安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
110 lines
4.8 KiB
PHP
110 lines
4.8 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace addon\haonav\controller\trait;
|
|
|
|
use think\exception\ValidateException;
|
|
use addon\haonav\model\Configure as ConfigureModel;
|
|
use addon\haonav\model\Links as LinksModel;
|
|
use addon\haonav\model\Ad as AdModel;
|
|
use addon\haonav\model\Apply as ApplyModel;
|
|
|
|
/**
|
|
* 投稿 + 自助申请(友链 / 广告合作)
|
|
* - submit:老投稿(POST 保留,向 301 apply 迁移)
|
|
* - apply:新自助申请页(蜜罐 + IP 限频 + URL 去重)
|
|
*/
|
|
trait ApplyTrait
|
|
{
|
|
/**
|
|
* 网址投稿(公开,提交后进入待审核 status=2)
|
|
* POST:保留以兼容外部老表单 / API
|
|
* GET:投稿已并入「申请收录 / 广告合作」,301 永久迁移
|
|
*/
|
|
public function submit()
|
|
{
|
|
if ($this->request->isPost()) {
|
|
$params = $this->request->post();
|
|
try {
|
|
validate(\addon\haonav\validate\Link::class)->check($params);
|
|
} catch (ValidateException $e) {
|
|
return $this->result->error('数据验证失败: ' . $e->getMessage());
|
|
}
|
|
$enable = (int)ConfigureModel::getVal('enable_submit', '1');
|
|
$model = new LinksModel();
|
|
$model->cid = $params['cid'];
|
|
$model->title = $params['title'];
|
|
$model->url = $params['url'];
|
|
$model->description = $params['description'] ?? '';
|
|
$model->keywords = $params['keywords'] ?? '';
|
|
$model->status = $enable ? 2 : 1; // 待审核 or 直接上架
|
|
$model->save();
|
|
return $this->result->success([], $enable ? '提交成功,等待管理员审核' : '提交成功');
|
|
}
|
|
|
|
$this->redirect(url('haonav/apply'), 301);
|
|
return;
|
|
}
|
|
|
|
/**
|
|
* 友链/广告合作自助申请(公开)
|
|
* GET 渲染表单页;POST 提交入库(待审核),后台「申请审核」处理。
|
|
* 防滥用:蜜罐字段 + 同 IP 限频(1小时5条)+ 同 URL 去重。
|
|
*/
|
|
public function apply()
|
|
{
|
|
if ($this->request->isPost()) {
|
|
// 蜜罐:正常用户不可见不填写,机器人常会填
|
|
if ((string)$this->request->post('website', '') !== '') {
|
|
return $this->result->success([], '提交成功,等待管理员审核');
|
|
}
|
|
$type = (int)$this->request->post('type/d', ApplyModel::TYPE_LINK);
|
|
$title = trim((string)$this->request->post('title', ''));
|
|
$url = trim((string)$this->request->post('url', ''));
|
|
$desc = trim((string)$this->request->post('description', ''));
|
|
$contact = trim((string)$this->request->post('contact', ''));
|
|
$slot = trim((string)$this->request->post('slot', ''));
|
|
|
|
if (!in_array($type, [ApplyModel::TYPE_LINK, ApplyModel::TYPE_AD], true)) {
|
|
return $this->result->error('申请类型错误');
|
|
}
|
|
if ($title === '' || mb_strlen($title) > 100) {
|
|
return $this->result->error('请填写正确的名称(100字以内)');
|
|
}
|
|
if (!filter_var($url, FILTER_VALIDATE_URL) || !preg_match('#^https?://#i', $url)) {
|
|
return $this->result->error('请填写正确的网址(http/https 开头)');
|
|
}
|
|
if ($contact === '' || mb_strlen($contact) > 100) {
|
|
return $this->result->error('请留下联系方式,便于审核后联系您');
|
|
}
|
|
if ($type === ApplyModel::TYPE_AD && $slot !== '' && !array_key_exists($slot, AdModel::slots())) {
|
|
return $this->result->error('意向广告位不存在');
|
|
}
|
|
|
|
$ip = (string)$this->request->ip();
|
|
if (ApplyModel::ipOverLimit($ip)) {
|
|
return $this->result->error('提交过于频繁,请稍后再试');
|
|
}
|
|
if (ApplyModel::urlExists($url)) {
|
|
return $this->result->error('该网址已提交过申请,请勿重复提交');
|
|
}
|
|
|
|
$model = new ApplyModel();
|
|
$model->type = $type;
|
|
$model->title = $title;
|
|
$model->url = $url;
|
|
$model->description = mb_substr($desc, 0, 500);
|
|
$model->contact = $contact;
|
|
$model->slot = $type === ApplyModel::TYPE_AD ? $slot : '';
|
|
$model->ip = $ip;
|
|
$model->status = ApplyModel::STATUS_PENDING;
|
|
$model->save();
|
|
return $this->result->success([], '提交成功,管理员审核后会通过您留下的联系方式回复');
|
|
}
|
|
|
|
$this->view->assign('slots', AdModel::slots());
|
|
$this->view->assign('config', $this->siteConfig());
|
|
$this->assignSeo();
|
|
return $this->view->fetch('apply');
|
|
}
|
|
} |