安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
164 lines
5.0 KiB
PHP
164 lines
5.0 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
declare (strict_types = 1);
|
||
|
||
namespace addon\articles\service;
|
||
|
||
/**
|
||
* 正文渲染服务(输出期增强,不改动入库内容)
|
||
*
|
||
* 三件事:
|
||
* 1. 图片懒加载:给 <img> 加 loading="lazy" decoding="async"
|
||
* 2. WebP:浏览器支持时把站内图片替换为 .webp 副本(见 ImageService)
|
||
* 3. 内链:把命中的关键词(如本文标签)替换为站内链接,利于收录与导流
|
||
*
|
||
* 全部基于 DOM 操作,不会破坏原有 HTML 结构;DOM 不可用时原样返回。
|
||
*/
|
||
class ContentRenderService
|
||
{
|
||
/** 单篇文章最多生成的内链数 */
|
||
const MAX_LINKS = 5;
|
||
|
||
/**
|
||
* 渲染正文
|
||
*
|
||
* @param string $html 已净化的正文
|
||
* @param array $linkKeywords [关键词 => 链接地址]
|
||
* @param bool $useWebp 是否启用 WebP 替换
|
||
*/
|
||
public static function render(string $html, array $linkKeywords = [], bool $useWebp = false): string
|
||
{
|
||
$html = trim($html);
|
||
if ($html === '' || !class_exists('DOMDocument')) {
|
||
return $html;
|
||
}
|
||
|
||
$prev = libxml_use_internal_errors(true);
|
||
$doc = new \DOMDocument('1.0', 'UTF-8');
|
||
$loaded = $doc->loadHTML('<?xml encoding="UTF-8">' . $html);
|
||
libxml_clear_errors();
|
||
libxml_use_internal_errors($prev);
|
||
|
||
if (!$loaded) {
|
||
return $html;
|
||
}
|
||
|
||
$body = $doc->getElementsByTagName('body')->item(0);
|
||
if (!$body) {
|
||
return $html;
|
||
}
|
||
|
||
self::enhanceImages($doc, $useWebp);
|
||
|
||
if (!empty($linkKeywords)) {
|
||
self::linkKeywords($doc, $linkKeywords);
|
||
}
|
||
|
||
$out = '';
|
||
foreach ($body->childNodes as $child) {
|
||
$out .= $doc->saveHTML($child);
|
||
}
|
||
|
||
return trim($out);
|
||
}
|
||
|
||
/**
|
||
* 图片增强:懒加载 + WebP
|
||
*/
|
||
private static function enhanceImages(\DOMDocument $doc, bool $useWebp): void
|
||
{
|
||
$images = [];
|
||
foreach ($doc->getElementsByTagName('img') as $img) {
|
||
$images[] = $img;
|
||
}
|
||
|
||
foreach ($images as $img) {
|
||
$img->setAttribute('loading', 'lazy');
|
||
$img->setAttribute('decoding', 'async');
|
||
|
||
if (!$useWebp) {
|
||
continue;
|
||
}
|
||
|
||
$src = (string) $img->getAttribute('src');
|
||
$webp = ImageService::webpUrl($src);
|
||
if ($webp !== '') {
|
||
$img->setAttribute('src', $webp);
|
||
}
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 内链替换(跳过已在 <a> 内的文本,避免链接套链接)
|
||
*/
|
||
private static function linkKeywords(\DOMDocument $doc, array $keywords): void
|
||
{
|
||
$xpath = new \DOMXPath($doc);
|
||
$nodes = $xpath->query('//text()[not(ancestor::a)]');
|
||
if (!$nodes || $nodes->length === 0) {
|
||
return;
|
||
}
|
||
|
||
// 先快照,避免替换过程中结构变化影响遍历
|
||
$list = [];
|
||
foreach ($nodes as $node) {
|
||
$list[] = $node;
|
||
}
|
||
|
||
$used = [];
|
||
$count = 0;
|
||
|
||
foreach ($list as $node) {
|
||
if ($count >= self::MAX_LINKS) {
|
||
break;
|
||
}
|
||
|
||
$text = (string) $node->nodeValue;
|
||
if (mb_strlen(trim($text), 'UTF-8') < 2) {
|
||
continue;
|
||
}
|
||
|
||
foreach ($keywords as $kw => $url) {
|
||
$kw = (string) $kw;
|
||
if ($count >= self::MAX_LINKS || isset($used[$kw]) || mb_strlen($kw, 'UTF-8') < 2) {
|
||
continue;
|
||
}
|
||
|
||
$pos = mb_stripos($text, $kw, 0, 'UTF-8');
|
||
if ($pos === false) {
|
||
continue;
|
||
}
|
||
|
||
$before = mb_substr($text, 0, $pos, 'UTF-8');
|
||
$after = mb_substr($text, $pos + mb_strlen($kw, 'UTF-8'), null, 'UTF-8');
|
||
|
||
$a = $doc->createElement('a', htmlspecialchars($kw, ENT_QUOTES, 'UTF-8'));
|
||
$a->setAttribute('href', (string) $url);
|
||
$a->setAttribute('class', 'article-inner-link');
|
||
|
||
$frag = $doc->createDocumentFragment();
|
||
$frag->appendChild($doc->createTextNode($before));
|
||
$frag->appendChild($a);
|
||
$frag->appendChild($doc->createTextNode($after));
|
||
|
||
$parent = $node->parentNode;
|
||
if (!$parent) {
|
||
continue;
|
||
}
|
||
$parent->replaceChild($frag, $node);
|
||
|
||
$used[$kw] = true;
|
||
$count++;
|
||
|
||
break; // 每个文本节点只处理一个关键词
|
||
}
|
||
}
|
||
}
|
||
}
|