Files
YwxAppThink/addon/haonav/model/Configure.php
T
yangwx 18101cf11a feat: 上线前安全加固与发布工程化;appmall 由插件迁移为独立应用
安全(P0)
- 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签
  (ywxapp.framework_package_verify,默认开启)
- JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive
- 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php)
- 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
2026-10-22 00:53:39 +08:00

154 lines
6.1 KiB
PHP
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
// +----------------------------------------------------------------------
// | YwxApp [ WE CAN DO IT JUST THINK ]
// +----------------------------------------------------------------------
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
// +----------------------------------------------------------------------
// | Author: ywxapp<admin@ywxapp.cn>
// +----------------------------------------------------------------------
declare (strict_types = 1);
namespace addon\haonav\model;
use ywxapp\model\BaseModel;
class Configure extends BaseModel
{
protected function getOptions(): array
{
// 所有的参数配置统一返回
return [
'strict' => false,
'name' => 'haonav_config',
'autoRelation' => [],
'createTime' => 'create_at',
'updateTime' => 'update_at',
'dateFormat' => 'Y-m-d H:i:s',
];
}
/**
* 读取单个配置值
* @param string $name
* @param mixed $default
* @return mixed
*/
public static function getVal(string $name, $default = '')
{
static $cache = [];
if (array_key_exists($name, $cache)) {
return $cache[$name];
}
$val = self::where('name', $name)->value('value');
$val = $val === null ? $default : $val;
$cache[$name] = $val;
return $val;
}
/**
* 读取全部配置为 name => value 数组
* @return array
*/
public static function getAll(): array
{
return self::column('value', 'name');
}
/**
* 老库结构自愈:早期 install.sql 的 config 表 id 无 PRIMARY KEY/AUTO_INCREMENT,
* create() 不带 id 会报 1364 Field 'id' doesn't have a default value,此处运行时修复。
*/
protected static function ensurePk(): void
{
static $done = false;
if ($done) {
return;
}
self::ensureAutoIncrementPk('wxapp_haonav_config');
$done = true;
}
/**
* 返利配置自愈:老库安装时 install.sql 尚未含这 3 行,访问配置页时补种,
* 保证后台「返利」分组始终可配置(INSERT 幂等,按 name 判重)。
*/
public static function ensureRebateConfig(): void
{
self::ensurePk();
$defaults = [
'enable_rebate' => ['返利', '开启返利PID', '开启后,命中适用域名的链接点击将自动拼接返利PID', 'radio', '0', '1,0'],
'rebate_param' => ['返利', '返利参数名', '拼接在网址后的参数名,默认 pid', 'string', 'pid', ''],
'rebate_domains' => ['返利', '返利适用域名', '仅这些域名(含子域名)会拼接返利PID,逗号或换行分隔,如 taobao.com,jd.com,pinduoduo.com', 'textarea', 'taobao.com,jd.com,pinduoduo.com', ''],
];
foreach ($defaults as $name => $cfg) {
if (self::where('name', $name)->count() === 0) {
self::create([
'name' => $name,
'group' => $cfg[0],
'title' => $cfg[1],
'tip' => $cfg[2],
'type' => $cfg[3],
'value' => $cfg[4],
'content' => $cfg[5],
]);
}
}
}
/**
* 外观背景配置自愈:背景图片 / 遮罩 / 随机变换色(老库补种,幂等)。
*/
public static function ensureAppearanceConfig(): void
{
self::ensurePk();
$defaults = [
'bg_image' => ['外观', '背景图片', '全站默认背景图片地址(URL),留空使用默认渐变;访客也可在页面右下角主题面板自定义', 'string', '', ''],
'bg_mask' => ['外观', '图片遮罩不透明度(%)', '背景图片上叠加遮罩的强度(0-90),越大文字越清晰、图片越淡,建议 20-50', 'number', '35', ''],
'bg_random' => ['外观', '随机变换背景色', '开启后,未自定义背景的访客每次访问随机展示一组渐变背景色', 'radio', '0', '1,0'],
'festival_theme' => ['外观', '节日主题自动换装', '春节/中秋/国庆/圣诞等节日当天自动切换节日专属背景、主色与飘落装饰,访客可自行关闭', 'radio', '1', '1,0'],
];
foreach ($defaults as $name => $cfg) {
if (self::where('name', $name)->count() === 0) {
self::create([
'name' => $name,
'group' => $cfg[0],
'title' => $cfg[1],
'tip' => $cfg[2],
'type' => $cfg[3],
'value' => $cfg[4],
'content' => $cfg[5],
]);
}
}
}
/**
* 死链自动下线配置自愈:老库安装时 install.sql 尚未含这 3 行,访问配置页时补种,
* 保证后台「导航配置」的 task 分组始终可配置(INSERT 幂等,按 name 判重)。
*/
public static function ensureDeadlinkConfig(): void
{
self::ensurePk();
$defaults = [
'deadlink_auto' => ['task', '死链自动下线', '连续检测失败达阈值后,自动将链接置为禁用(下线)', 'radio', '0', '1,0'],
'deadlink_threshold' => ['task', '下线阈值(连续失败次数)', '达到该连续失败次数才下线,避免单次网络抖动误杀(建议2)', 'number', '2', ''],
'deadlink_recover' => ['task', '死链恢复自动上线', '链接重新可达时自动恢复为启用(仅对检测器自动下线的链接生效)', 'radio', '0', '1,0'],
];
foreach ($defaults as $name => $cfg) {
if (self::where('name', $name)->count() === 0) {
self::create([
'name' => $name,
'group' => $cfg[0],
'title' => $cfg[1],
'tip' => $cfg[2],
'type' => $cfg[3],
'value' => $cfg[4],
'content' => $cfg[5],
]);
}
}
}
}