安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
152 lines
5.3 KiB
PHP
152 lines
5.3 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
declare (strict_types = 1);
|
||
|
||
namespace addon\blog\controller;
|
||
|
||
use addon\blog\model\BlogArticle;
|
||
use addon\blog\model\BlogCategory;
|
||
use think\facade\Request;
|
||
use ywxapp\controller\FrontendBase;
|
||
|
||
/**
|
||
* 站点地图(前台 SEO 用)
|
||
*
|
||
* 收录范围:首页 / 分类 / 已发布且审核通过的文章(草稿、待审、驳回均不收录)
|
||
*
|
||
* 文章 ≤ 5000:sitemap.xml 直接输出 urlset
|
||
* 文章 > 5000:sitemap.xml 输出 sitemap index,文章拆到 sitemap-<n>.xml
|
||
*/
|
||
class Sitemap extends FrontendBase
|
||
{
|
||
/** 单个 sitemap 文件最多 URL 数 */
|
||
const MAX_PER_FILE = 5000;
|
||
|
||
public function index()
|
||
{
|
||
$base = Request::domain();
|
||
$total = $this->query()->count();
|
||
|
||
$static = [
|
||
['loc' => $base . (string) url('blog/index/index'), 'priority' => '1.0', 'lastmod' => date('Y-m-d')],
|
||
];
|
||
foreach (BlogCategory::where('status', 1)->select() as $c) {
|
||
$static[] = [
|
||
'loc' => $base . (string) url('blog/index/category', ['id' => $c->id]),
|
||
'priority' => '0.6',
|
||
];
|
||
}
|
||
|
||
if ($total > self::MAX_PER_FILE) {
|
||
$pages = (int) ceil($total / self::MAX_PER_FILE);
|
||
$maps = $static;
|
||
for ($i = 1; $i <= $pages; $i++) {
|
||
// 分片 URL 必须手工拼接:url() 会追加 .html 后缀,不能用于 .xml
|
||
$maps[] = [
|
||
'loc' => $base . '/blog/sitemap-' . $i . '.xml',
|
||
'lastmod' => date('Y-m-d'),
|
||
'priority' => '0.8',
|
||
];
|
||
}
|
||
return response(self::renderIndex($maps), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
$items = $static;
|
||
foreach ($this->query()->field('id,update_at')->order('create_at', 'desc')->select() as $a) {
|
||
$items[] = [
|
||
'loc' => $base . (string) url('blog/article/detail', ['id' => $a->id]),
|
||
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
|
||
'priority' => '0.8',
|
||
];
|
||
}
|
||
|
||
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
/**
|
||
* 文章分片:/blog/sitemap-<page>.xml
|
||
*/
|
||
public function chunk($page = 1)
|
||
{
|
||
$page = max(1, (int) $page);
|
||
$base = Request::domain();
|
||
$total = $this->query()->count();
|
||
$pages = max(1, (int) ceil($total / self::MAX_PER_FILE));
|
||
|
||
if ($page > $pages) {
|
||
return response(self::renderUrlset([]), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
$articles = $this->query()
|
||
->field('id,update_at')
|
||
->order('create_at', 'desc')
|
||
->page($page, self::MAX_PER_FILE)
|
||
->select();
|
||
|
||
$items = [];
|
||
foreach ($articles as $a) {
|
||
$items[] = [
|
||
'loc' => $base . (string) url('blog/article/detail', ['id' => $a->id]),
|
||
'lastmod' => date('Y-m-d', (int) $a->update_at ?: time()),
|
||
'priority' => '0.8',
|
||
];
|
||
}
|
||
|
||
return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
|
||
}
|
||
|
||
/**
|
||
* 对外可见文章的查询条件:已发布 + 审核通过 + 未删除
|
||
*/
|
||
private function query()
|
||
{
|
||
return BlogArticle::where('status', 1)->where('audit_status', 2);
|
||
}
|
||
|
||
private static function renderUrlset(array $items): string
|
||
{
|
||
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
|
||
. '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
|
||
|
||
foreach ($items as $item) {
|
||
$xml .= " <url>\n";
|
||
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
|
||
if (!empty($item['lastmod'])) {
|
||
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
|
||
}
|
||
$xml .= ' <priority>' . ($item['priority'] ?? '0.5') . "</priority>\n";
|
||
$xml .= " </url>\n";
|
||
}
|
||
|
||
return $xml . '</urlset>';
|
||
}
|
||
|
||
private static function renderIndex(array $items): string
|
||
{
|
||
$xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
|
||
. '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
|
||
|
||
foreach ($items as $item) {
|
||
$xml .= " <sitemap>\n";
|
||
$xml .= ' <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
|
||
if (!empty($item['lastmod'])) {
|
||
$xml .= ' <lastmod>' . $item['lastmod'] . "</lastmod>\n";
|
||
}
|
||
$xml .= " </sitemap>\n";
|
||
}
|
||
|
||
return $xml . '</sitemapindex>';
|
||
}
|
||
|
||
private static function esc(string $value): string
|
||
{
|
||
return htmlspecialchars($value, ENT_XML1 | ENT_QUOTES, 'UTF-8');
|
||
}
|
||
}
|