安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
203 lines
7.0 KiB
PHP
203 lines
7.0 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
// | 文章CMS插件数据表自愈聚合入口
|
||
// +----------------------------------------------------------------------
|
||
declare (strict_types = 1);
|
||
|
||
namespace addon\articles\library;
|
||
|
||
use think\facade\Db;
|
||
|
||
/**
|
||
* 插件表结构自愈
|
||
*
|
||
* 背景(重要):
|
||
* - 框架 install.sql 导入有白名单,只执行 CREATE TABLE / INSERT,
|
||
* ALTER / DROP / UPDATE 会被跳过并记日志 → 老库升级缺列只能靠代码补。
|
||
* - 早期实现复用 BaseModel::ensureTableFromInstall(),它读的是**核心**
|
||
* public/install/install.sql(不含本插件表)→ 恒为空操作,还每请求
|
||
* 重复 file_get_contents + 正则解析大文件。
|
||
*
|
||
* 现方案:本类直接解析**插件自身** addon/articles/install.sql:
|
||
* - repair(false):只建表(轻量,首访兜底,同请求只跑一次)
|
||
* - repair(true) :建表 + 补列 + 补索引(install / upgrade 时调用)
|
||
*/
|
||
class ArticleSchema
|
||
{
|
||
/** 同一次请求内是否已检查过(避免每请求重复解析 SQL) */
|
||
private static bool $checked = false;
|
||
|
||
/** 需要补齐的性能索引:表名(不含前缀) => [索引名 => 列定义] */
|
||
private const INDEXES = [
|
||
'articles_article' => [
|
||
// 前台列表:status + delete_at 过滤后按 create_at 排序
|
||
'idx_list' => '`status`,`delete_at`,`create_at`',
|
||
// 后台列表:order is_top desc / is_recommend
|
||
'idx_top' => '`is_top`,`is_recommend`',
|
||
],
|
||
];
|
||
|
||
/**
|
||
* 首访兜底:确保表存在(不补列,同请求只执行一次)
|
||
*/
|
||
public static function ensure(): void
|
||
{
|
||
if (self::$checked) {
|
||
return;
|
||
}
|
||
self::$checked = true;
|
||
self::repair(false);
|
||
}
|
||
|
||
/**
|
||
* 完整自愈:建表(+ 补列 + 补索引)
|
||
*
|
||
* @param bool $withColumns 是否补列与补索引(升级场景传 true)
|
||
*/
|
||
public static function repair(bool $withColumns = true): void
|
||
{
|
||
$file = dirname(__DIR__) . DIRECTORY_SEPARATOR . 'install.sql';
|
||
if (!is_file($file)) {
|
||
return;
|
||
}
|
||
|
||
$content = (string) file_get_contents($file);
|
||
$prefix = self::prefix();
|
||
|
||
// 解析 CREATE TABLE IF NOT EXISTS `__PREFIX__xxx` ( ... ) ENGINE=...;
|
||
preg_match_all(
|
||
'/CREATE TABLE IF NOT EXISTS\s+`__PREFIX__([a-z_]+)`\s*\((.*?)\)\s*ENGINE=[^;]*;/is',
|
||
$content,
|
||
$matches,
|
||
PREG_SET_ORDER
|
||
);
|
||
|
||
foreach ($matches as $m) {
|
||
$table = $prefix . $m[1];
|
||
self::ensureTable($table, str_replace('__PREFIX__', $prefix, $m[0]));
|
||
if ($withColumns) {
|
||
self::ensureColumns($table, $m[2]);
|
||
}
|
||
}
|
||
|
||
if ($withColumns) {
|
||
foreach (self::INDEXES as $table => $indexes) {
|
||
foreach ($indexes as $name => $cols) {
|
||
self::ensureIndex($prefix . $table, $name, $cols);
|
||
}
|
||
}
|
||
|
||
// 全文索引(可选):用于加速搜索,不支持时静默降级(搜索仍走 LIKE)
|
||
self::ensureFulltext($prefix . 'articles_article', 'ft_title_summary', '`title`,`summary`');
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 当前数据库表前缀
|
||
*/
|
||
private static function prefix(): string
|
||
{
|
||
$default = (string) config('database.default', 'mysql');
|
||
return (string) config("database.connections.{$default}.prefix", '');
|
||
}
|
||
|
||
/**
|
||
* 表不存在则建表
|
||
*/
|
||
private static function ensureTable(string $table, string $ddl): void
|
||
{
|
||
try {
|
||
$exists = Db::query("SHOW TABLES LIKE '{$table}'");
|
||
if (empty($exists)) {
|
||
Db::execute($ddl);
|
||
}
|
||
} catch (\Throwable $e) {
|
||
// 建表失败不阻断访问,交由 install/upgrade 流程暴露
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 按 install.sql 的列定义补列(SHOW COLUMNS 比对后 ALTER ADD COLUMN)
|
||
*/
|
||
private static function ensureColumns(string $table, string $body): void
|
||
{
|
||
$exists = [];
|
||
try {
|
||
foreach (Db::query("SHOW COLUMNS FROM `{$table}`") as $row) {
|
||
$exists[strtolower((string) $row['Field'])] = true;
|
||
}
|
||
} catch (\Throwable $e) {
|
||
return; // 表都还没有,交给 ensureTable
|
||
}
|
||
|
||
foreach (preg_split('/\r\n|\r|\n/', $body) as $line) {
|
||
$line = trim($line);
|
||
if ($line === '') {
|
||
continue;
|
||
}
|
||
// 跳过键定义行
|
||
if (preg_match('/^(PRIMARY\s+KEY|UNIQUE\s+KEY|KEY|INDEX|CONSTRAINT|FULLTEXT)\b/i', $line)) {
|
||
continue;
|
||
}
|
||
if (!preg_match('/^`(\w+)`\s+(.+?),?$/s', $line, $m)) {
|
||
continue;
|
||
}
|
||
$col = $m[1];
|
||
if (isset($exists[strtolower($col)])) {
|
||
continue;
|
||
}
|
||
try {
|
||
Db::execute('ALTER TABLE `' . $table . '` ADD COLUMN `' . $col . '` ' . rtrim($m[2], ','));
|
||
} catch (\Throwable $e) {
|
||
// 单列补失败不影响其它列
|
||
}
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 全文索引不存在则添加(中文优先用 ngram 解析器,失败退回默认解析器,再失败则忽略)
|
||
*/
|
||
private static function ensureFulltext(string $table, string $name, string $cols): void
|
||
{
|
||
try {
|
||
foreach (Db::query("SHOW INDEX FROM `{$table}`") as $row) {
|
||
if (($row['Key_name'] ?? '') === $name) {
|
||
return;
|
||
}
|
||
}
|
||
|
||
try {
|
||
Db::execute("ALTER TABLE `{$table}` ADD FULLTEXT INDEX `{$name}` ({$cols}) WITH PARSER ngram");
|
||
} catch (\Throwable $e) {
|
||
// 不支持 ngram(非 MySQL / 版本过旧):退回默认解析器
|
||
Db::execute("ALTER TABLE `{$table}` ADD FULLTEXT INDEX `{$name}` ({$cols})");
|
||
}
|
||
} catch (\Throwable $e) {
|
||
// 不支持全文索引:忽略,搜索自动降级为 LIKE
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 索引不存在则添加
|
||
*/
|
||
private static function ensureIndex(string $table, string $name, string $cols): void
|
||
{
|
||
try {
|
||
foreach (Db::query("SHOW INDEX FROM `{$table}`") as $row) {
|
||
if (($row['Key_name'] ?? '') === $name) {
|
||
return;
|
||
}
|
||
}
|
||
Db::execute("ALTER TABLE `{$table}` ADD INDEX `{$name}` ({$cols})");
|
||
} catch (\Throwable $e) {
|
||
// 索引已存在或不支持时忽略
|
||
}
|
||
}
|
||
}
|