 'image/{yyyy}{mm}{dd}/{time}{rand:6}',
|
|
|
|
'scrawlActionName' => 'uploadscrawl',
|
|
'scrawlFieldName' => 'upfile',
|
|
'scrawlPathFormat' => $prefix . 'image/{yyyy}{mm}{dd}/{time}{rand:6}',
|
|
'scrawlMaxSize' => $imageSize,
|
|
'scrawlUrlPrefix' => '',
|
|
'scrawlInsertAlign' => 'none',
|
|
|
|
'catcherLocalDomain' => ['127.0.0.1', 'localhost'],
|
|
'catcherActionName' => 'catchimage',
|
|
'catcherFieldName' => 'source',
|
|
'catcherPathFormat' => $prefix . 'image/{yyyy}{mm}{dd}/{time}{rand:6}',
|
|
'catcherUrlPrefix' => '',
|
|
'catcherMaxSize' => $imageSize,
|
|
'catcherAllowFiles' => array_map(fn($e) => '.' . $e, $imageExt),
|
|
|
|
'videoActionName' => 'uploadvideo',
|
|
'videoFieldName' => 'upfile',
|
|
'videoPathFormat' => $prefix . 'video/{yyyy}{mm}{dd}/{time}{rand:6}',
|
|
'videoUrlPrefix' => '',
|
|
'videoMaxSize' => $videoSize,
|
|
'videoAllowFiles' => array_map(fn($e) => '.' . $e, $videoExt),
|
|
|
|
'fileActionName' => 'uploadfile',
|
|
'fileFieldName' => 'upfile',
|
|
'filePathFormat' => $prefix . 'file/{yyyy}{mm}{dd}/{time}{rand:6}',
|
|
'fileUrlPrefix' => '',
|
|
'fileMaxSize' => $fileSize,
|
|
'fileAllowFiles' => array_map(fn($e) => '.' . $e, $fileExt),
|
|
|
|
'imageManagerActionName' => 'listimage',
|
|
'imageManagerListPath' => $prefix . 'image/',
|
|
'imageManagerListSize' => 20,
|
|
'imageManagerUrlPrefix' => '',
|
|
'imageManagerInsertAlign' => 'none',
|
|
'imageManagerAllowFiles' => array_map(fn($e) => '.' . $e, $imageExt),
|
|
|
|
'fileManagerActionName' => 'listfile',
|
|
'fileManagerListPath' => $prefix . 'file/',
|
|
'fileManagerUrlPrefix' => '',
|
|
'fileManagerListSize' => 20,
|
|
'fileManagerAllowFiles' => array_map(fn($e) => '.' . $e, $fileExt),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* 通用上传处理
|
|
*/
|
|
protected function upload(string $field, array $allowExt, string $group): array
|
|
{
|
|
$file = $this->request->file($field);
|
|
if (!$file) {
|
|
return ['state' => '未找到上传文件'];
|
|
}
|
|
|
|
$ext = strtolower($file->getOriginalExtension());
|
|
if (!in_array($ext, $allowExt, true)) {
|
|
return ['state' => '不允许的文件类型：' . $ext];
|
|
}
|
|
|
|
$limit = $group === 'video'
|
|
? $this->sizeBytes('editor_video_size', 100)
|
|
: ($group === 'file' ? $this->sizeBytes('editor_file_size', 50) : $this->sizeBytes('editor_image_size', 10));
|
|
if ($file->getSize() > $limit) {
|
|
return ['state' => '文件大小超出限制'];
|
|
}
|
|
|
|
if ($group === 'image') {
|
|
$info = @getimagesize($file->getRealPath());
|
|
if ($info === false) {
|
|
return ['state' => '文件不是有效的图片'];
|
|
}
|
|
}
|
|
|
|
$relativeDir = trim($this->uploadDir(), '/') . '/' . $group . '/' . date('Ymd');
|
|
$targetDir = public_path() . str_replace('/', DIRECTORY_SEPARATOR, $relativeDir);
|
|
|
|
if (!is_dir($targetDir) && !@mkdir($targetDir, 0755, true) && !is_dir($targetDir)) {
|
|
return ['state' => '上传目录创建失败，请检查权限'];
|
|
}
|
|
|
|
$original = $file->getOriginalName();
|
|
$saveName = date('His') . substr(md5(uniqid('', true)), 0, 10) . '.' . $ext;
|
|
|
|
try {
|
|
$file->move($targetDir, $saveName);
|
|
} catch (\Throwable $e) {
|
|
return ['state' => '文件保存失败：' . $e->getMessage()];
|
|
}
|
|
|
|
$url = '/' . $relativeDir . '/' . $saveName;
|
|
|
|
return [
|
|
'state' => 'SUCCESS',
|
|
'url' => $url,
|
|
'title' => $original,
|
|
'original' => $original,
|
|
'type' => '.' . $ext,
|
|
'size' => (string) filesize($targetDir . DIRECTORY_SEPARATOR . $saveName),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* 涂鸦上传：接收 base64 数据
|
|
*/
|
|
protected function uploadScrawl(): array
|
|
{
|
|
$base64 = (string) $this->request->post('upfile', '');
|
|
if ($base64 === '') {
|
|
return ['state' => '未接收到涂鸦数据'];
|
|
}
|
|
|
|
$binary = base64_decode($base64, true);
|
|
if ($binary === false || strlen($binary) > $this->sizeBytes('editor_image_size', 10)) {
|
|
return ['state' => '涂鸦数据无效或过大'];
|
|
}
|
|
|
|
$relativeDir = trim($this->uploadDir(), '/') . '/image/' . date('Ymd');
|
|
$targetDir = public_path() . str_replace('/', DIRECTORY_SEPARATOR, $relativeDir);
|
|
|
|
if (!is_dir($targetDir) && !@mkdir($targetDir, 0755, true) && !is_dir($targetDir)) {
|
|
return ['state' => '上传目录创建失败，请检查权限'];
|
|
}
|
|
|
|
$saveName = date('His') . substr(md5(uniqid('', true)), 0, 10) . '.png';
|
|
if (@file_put_contents($targetDir . DIRECTORY_SEPARATOR . $saveName, $binary) === false) {
|
|
return ['state' => '涂鸦保存失败'];
|
|
}
|
|
|
|
return [
|
|
'state' => 'SUCCESS',
|
|
'url' => '/' . $relativeDir . '/' . $saveName,
|
|
'title' => $saveName,
|
|
'original' => $saveName,
|
|
'type' => '.png',
|
|
'size' => (string) strlen($binary),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* 远程图片抓取
|
|
*/
|
|
protected function catchImage(): array
|
|
{
|
|
if ((int) ($this->cfg()['editor_catch_image'] ?? 1) !== 1) {
|
|
return ['state' => '远程图片抓取已关闭', 'list' => []];
|
|
}
|
|
|
|
$field = 'source';
|
|
$sources = $this->request->param($field, []);
|
|
if (!is_array($sources)) {
|
|
$sources = [$sources];
|
|
}
|
|
|
|
if (empty($sources)) {
|
|
return ['state' => '未接收到图片地址'];
|
|
}
|
|
|
|
$imageExt = $this->imageExt();
|
|
$relativeDir = trim($this->uploadDir(), '/') . '/image/' . date('Ymd');
|
|
$targetDir = public_path() . str_replace('/', DIRECTORY_SEPARATOR, $relativeDir);
|
|
|
|
if (!is_dir($targetDir) && !@mkdir($targetDir, 0755, true) && !is_dir($targetDir)) {
|
|
return ['state' => '上传目录创建失败，请检查权限'];
|
|
}
|
|
|
|
$list = [];
|
|
foreach ($sources as $remote) {
|
|
$remote = (string) $remote;
|
|
$item = ['state' => '抓取失败', 'source' => $remote, 'url' => ''];
|
|
|
|
if (!$this->isSafeRemoteUrl($remote)) {
|
|
$item['state'] = '非法的图片地址';
|
|
$list[] = $item;
|
|
continue;
|
|
}
|
|
|
|
$binary = $this->fetchRemote($remote);
|
|
if ($binary === null) {
|
|
$list[] = $item;
|
|
continue;
|
|
}
|
|
|
|
$info = @getimagesizefromstring($binary);
|
|
if ($info === false) {
|
|
$item['state'] = '远程文件不是有效图片';
|
|
$list[] = $item;
|
|
continue;
|
|
}
|
|
|
|
$ext = image_type_to_extension($info[2], false);
|
|
if (!in_array(strtolower((string) $ext), $imageExt, true)) {
|
|
$item['state'] = '不允许的图片类型';
|
|
$list[] = $item;
|
|
continue;
|
|
}
|
|
|
|
$saveName = date('His') . substr(md5(uniqid('', true)), 0, 10) . '.' . $ext;
|
|
if (@file_put_contents($targetDir . DIRECTORY_SEPARATOR . $saveName, $binary) === false) {
|
|
$item['state'] = '图片保存失败';
|
|
$list[] = $item;
|
|
continue;
|
|
}
|
|
|
|
$list[] = [
|
|
'state' => 'SUCCESS',
|
|
'url' => '/' . $relativeDir . '/' . $saveName,
|
|
'size' => (string) strlen($binary),
|
|
'title' => $saveName,
|
|
'original' => basename(parse_url($remote, PHP_URL_PATH) ?: $saveName),
|
|
'source' => $remote,
|
|
];
|
|
}
|
|
|
|
return ['state' => 'SUCCESS', 'list' => $list];
|
|
}
|
|
|
|
/**
|
|
* 图片 / 附件管理器列表
|
|
*/
|
|
protected function listFiles(string $group, array $allowExt): array
|
|
{
|
|
$start = (int) $this->request->param('start', 0);
|
|
$size = (int) $this->request->param('size', 20);
|
|
$size = $size > 0 && $size <= 100 ? $size : 20;
|
|
|
|
$relativeRoot = trim($this->uploadDir(), '/') . '/' . $group;
|
|
$rootDir = public_path() . str_replace('/', DIRECTORY_SEPARATOR, $relativeRoot);
|
|
|
|
if (!is_dir($rootDir)) {
|
|
return ['state' => 'SUCCESS', 'list' => [], 'start' => $start, 'total' => 0];
|
|
}
|
|
|
|
$files = [];
|
|
$iter = new \RecursiveIteratorIterator(
|
|
new \RecursiveDirectoryIterator($rootDir, \FilesystemIterator::SKIP_DOTS)
|
|
);
|
|
|
|
foreach ($iter as $fileInfo) {
|
|
if (!$fileInfo->isFile()) {
|
|
continue;
|
|
}
|
|
if (!in_array(strtolower($fileInfo->getExtension()), $allowExt, true)) {
|
|
continue;
|
|
}
|
|
$relative = str_replace('\\', '/', substr($fileInfo->getPathname(), strlen(public_path())));
|
|
$files[] = [
|
|
'url' => '/' . ltrim($relative, '/'),
|
|
'mtime' => $fileInfo->getMTime(),
|
|
];
|
|
}
|
|
|
|
usort($files, fn($a, $b) => $b['mtime'] <=> $a['mtime']);
|
|
|
|
$total = count($files);
|
|
$page = array_slice($files, $start, $size);
|
|
|
|
return ['state' => 'SUCCESS', 'list' => $page, 'start' => $start, 'total' => $total];
|
|
}
|
|
|
|
/**
|
|
* 校验远程地址是否安全，阻断 SSRF
|
|
*/
|
|
protected function isSafeRemoteUrl(string $url): bool
|
|
{
|
|
$parts = parse_url($url);
|
|
if (!$parts || empty($parts['scheme']) || empty($parts['host'])) {
|
|
return false;
|
|
}
|
|
if (!in_array(strtolower($parts['scheme']), ['http', 'https'], true)) {
|
|
return false;
|
|
}
|
|
|
|
$host = $parts['host'];
|
|
$ip = filter_var($host, FILTER_VALIDATE_IP) ? $host : gethostbyname($host);
|
|
|
|
if (filter_var($ip, FILTER_VALIDATE_IP) === false) {
|
|
return false;
|
|
}
|
|
|
|
$public = filter_var(
|
|
$ip,
|
|
FILTER_VALIDATE_IP,
|
|
FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
|
|
);
|
|
|
|
return $public !== false;
|
|
}
|
|
|
|
/**
|
|
* 下载远程内容
|
|
*/
|
|
protected function fetchRemote(string $url): ?string
|
|
{
|
|
if (function_exists('curl_init')) {
|
|
$ch = curl_init($url);
|
|
curl_setopt_array($ch, [
|
|
CURLOPT_RETURNTRANSFER => true,
|
|
CURLOPT_FOLLOWLOCATION => false,
|
|
CURLOPT_TIMEOUT => 15,
|
|
CURLOPT_CONNECTTIMEOUT => 5,
|
|
CURLOPT_USERAGENT => 'YwxApp-Forum/1.0',
|
|
CURLOPT_SSL_VERIFYPEER => true,
|
|
]);
|
|
$body = curl_exec($ch);
|
|
$code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
|
curl_close($ch);
|
|
|
|
if ($body === false || $code !== 200 || strlen((string) $body) > $this->sizeBytes('editor_image_size', 10)) {
|
|
return null;
|
|
}
|
|
return (string) $body;
|
|
}
|
|
|
|
$ctx = stream_context_create(['http' => ['timeout' => 15, 'follow_location' => 0]]);
|
|
$body = @file_get_contents($url, false, $ctx, 0, $this->sizeBytes('editor_image_size', 10) + 1);
|
|
|
|
if ($body === false || strlen($body) > $this->sizeBytes('editor_image_size', 10)) {
|
|
return null;
|
|
}
|
|
return $body;
|
|
}
|
|
|
|
/**
|
|
* 读取上传目录配置（后台可配，安全校验防穿越）
|
|
*/
|
|
protected function uploadDir(): string
|
|
{
|
|
$dir = (string) ($this->cfg()['editor_upload_dir'] ?? 'uploads/forum');
|
|
$dir = str_replace('\\', '/', $dir);
|
|
$dir = preg_replace('#\.+/#', '', $dir) ?? 'uploads/forum';
|
|
return trim($dir, '/') ?: 'uploads/forum';
|
|
}
|
|
}
|