Files
YwxAppThink/app/appmall/view/developer/mine.html
T
yangwx 18101cf11a feat: 上线前安全加固与发布工程化;appmall 由插件迁移为独立应用
安全(P0)
- 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签
  (ywxapp.framework_package_verify,默认开启)
- JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive
- 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php)
- 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
2026-10-22 00:53:39 +08:00

96 lines
4.5 KiB
HTML

<!--
* @Author: YwxApp <ywx@ywxapp.cn>
* @Date: 2026-07-21 13:40:36
* @LastEditors: YwxApp <ywx@ywxapp.cn>
* @LastEditTime: 2026-07-26 15:36:01
* @Description:
* @FilePath: \ywxapp_dev\app\appmall\view\frontend\developer\mine.html
* @CustomString: Copyright (c) 2026 YwxApp
-->
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="utf-8">
<title>查询我的令牌 - YwxApp 应用市场</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="/assets/layui/css/layui.css" rel="stylesheet">
<link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
<style>
body { background: #f2f3f5; margin: 0; }
.topbar { height: 52px; background: #fff; border-bottom: 1px solid #ebedf0; display: flex; align-items: center; padding: 0 22px; }
.topbar .brand { font-size: 16px; font-weight: 700; display: flex; align-items: center; gap: 8px; }
.topbar .brand .logo { width: 24px; height: 24px; border-radius: 6px; background: linear-gradient(135deg, #1677ff, #36cfc9); color: #fff; display: inline-flex; align-items: center; justify-content: center; font-size: 14px; }
.topbar .brand small { font-weight: 400; color: #8a919f; font-size: 13px; }
.topbar .spacer { flex: 1; }
.dev-box { max-width: 460px; margin: 48px auto; background: #fff; padding: 30px 35px; border-radius: 8px; box-shadow: 0 2px 12px rgba(0,0,0,.08); }
.dev-box h2 { text-align: center; margin-bottom: 6px; }
.dev-tip { text-align: center; color: #999; margin-bottom: 22px; font-size: 13px; }
.dev-token { background: #f4f4f4; padding: 12px; border-radius: 6px; word-break: break-all; font-family: monospace; }
</style>
</head>
<body>
<div class="topbar">
<div class="brand"><span class="logo">Y</span>YwxApp 应用市场<small>开发者中心</small></div>
<div class="spacer"></div>
<a href="{:url('console')}" class="layui-btn layui-btn-sm layui-btn-normal">进入开发者中心</a>
</div>
<div class="dev-box">
<h2>查询我的令牌</h2>
<p class="dev-tip">输入注册邮箱,取回你的开发者令牌(若已激活将重新邮件发送)</p>
<form class="layui-form" id="lookupForm">
<div class="layui-form-item">
<label class="layui-form-label">邮箱</label>
<div class="layui-input-block">
<input type="email" name="email" required lay-verify="email" placeholder="注册时填写的邮箱" class="layui-input">
</div>
</div>
<div class="layui-form-item">
<div class="layui-input-block">
<button class="layui-btn layui-btn-fluid" lay-submit lay-filter="lookup">查询令牌</button>
</div>
</div>
</form>
<div id="result" style="display:none; margin-top:20px;">
<div id="resultMsg" class="layui-bg-blue" style="padding:10px 12px;border-radius:6px;margin-bottom:12px;"></div>
<div id="tokenWrap" style="display:none;">
<label class="layui-form-label" style="text-align:left;padding-left:0;">你的开发者令牌</label>
<div class="dev-token" id="tokenVal"></div>
<button class="layui-btn layui-btn-sm layui-btn-normal" id="copyBtn" style="margin-top:10px;">复制令牌</button>
</div>
</div>
<p class="dev-tip" style="margin-top:18px;"><a href="{:url('index')}">返回开发者注册</a></p>
</div>
<script src="/assets/layui/layui.js"></script>
<script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
<script>
layui.use(['form', 'jquery', 'layer', 'http'], function () {
var form = layui.form, $ = layui.jquery, layer = layui.layer, http = layui.http;
form.on('submit(lookup)', function (data) {
http.post('{:url("/appmall/developer/lookup")}', data.field).then(function (r) {
$('#result').show();
$('#resultMsg').text(r.message || '查询完成');
if (r.code === 0 && r.data && r.data.token) {
$('#tokenWrap').show();
$('#tokenVal').text(r.data.token);
} else {
$('#tokenWrap').hide();
}
if (r.code !== 0) { layer.msg(r.message || '查询失败', { icon: 2 }); }
}).catch(function () { layer.msg('请求失败', { icon: 2 }); });
return false;
});
$('#copyBtn').on('click', function () {
var t = document.getElementById('tokenVal').innerText;
var dummy = $('<textarea>').val(t).appendTo('body').select();
document.execCommand('copy');
dummy.remove();
layer.msg('已复制', { icon: 1 });
});
});
</script>
</body>
</html>