安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
230 lines
7.1 KiB
PHP
230 lines
7.1 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
declare (strict_types = 1);
|
||
|
||
namespace addon\articles\controller\api;
|
||
|
||
// 注意:本类就叫 Article,模型必须起别名,否则「类名已被占用」致命错误
|
||
use addon\articles\model\Article as ArticleModel;
|
||
use addon\articles\model\ArticleCategory;
|
||
use addon\articles\model\ArticleComment;
|
||
use addon\articles\model\ArticleTag;
|
||
use think\facade\Cache;
|
||
use ywxapp\controller\ApiBase;
|
||
use ywxapp\service\AddonService;
|
||
|
||
/**
|
||
* 文章CMS 对外 API
|
||
*
|
||
* 鉴权:继承 ApiBase(默认需登录);列表/详情/分类/标签/搜索放行游客,
|
||
* 评论必须登录($noNeedLogin 未包含 comment)。
|
||
*
|
||
* URL:/articles/api/articles 等(见 route/app.php)
|
||
*/
|
||
class Article extends ApiBase
|
||
{
|
||
/** 免登录方法(评论不在其中,必须登录) */
|
||
protected $noNeedLogin = ['index', 'read', 'categories', 'tags', 'search'];
|
||
|
||
/**
|
||
* 文章列表
|
||
* 参数:page / cid / tid
|
||
*/
|
||
public function index()
|
||
{
|
||
$page = (int) input('page/d', 1);
|
||
$cid = (int) input('cid/d', 0);
|
||
$tid = (int) input('tid/d', 0);
|
||
|
||
$where = [];
|
||
if ($cid > 0) {
|
||
$where['cid'] = $cid;
|
||
}
|
||
if ($tid > 0) {
|
||
$where['tid'] = $tid;
|
||
}
|
||
|
||
$list = ArticleModel::listArticles($where, $page, $this->pageSize());
|
||
|
||
$rows = [];
|
||
foreach ($list->items() as $a) {
|
||
$rows[] = [
|
||
'id' => $a->id,
|
||
'title' => $a->title,
|
||
'summary' => $a->summary,
|
||
'cover_image' => $a->cover_image,
|
||
'cid' => $a->cid,
|
||
'category' => $a->category_name ?? '',
|
||
'view_count' => (int) $a->view_count,
|
||
'comment_count' => (int) $a->comment_count,
|
||
'create_at' => $a->create_at,
|
||
];
|
||
}
|
||
|
||
$this->apiSuccess($rows, 'success', $list->total());
|
||
}
|
||
|
||
/**
|
||
* 文章详情(正文已在入库时做过白名单净化,可安全下发)
|
||
*/
|
||
public function read($id = 0)
|
||
{
|
||
$id = (int) ($id ?: input('id/d', 0));
|
||
$article = ArticleModel::getDetail($id);
|
||
|
||
if (!$article) {
|
||
$this->apiError('文章不存在或已下线', 404, null, 404);
|
||
}
|
||
|
||
ArticleModel::where('id', $id)->inc('view_count')->update();
|
||
|
||
$tags = [];
|
||
foreach ($article->tags as $t) {
|
||
$tags[] = ['id' => $t->id, 'name' => $t->name];
|
||
}
|
||
|
||
$this->apiSuccess([
|
||
'id' => $article->id,
|
||
'title' => $article->title,
|
||
'content' => $article->content,
|
||
'summary' => $article->summary,
|
||
'cover_image' => $article->cover_image,
|
||
'author' => $article->author,
|
||
'cid' => $article->cid,
|
||
'category' => $article->category_name ?? '',
|
||
'view_count' => (int) $article->view_count,
|
||
'comment_count' => (int) $article->comment_count,
|
||
'create_at' => $article->create_at,
|
||
'tags' => $tags,
|
||
]);
|
||
}
|
||
|
||
/**
|
||
* 分类列表
|
||
*/
|
||
public function categories()
|
||
{
|
||
$rows = [];
|
||
foreach (ArticleCategory::allEnable() as $c) {
|
||
$rows[] = [
|
||
'id' => $c->id,
|
||
'name' => $c->name,
|
||
'alias' => $c->alias,
|
||
'description' => $c->description,
|
||
];
|
||
}
|
||
$this->apiSuccess($rows, 'success', count($rows));
|
||
}
|
||
|
||
/**
|
||
* 标签列表
|
||
*/
|
||
public function tags()
|
||
{
|
||
$rows = [];
|
||
foreach (ArticleTag::where('delete_at', 0)->order('id', 'desc')->select() as $t) {
|
||
$rows[] = ['id' => $t->id, 'name' => $t->name, 'alias' => $t->alias];
|
||
}
|
||
$this->apiSuccess($rows, 'success', count($rows));
|
||
}
|
||
|
||
/**
|
||
* 搜索
|
||
*/
|
||
public function search()
|
||
{
|
||
$keyword = trim((string) input('keyword/s', ''));
|
||
$page = (int) input('page/d', 1);
|
||
|
||
$list = ArticleModel::listArticles(['keyword' => $keyword], $page, $this->pageSize());
|
||
|
||
$rows = [];
|
||
foreach ($list->items() as $a) {
|
||
$rows[] = [
|
||
'id' => $a->id,
|
||
'title' => $a->title,
|
||
'summary' => $a->summary,
|
||
'cid' => $a->cid,
|
||
'category' => $a->category_name ?? '',
|
||
'create_at' => $a->create_at,
|
||
];
|
||
}
|
||
|
||
$this->apiSuccess($rows, 'success', $list->total());
|
||
}
|
||
|
||
/**
|
||
* 发表评论(需登录)
|
||
*/
|
||
public function comment()
|
||
{
|
||
$aid = (int) input('aid/d', 0);
|
||
$content = trim((string) input('content/s', ''));
|
||
|
||
if ($aid <= 0 || $content === '') {
|
||
$this->apiError('参数错误');
|
||
}
|
||
|
||
$len = mb_strlen($content, 'UTF-8');
|
||
if ($len < 2) {
|
||
$this->apiError('评论内容太短');
|
||
}
|
||
if ($len > 500) {
|
||
$this->apiError('评论内容不能超过 500 字');
|
||
}
|
||
|
||
// 目标文章必须存在且已发布
|
||
$article = ArticleModel::where('id', $aid)->where('status', 1)->where('delete_at', 0)->find();
|
||
if (!$article) {
|
||
$this->apiError('文章不存在或未发布');
|
||
}
|
||
|
||
$cfg = AddonService::config('articles');
|
||
$needAudit = !empty($cfg['comment_audit']);
|
||
$interval = max(0, (int) ($cfg['comment_interval'] ?? 10));
|
||
|
||
$uid = (int) $this->uid();
|
||
$lockKey = 'articles_comment_lock:' . $uid;
|
||
if ($interval > 0 && Cache::get($lockKey, 0)) {
|
||
$this->apiError('评论太频繁,请稍后再试');
|
||
}
|
||
|
||
ArticleComment::create([
|
||
'uid' => $uid,
|
||
'aid' => $aid,
|
||
'pid' => 0,
|
||
'content' => $content,
|
||
'status' => $needAudit ? 0 : 1,
|
||
'ip' => (string) $this->request->ip(),
|
||
'user_agent' => mb_substr((string) $this->request->header('user-agent', ''), 0, 255),
|
||
'create_at' => time(),
|
||
'update_at' => time(),
|
||
]);
|
||
|
||
if (!$needAudit) {
|
||
ArticleModel::where('id', $aid)->inc('comment_count')->update();
|
||
}
|
||
if ($interval > 0) {
|
||
Cache::set($lockKey, 1, $interval);
|
||
}
|
||
|
||
$this->apiSuccess(null, $needAudit ? '评论已提交,等待审核' : '评论成功');
|
||
}
|
||
|
||
/**
|
||
* 每页条数(取自插件配置)
|
||
*/
|
||
private function pageSize(): int
|
||
{
|
||
$cfg = AddonService::config('articles');
|
||
$size = (int) ($cfg['page_size'] ?? 10);
|
||
return $size > 0 ? min($size, 50) : 10;
|
||
}
|
||
}
|