yangwx
18101cf11a
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
119 lines
5.8 KiB
PHP
119 lines
5.8 KiB
PHP
<?php
|
||
/*
|
||
* @Author: YwxApp <ywx@ywxapp.cn>
|
||
* @Date: 2026-08-10 15:26:18
|
||
* @LastEditors: YwxApp <ywx@ywxapp.cn>
|
||
* @LastEditTime: 2026-08-15 10:14:11
|
||
* @Description:
|
||
* @FilePath: \ywxapp_dev\addon\articles\route\app.php
|
||
* @CustomString: Copyright (c) 2026 YwxApp
|
||
*/
|
||
// +----------------------------------------------------------------------
|
||
// | 文章CMS插件路由：相对路由，由 AppService::loadAddonRoutes 统一补 articles 前缀
|
||
// | 约定：不要用 Route::group('articles') 再包一层（外层已补前缀，会双重前缀）
|
||
// +----------------------------------------------------------------------
|
||
use think\facade\Route;
|
||
|
||
// 前台（相对规则，由外层 Route::group('articles') 统一补全前缀，url() 用 articles/xxx/index 生成）
|
||
Route::get('index/index', 'addon\articles\controller\Index@index');
|
||
Route::get('read/:id', 'addon\articles\controller\Article@read');
|
||
Route::get('article/detail/:id', 'addon\articles\controller\Article@detail');
|
||
Route::get('category/index', 'addon\articles\controller\Category@index');
|
||
Route::get('category/:id', 'addon\articles\controller\Category@index');
|
||
Route::get('tag/index', 'addon\articles\controller\Tag@index');
|
||
Route::get('tag/:id', 'addon\articles\controller\Tag@index');
|
||
Route::get('search/index', 'addon\articles\controller\Article@search');
|
||
|
||
// 专题聚合页
|
||
Route::get('topic', 'addon\articles\controller\Topic@index');
|
||
Route::get('topic/index', 'addon\articles\controller\Topic@index');
|
||
Route::get('topic/:id', 'addon\articles\controller\Topic@detail');
|
||
Route::post('article/comment', 'addon\articles\controller\Article@comment');
|
||
Route::post('article/like', 'addon\articles\controller\Article@like');
|
||
Route::post('article/favorite', 'addon\articles\controller\Article@favorite');
|
||
|
||
// SEO：站点地图（文章 > 5000 条时 sitemap.xml 输出 index，文章拆到 sitemap-<n>.xml）
|
||
Route::get('sitemap.xml', 'addon\articles\controller\Sitemap@index');
|
||
Route::get('sitemap-:page.xml', 'addon\articles\controller\Sitemap@chunk');
|
||
|
||
// 对外 API（/articles/api/...，继承 ApiBase，走 JWT 登录态；游客可访问列表/详情/搜索）
|
||
Route::group('api', function () {
|
||
Route::get('articles', 'api.Article/index');
|
||
Route::get('article/:id', 'api.Article/read');
|
||
Route::get('categories', 'api.Article/categories');
|
||
Route::get('tags', 'api.Article/tags');
|
||
Route::get('search', 'api.Article/search');
|
||
Route::post('comment', 'api.Article/comment');
|
||
});
|
||
|
||
// 会员中心投稿（/articles/member/article/...，必须登录，投稿后为待审核状态）
|
||
Route::group('member', function () {
|
||
Route::get('article/index', 'Article/index');
|
||
Route::get('article/add', 'Article/add');
|
||
Route::get('article/edit', 'Article/edit');
|
||
Route::post('article/save', 'Article/save');
|
||
Route::post('article/delete', 'Article/delete');
|
||
})->layer('member');
|
||
|
||
// 后台
|
||
// 实测结论（已校准，勿改回点号）：
|
||
// 1. 真实 URL 是【斜杠】形式 —— /articles/backend/article/index.html
|
||
// （外层 Route::group('articles') 只补插件名前缀，不会把 backend 拼成带点形式）
|
||
// 2. 早期注释里"拼成带点形式 / 斜杠恒 404 / 必须用点号"的说法已过时。点号 URL
|
||
// （articles/backend.article/index）匹配不到已注册规则 → 走兜底控制器解析：
|
||
// Windows 下文件名大小写不敏感可能碰巧命中，Linux 必然 404；且兜底不校验 HTTP
|
||
// 方法，会让 Route::post('article/delete') 的方法限制失效（GET 即可删除）。
|
||
// 3. 故：menu.json 的 route、视图 {:url('articles/backend/xxx/yyy')}、
|
||
// 控制器的跳转/返回 url 一律用斜杠形式。
|
||
// 4. 不能用 wxchat 的 ->prefix('backend/') 写法——本插件后台控制器已在
|
||
// controller/backend/ 子目录，prefix 会让 TP 解析成 backend/backend/Category 导致 500。
|
||
// 5. ->layer('backend') 负责把 'Article/index' 解析到 controller/backend/Article.php。
|
||
|
||
Route::group('backend', function () {
|
||
// 无 index 段的等价形态（兼容控制器/模板里的 '/articles/backend/article' 旧跳转）
|
||
Route::get('article', 'Article/index');
|
||
Route::get('tag', 'Tag/index');
|
||
Route::get('category', 'Category/index');
|
||
|
||
Route::get('dashboard/index', 'Dashboard/index');
|
||
Route::get('dashboard', 'Dashboard/index');
|
||
|
||
Route::get('article/index', 'Article/index');
|
||
Route::any('article/save', 'Article/save');
|
||
Route::get('article/edit', 'Article/edit');
|
||
Route::post('article/update', 'Article/update');
|
||
Route::post('article/delete', 'Article/delete');
|
||
Route::post('article/batchDelete', 'Article/batchDelete');
|
||
Route::post('article/batchStatus', 'Article/batchStatus');
|
||
Route::post('article/audit', 'Article/audit');
|
||
Route::post('article/recyclebin', 'Article/recyclebin');
|
||
Route::post('article/restore', 'Article/restore');
|
||
|
||
Route::get('tag/index', 'Tag/index');
|
||
Route::any('tag/save', 'Tag/save');
|
||
Route::get('tag/edit', 'Tag/edit');
|
||
Route::post('tag/update', 'Tag/update');
|
||
Route::post('tag/delete', 'Tag/delete');
|
||
|
||
Route::get('comment/index', 'Comment/index');
|
||
Route::post('comment/audit', 'Comment/audit');
|
||
Route::post('comment/delete', 'Comment/delete');
|
||
|
||
Route::get('topic/index', 'Topic/index');
|
||
Route::any('topic/save', 'Topic/save');
|
||
Route::get('topic/edit', 'Topic/edit');
|
||
Route::post('topic/update', 'Topic/update');
|
||
Route::post('topic/delete', 'Topic/delete');
|
||
|
||
Route::get('attachment/index', 'Attachment/index');
|
||
Route::post('attachment/upload', 'Attachment/upload');
|
||
Route::post('attachment/delete', 'Attachment/delete');
|
||
|
||
Route::get('category/index', 'Category/index');
|
||
Route::any('category/save', 'Category/save');
|
||
Route::get('category/edit', 'Category/edit');
|
||
Route::post('category/update', 'Category/update');
|
||
Route::post('category/delete', 'Category/delete');
|
||
|
||
})->layer('backend');;
|
||
|