yangwx
18101cf11a
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
292 lines
11 KiB
PHP
292 lines
11 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
declare (strict_types = 1);
|
||
|
||
namespace addon\blog\controller\member;
|
||
|
||
use addon\blog\model\BlogArticle as ArticleModel;
|
||
use addon\blog\model\BlogCategory as CategoryModel;
|
||
use addon\blog\model\BlogTag as TagModel;
|
||
use think\facade\Request;
|
||
use think\facade\View;
|
||
use think\Validate;
|
||
use ywxapp\controller\MemberBase;
|
||
|
||
/**
|
||
* 会员中心文章管理（多用户模式：文章由会员在用户中心发布/管理）
|
||
* 继承 AddonMember，处于 route/app.php 的 member 路由组中，强制会员登录。
|
||
* 文章作者固定为当前登录会员（uid = $this->auth->info->id）。
|
||
*/
|
||
class Article extends MemberBase
|
||
{
|
||
protected $noNeedLogin = [];
|
||
protected $noNeedVerify = [];
|
||
|
||
// 当前登录会员 id（文章作者）；会员主键为 uid，需从模型取 uid
|
||
|
||
protected function uid()
|
||
{
|
||
return $this->auth->model->uid;
|
||
}
|
||
|
||
/**
|
||
* 我的文章列表（ajax 请求返回 layui table 所需 JSON，普通请求渲染视图）
|
||
*/
|
||
public function index()
|
||
{
|
||
$status = Request::param('status', 'all');
|
||
$keyword = Request::param('keyword', '');
|
||
$page = Request::param('page', 1);
|
||
$limit = Request::param('limit', 15);
|
||
|
||
if (Request::isAjax()) {
|
||
$query = ArticleModel::with(['category', 'tags'])->where('uid', $this->uid());
|
||
|
||
if ($status !== 'all') {
|
||
$query->where('status', $status);
|
||
}
|
||
if ($keyword) {
|
||
$query->where('title|content', 'like', "%{$keyword}%");
|
||
}
|
||
|
||
$paginator = $query->order('create_at', 'desc')
|
||
->paginate(['list_rows' => $limit, 'page' => $page]);
|
||
|
||
$rows = [];
|
||
foreach ($paginator->items() as $a) {
|
||
$rows[] = [
|
||
'id' => $a->id,
|
||
'title' => $a->title,
|
||
'is_top' => $a->is_top,
|
||
'category' => $a->category->name ?? '-',
|
||
'status' => $a->status,
|
||
'view_count' => (int) $a->view_count,
|
||
'comment_count' => (int) $a->comment_count,
|
||
'like_count' => (int) $a->like_count,
|
||
'favorite_count' => (int) $a->favorite_count,
|
||
'share_count' => (int) $a->share_count,
|
||
'create_at' => $a->create_at,
|
||
'create_text' => (function ($t) {
|
||
if ($t instanceof \DateTime) return $t->format('Y-m-d H:i');
|
||
if (is_numeric($t)) return date('Y-m-d H:i', (int) $t);
|
||
$ts = strtotime((string) $t);
|
||
return $ts !== false ? date('Y-m-d H:i', $ts) : (string) $t;
|
||
})($a->create_at),
|
||
'detail_url' => (string) url('blog/article/detail', ['id' => $a->id]),
|
||
'edit_url' => (string) url('blog/member.article/edit', ['id' => $a->id]),
|
||
];
|
||
}
|
||
|
||
return json([
|
||
'code' => 0,
|
||
'msg' => '',
|
||
'count' => $paginator->total(),
|
||
'data' => $rows,
|
||
]);
|
||
}
|
||
|
||
return View::fetch('article/index', [
|
||
'status' => $status,
|
||
'keyword' => $keyword,
|
||
]);
|
||
}
|
||
|
||
/**
|
||
* 写文章页面
|
||
*/
|
||
public function create()
|
||
{
|
||
$categories = CategoryModel::getAvailable($this->uid());
|
||
$tags = TagModel::select();
|
||
|
||
return View::fetch('article/create', [
|
||
'categories' => $categories,
|
||
'tags' => $tags,
|
||
]);
|
||
}
|
||
|
||
/**
|
||
* 保存文章（作者为当前会员，不可指定）
|
||
*/
|
||
public function save()
|
||
{
|
||
$data = Request::post();
|
||
$data['uid'] = $this->uid(); // 多用户：作者固定为当前会员
|
||
$data['lat'] = (float) Request::post('lat', 0);
|
||
$data['lng'] = (float) Request::post('lng', 0);
|
||
unset($data['user_id'], $data['tags']);
|
||
|
||
$validate = new Validate([
|
||
'title|标题' => 'require|max:255',
|
||
'content|内容' => 'require',
|
||
'cid|分类' => 'require|number',
|
||
]);
|
||
if (! $validate->check($data)) {
|
||
return json(['code' => 0, 'msg' => $validate->getError()]);
|
||
}
|
||
|
||
$tagIds = $this->parseTags(Request::post('tags'));
|
||
|
||
// 内容审核：开启 need_audit 时进入人工审核队列
|
||
//
|
||
// 注意：这里原先调用 \addon\wxchat\service\AiAuditService::audit()，
|
||
// 但那是 wxchat 的「实名认证」服务（消费 real_name / id_card / 证件照），
|
||
// 与文章内容审核无关，且它是 static::audit(array)，此处还用实例调用了它——
|
||
// 结果就是开启审核后会员发文必然异常。现改为一律转人工复核。
|
||
$needAudit = (int) config('blog.need_audit');
|
||
$auditStatus = 2; // 2=通过
|
||
$auditReason = '';
|
||
if ($needAudit) {
|
||
$auditStatus = 1; // 1=待审，等待后台人工复核
|
||
}
|
||
$data['status'] = ($auditStatus === 2) ? 1 : 0; // 仅通过态对外可见
|
||
$data['audit_status'] = $auditStatus;
|
||
|
||
\addon\blog\library\BlogSchema::ensure();
|
||
$article = ArticleModel::create($data);
|
||
$article->tags()->sync($tagIds);
|
||
\addon\blog\service\BlogSearchService::sync($article->id);
|
||
|
||
if ($auditStatus === 3) {
|
||
return json(['code' => 0, 'msg' => $auditReason, 'url' => (string) url('blog/member/article')]);
|
||
}
|
||
if ($needAudit && $auditStatus === 1) {
|
||
return json(['code' => 1, 'msg' => '发布成功，等待审核', 'url' => (string) url('blog/member/article')]);
|
||
}
|
||
return json(['code' => 1, 'msg' => '文章发布成功', 'url' => (string) url('blog/member/article')]);
|
||
}
|
||
|
||
/**
|
||
* 编辑文章页面（仅能编辑自己的文章）
|
||
*/
|
||
public function edit($id = null)
|
||
{
|
||
$article = ArticleModel::with(['tags'])
|
||
->where('id', $id)
|
||
->where('uid', $this->uid())
|
||
->find();
|
||
if (! $article) {
|
||
return redirect((string) url('blog/member/article'));
|
||
}
|
||
|
||
$categories = CategoryModel::getAvailable($this->uid());
|
||
$tags = TagModel::select();
|
||
$articleTagsStr = implode(',', $article->tags->column('name'));
|
||
|
||
return View::fetch('article/edit', [
|
||
'article' => $article,
|
||
'categories' => $categories,
|
||
'tags' => $tags,
|
||
'articleTagsStr' => $articleTagsStr,
|
||
]);
|
||
}
|
||
|
||
/**
|
||
* 更新文章（仅能更新自己的文章，作者不可改）
|
||
*/
|
||
public function update($id)
|
||
{
|
||
$article = ArticleModel::where('id', $id)
|
||
->where('uid', $this->uid())
|
||
->find();
|
||
if (! $article) {
|
||
return json(['code' => 0, 'msg' => '文章不存在或无权限']);
|
||
}
|
||
|
||
$data = Request::post();
|
||
$data['lat'] = (float) Request::post('lat', $article->lat ?? 0);
|
||
$data['lng'] = (float) Request::post('lng', $article->lng ?? 0);
|
||
unset($data['uid'], $data['user_id'], $data['tags'], $data['tag_names'], $data['id']);
|
||
|
||
$validate = new Validate([
|
||
'title|标题' => 'require|max:255',
|
||
'content|内容' => 'require',
|
||
'cid|分类' => 'require|number',
|
||
]);
|
||
if (! $validate->check($data)) {
|
||
return json(['code' => 0, 'msg' => $validate->getError()]);
|
||
}
|
||
|
||
$tagIds = $this->parseTags(Request::post('tags'));
|
||
$article->save($data);
|
||
$article->tags()->sync($tagIds);
|
||
\addon\blog\service\BlogSearchService::sync($article->id);
|
||
|
||
return json(['code' => 1, 'msg' => '文章更新成功', 'url' => (string) url('blog/member/article')]);
|
||
}
|
||
|
||
/**
|
||
* 删除文章（仅能删除自己的文章）
|
||
*/
|
||
public function delete($id)
|
||
{
|
||
$article = ArticleModel::where('id', $id)
|
||
->where('uid', $this->uid())
|
||
->find();
|
||
if ($article) {
|
||
\addon\blog\service\BlogSearchService::remove($article->id);
|
||
$article->tags()->detach();
|
||
$article->delete();
|
||
return json(['code' => 1, 'msg' => '文章已删除']);
|
||
}
|
||
return json(['code' => 0, 'msg' => '文章不存在或无权限']);
|
||
}
|
||
|
||
/**
|
||
* 批量操作（仅限自己的文章）
|
||
*/
|
||
public function batch()
|
||
{
|
||
$action = Request::post('action');
|
||
$ids = Request::post('ids/a');
|
||
if (empty($ids)) {
|
||
return json(['code' => 0, 'msg' => '请选择文章']);
|
||
}
|
||
|
||
switch ($action) {
|
||
case 'delete':
|
||
$list = ArticleModel::whereIn('id', $ids)->where('uid', $this->uid())->select();
|
||
foreach ($list as $a) {
|
||
$a->tags()->detach();
|
||
$a->delete();
|
||
}
|
||
return json(['code' => 1, 'msg' => '批量删除成功']);
|
||
case 'publish':
|
||
ArticleModel::whereIn('id', $ids)->where('uid', $this->uid())->update(['status' => 1]);
|
||
return json(['code' => 1, 'msg' => '批量发布成功']);
|
||
case 'draft':
|
||
ArticleModel::whereIn('id', $ids)->where('uid', $this->uid())->update(['status' => 0]);
|
||
return json(['code' => 1, 'msg' => '批量设为草稿成功']);
|
||
default:
|
||
return json(['code' => 0, 'msg' => '无效操作']);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 解析标签：逗号分隔的名称 -> 标签 id 数组（不存在则自动创建）
|
||
*/
|
||
protected function parseTags($raw)
|
||
{
|
||
$tagIds = [];
|
||
if (empty($raw)) {
|
||
return $tagIds;
|
||
}
|
||
$names = is_array($raw) ? $raw : explode(',', $raw);
|
||
foreach ($names as $name) {
|
||
$name = trim($name);
|
||
if ($name === '') {
|
||
continue;
|
||
}
|
||
$tag = TagModel::where('name', $name)->find() ?: TagModel::create(['name' => $name]);
|
||
$tagIds[] = $tag->id;
|
||
}
|
||
return $tagIds;
|
||
}
|
||
}
|