安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
167 lines
6.0 KiB
PHP
167 lines
6.0 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
declare (strict_types = 1);
|
||
|
||
namespace addon\articles\controller;
|
||
|
||
use addon\articles\model\Article;
|
||
use addon\articles\model\ArticleCategory;
|
||
use addon\articles\model\ArticleTopic;
|
||
use think\facade\Request;
|
||
|
||
/**
|
||
* 站点地图(前台 SEO 用)
|
||
*
|
||
* 文章数 ≤ 5000:sitemap.xml 直接输出全部 URL(urlset)
|
||
* 文章数 > 5000:sitemap.xml 输出 sitemap index,文章拆到 sitemap-<n>.xml 分片
|
||
* (单文件 URL 上限 5 万条、体积 50MB,这里按 5000 条分片留足余量)
|
||
*
|
||
* 收录范围:插件首页 / 分类 / 专题 / 已发布且未删除的文章(草稿与待审不收录)
|
||
*
|
||
* @author ywxapp <admin@ywxapp.cn>
|
||
*/
|
||
class Sitemap extends ArticlesFrontend
|
||
{
|
||
/** 单个 sitemap 文件最多包含的 URL 数 */
|
||
const MAX_PER_FILE = 5000;
|
||
|
||
/**
|
||
* /articles/sitemap.xml
|
||
*/
|
||
public function index()
|
||
{
|
||
$base = Request::domain();
|
||
$total = Article::scope('normal')->count();
|
||
|
||
// 首页 / 分类 / 专题(条目少,始终放在索引或主文件中)
|
||
$static = [
|
||
['loc' => $base . (string) url('articles/index/index'), 'priority' => '1.0', 'lastmod' => date('Y-m-d')],
|
||
['loc' => $base . (string) url('articles/topic/index'), 'priority' => '0.7'],
|
||
];
|
||
foreach (ArticleCategory::allEnable() as $c) {
|
||
$static[] = [
|
||
'loc' => $base . (string) url('articles/category/index', ['id' => $c->id]),
|
||
'priority' => '0.6',
|
||
];
|
||
}
|
||
foreach (ArticleTopic::scope('enable')->select() as $t) {
|
||
$static[] = [
|
||
'loc' => $base . (string) url('articles/topic/' . $t->id),
|
||
'priority' => '0.7',
|
||
];
|
||
}
|
||
|
||
// 文章过多 → 输出 sitemap index(静态条目放主文件,文章分片)
|
||
if ($total > self::MAX_PER_FILE) {
|
||
$pages = (int) ceil($total / self::MAX_PER_FILE);
|
||
$maps = $static;
|
||
for ($i = 1; $i <= $pages; $i++) {
|
||
// 分片文件 URL 手工拼接:url() 会追加 .html 后缀,不能用于 .xml
|
||
$maps[] = [
|
||
'loc' => $base . '/articles/sitemap-' . $i . '.xml',
|
||
'lastmod' => date('Y-m-d'),
|
||
'priority' => '0.8',
|
||
];
|
||
}
|
||
return response(self::renderIndex($maps), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
// 常规:单文件输出(静态 + 全部文章)
|
||
$items = $static;
|
||
foreach (Article::scope('normal')->field('id,update_at')->order('id', 'desc')->select() as $a) {
|
||
$items[] = [
|
||
'loc' => $base . (string) url('articles/read/' . $a->id),
|
||
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
|
||
'priority' => '0.8',
|
||
];
|
||
}
|
||
|
||
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
/**
|
||
* 文章分片:/articles/sitemap-<page>.xml
|
||
*/
|
||
public function chunk($page = 1)
|
||
{
|
||
$page = max(1, (int) $page);
|
||
$base = Request::domain();
|
||
$total = Article::scope('normal')->count();
|
||
|
||
$pages = max(1, (int) ceil($total / self::MAX_PER_FILE));
|
||
if ($page > $pages) {
|
||
// 越界分片返回空 urlset,避免搜索引擎误判为错误
|
||
return response(self::renderUrlset([]), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
$articles = Article::scope('normal')
|
||
->field('id,update_at')
|
||
->order('id', 'desc')
|
||
->page($page, self::MAX_PER_FILE)
|
||
->select();
|
||
|
||
$items = [];
|
||
foreach ($articles as $a) {
|
||
$items[] = [
|
||
'loc' => $base . (string) url('articles/read/' . $a->id),
|
||
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
|
||
'priority' => '0.8',
|
||
];
|
||
}
|
||
|
||
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
/**
|
||
* 渲染 urlset
|
||
*/
|
||
private static function renderUrlset(array $items): string
|
||
{
|
||
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
|
||
. '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
|
||
|
||
foreach ($items as $item) {
|
||
$xml .= " <url>\n";
|
||
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
|
||
if (!empty($item['lastmod'])) {
|
||
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
|
||
}
|
||
$xml .= ' <priority>' . ($item['priority'] ?? '0.5') . "</priority>\n";
|
||
$xml .= " </url>\n";
|
||
}
|
||
|
||
return $xml . '</urlset>';
|
||
}
|
||
|
||
/**
|
||
* 渲染 sitemap index
|
||
*/
|
||
private static function renderIndex(array $items): string
|
||
{
|
||
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
|
||
. '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
|
||
|
||
foreach ($items as $item) {
|
||
$xml .= " <sitemap>\n";
|
||
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
|
||
if (!empty($item['lastmod'])) {
|
||
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
|
||
}
|
||
$xml .= " </sitemap>\n";
|
||
}
|
||
|
||
return $xml . '</sitemapindex>';
|
||
}
|
||
|
||
private static function esc(string $value): string
|
||
{
|
||
return htmlspecialchars($value, ENT_XML1 | ENT_QUOTES, 'UTF-8');
|
||
}
|
||
}
|