安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
191 lines
6.0 KiB
PHP
191 lines
6.0 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace addon\haonav\controller\backend;
|
||
|
||
use think\facade\Db;
|
||
use addon\haonav\model\Ad as AdModel;
|
||
|
||
/**
|
||
* 广告位后台管理
|
||
*/
|
||
class Ad extends HaonavBackend
|
||
{
|
||
|
||
protected $noNeedVerify = [];
|
||
|
||
protected function initialize()
|
||
{
|
||
$this->model = new AdModel();
|
||
}
|
||
|
||
public function index()
|
||
{
|
||
if ($this->request->isAjax()) {
|
||
$slot = $this->request->param('slot', '');
|
||
$status = $this->request->param('status', '');
|
||
$page = $this->request->param('page/d', 1);
|
||
$limit = $this->request->param('limit/d', 20);
|
||
$data = $this->model
|
||
->when($slot, fn($q, $s) => $q->where('slot', $s))
|
||
->when($status !== '', fn($q, $s) => $q->where('status', $s))
|
||
->order('slot')->order('sort', 'desc')->order('id', 'desc')
|
||
->paginate(['page' => $page, 'list_rows' => $limit]);
|
||
$this->result->setCount($data->total());
|
||
$this->result->success($data->items());
|
||
}
|
||
return $this->view->fetch('ad/index');
|
||
}
|
||
|
||
/**
|
||
* 表单下拉数据(广告位列表)
|
||
*/
|
||
public function create()
|
||
{
|
||
if ($this->request->isAjax()) {
|
||
$slots = [];
|
||
foreach (AdModel::slots() as $k => $v) {
|
||
$slots[] = ['id' => $k, 'title' => $v];
|
||
}
|
||
// 直接返回数组,前端 res.data 即数组(勿再包 data)
|
||
$this->result->success($slots);
|
||
}
|
||
}
|
||
|
||
public function save()
|
||
{
|
||
if (! $this->request->isPost()) {
|
||
return $this->result->error('请求方式错误');
|
||
}
|
||
$post = $this->request->post();
|
||
$this->normalizeDates($post);
|
||
Db::startTrans();
|
||
try {
|
||
$this->model->save($post);
|
||
AdModel::clearCache();
|
||
Db::commit();
|
||
$this->result->success($this->model, '保存成功');
|
||
} catch (\Exception $e) {
|
||
Db::rollback();
|
||
$this->result->error('保存失败: ' . $e->getMessage());
|
||
}
|
||
}
|
||
|
||
public function edit($id = 0)
|
||
{
|
||
$id = $this->request->param('id');
|
||
$model = $this->model->find($id);
|
||
if (! $model) {
|
||
return $this->result->error('数据不存在');
|
||
}
|
||
if ($this->request->isAjax()) {
|
||
$slots = [];
|
||
foreach (AdModel::slots() as $k => $v) {
|
||
$slots[] = ['id' => $k, 'title' => $v];
|
||
}
|
||
$info = $model->toArray();
|
||
$info['start_at_text'] = $model->start_at ? date('Y-m-d H:i:s', (int)$model->start_at) : '';
|
||
$info['end_at_text'] = $model->end_at ? date('Y-m-d H:i:s', (int)$model->end_at) : '';
|
||
$this->result->success(['info' => $info, 'slots' => $slots]);
|
||
}
|
||
}
|
||
|
||
public function update()
|
||
{
|
||
if (! ($this->request->isAjax() && $this->request->isPut())) {
|
||
return $this->result->error('请求方式错误');
|
||
}
|
||
$id = $this->request->param('id');
|
||
$post = $this->request->param();
|
||
$this->normalizeDates($post);
|
||
Db::startTrans();
|
||
try {
|
||
$model = $this->model->find($id);
|
||
if (! $model) {
|
||
throw new \think\exception\ValidateException('数据不存在');
|
||
}
|
||
$model->save($post);
|
||
AdModel::clearCache();
|
||
Db::commit();
|
||
$this->result->success($model, '更新成功');
|
||
} catch (\Exception $e) {
|
||
Db::rollback();
|
||
$this->result->error('更新失败: ' . $e->getMessage());
|
||
}
|
||
}
|
||
|
||
public function delete()
|
||
{
|
||
$ids = (string)$this->request->param('ids', '');
|
||
$arr = array_values(array_filter(array_map('intval', explode(',', $ids))));
|
||
if (empty($arr)) {
|
||
return $this->result->error('请选择数据');
|
||
}
|
||
$this->model->whereIn('id', $arr)->delete();
|
||
AdModel::clearCache();
|
||
$this->result->success([], '已删除');
|
||
}
|
||
|
||
/**
|
||
* 状态开关(列表内 switch)
|
||
*/
|
||
public function status()
|
||
{
|
||
if (! ($this->request->isAjax() && $this->request->isPost())) {
|
||
return $this->result->error('请求方式错误');
|
||
}
|
||
$id = (int)$this->request->param('id');
|
||
$status = (int)$this->request->param('status');
|
||
$model = $this->model->find($id);
|
||
if (! $model) {
|
||
return $this->result->error('数据不存在');
|
||
}
|
||
$model->status = $status;
|
||
$model->save();
|
||
AdModel::clearCache();
|
||
$this->result->success([], '操作成功');
|
||
}
|
||
|
||
/**
|
||
* 排序(列表内行内编辑)
|
||
*/
|
||
public function sort()
|
||
{
|
||
if (! ($this->request->isAjax() && $this->request->isPost())) {
|
||
return $this->result->error('请求方式错误');
|
||
}
|
||
$id = (int)$this->request->param('id');
|
||
$sort = (int)$this->request->param('sort', 0);
|
||
$model = $this->model->find($id);
|
||
if ($model) {
|
||
$model->sort = $sort;
|
||
$model->save();
|
||
AdModel::clearCache();
|
||
}
|
||
$this->result->success([], '已保存');
|
||
}
|
||
|
||
/**
|
||
* 将日期字符串转为时间戳;空值置 null
|
||
*/
|
||
protected function normalizeDates(array &$post): void
|
||
{
|
||
foreach (['start_at', 'end_at'] as $k) {
|
||
if (empty($post[$k])) {
|
||
$post[$k] = null;
|
||
} else {
|
||
$t = strtotime((string)$post[$k]);
|
||
$post[$k] = $t === false ? null : $t;
|
||
}
|
||
}
|
||
}
|
||
}
|