Files
YwxAppThink/app/backend/controller/Notice.php
T
yangwx 18101cf11a feat: 上线前安全加固与发布工程化;appmall 由插件迁移为独立应用
安全(P0)
- 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签
  (ywxapp.framework_package_verify,默认开启)
- JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive
- 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php)
- 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
2026-10-22 00:53:39 +08:00

197 lines
6.9 KiB
PHP

<?php
declare(strict_types=1);
namespace app\backend\controller;
use think\Request;
use think\facade\Db;
use think\db\exception\DbException;
use think\exception\ValidateException;
use ywxapp\controller\BackendBase;
use ywxapp\model\CommonNotice as NoticeModel;
use app\backend\validate\Notice as NoticeValidate;
/**
* 站点公告管理
*/
class Notice extends BackendBase
{
protected $noNeedLogin = [];
protected $noNeedVerify = [];
protected function initialize()
{
$this->model = new NoticeModel();
NoticeModel::ensureSchema();
}
public function index()
{
$page = $this->request->param('page/d', 1);
$limit = $this->request->param('limit/d', 15);
$title = $this->request->param('title', '');
$type = $this->request->param('type/d', 0);
if ($this->request->isAjax()) {
$query = $this->model->newQuery();
if ($title !== '') {
$query->where('title', 'like', '%' . $title . '%');
}
if ($type > 0) {
$query->where('type', $type);
}
$list = $query->order('is_top', 'desc')
->order('sort', 'desc')
->order('id', 'desc')
->paginate(['page' => $page, 'list_rows' => $limit]);
$this->result->setCount($list->total())->success($list->items());
}
return $this->fetch();
}
public function save()
{
if (! $this->request->isPost()) {
$this->result->error('请求方式错误', 405);
}
$params = $this->request->only(
['title', 'content', 'author', 'type', 'is_top', 'start_time', 'end_time', 'sort', 'status'],
'post'
);
// 未填写发布人时取当前登录管理员
if (empty($params['author']) && isset($this->auth->info['username'])) {
$params['author'] = $this->auth->info['username'];
}
$params = $this->parseTime($params);
try {
validate(NoticeValidate::class)->check($params);
$this->model->create($params);
$this->result->success('', '添加成功');
} catch (ValidateException $e) {
$this->result->error($e->getMessage());
} catch (DbException $e) {
$this->result->error('添加失败: ' . $e->getMessage(), 2);
}
}
/**
* 将前端传来的日期字符串转为时间戳(空则置 0=长期)
*/
private function parseTime(array $params): array
{
foreach (['start_time', 'end_time'] as $f) {
if (isset($params[$f])) {
$params[$f] = $params[$f] === '' || $params[$f] === null
? 0
: (is_numeric($params[$f]) ? (int)$params[$f] : strtotime($params[$f]));
} else {
$params[$f] = 0;
}
}
return $params;
}
public function edit($id = null)
{
$id = $id ?: $this->request->param('id');
$info = $this->model->find($id);
if (! $info) {
$this->result->error('记录不存在', 404);
}
// 时间戳转日期字符串,方便表单回填
$data = $info->toArray();
$data['start_time'] = ! empty($data['start_time']) ? date('Y-m-d H:i:s', $data['start_time']) : '';
$data['end_time'] = ! empty($data['end_time']) ? date('Y-m-d H:i:s', $data['end_time']) : '';
$this->result->success(['info' => $data]);
}
public function update()
{
if (! ($this->request->isAjax() && $this->request->isPut())) {
$this->result->error('请求方式错误', 405);
}
$params = $this->request->param();
$id = $params['id'] ?? null;
$info = $this->model->find($id);
if (! $info) {
$this->result->error('记录不存在', 404);
}
$statusOnly = isset($params['status'])
&& count(array_diff(array_keys($params), ['id', 'status'])) === 0;
if (! $statusOnly) {
$params = $this->parseTime($params);
try {
validate(NoticeValidate::class)->check($params);
} catch (ValidateException $e) {
$this->result->error($e->getMessage());
}
} else {
$params = $this->parseTime($params);
}
$info->save($params);
$this->result->success($info, '更新成功');
}
public function recyclebin()
{
$page = $this->request->param('page/d', 1);
$limit = $this->request->param('limit/d', 15);
if ($this->request->isAjax()) {
$list = $this->model->onlyTrashed()
->order('sort', 'desc')
->paginate(['page' => $page, 'list_rows' => $limit]);
$this->result->setCount($list->total())->success($list->items());
}
return $this->fetch('notice/index');
}
public function delete()
{
if ($this->request->isAjax() && $this->request->isDelete()) {
$ids = $this->request->param('ids', '');
$force = $this->request->param('force', false);
if (empty($ids)) {
$this->result->error('请选择要删除的数据');
}
$idsArray = array_filter(explode(',', $ids), 'is_numeric');
if (empty($idsArray)) {
$this->result->error('参数错误');
}
try {
Db::transaction(function () use ($idsArray, $force) {
if ($force) {
$this->model->onlyTrashed()->whereIn('id', $idsArray)->select()
->each(function ($item) { $item->force()->delete(); });
} else {
$this->model->destroy($idsArray);
}
});
$this->result->success();
} catch (\think\exception\HttpResponseException $e) {
throw $e;
} catch (\Exception $e) {
$this->result->error('删除失败: ' . ($e->getMessage() ?: $e->__toString()), 500);
}
}
}
public function restore($ids = '')
{
if ($this->request->isAjax() && $this->request->isPost()) {
$ids = $this->request->param('ids', '');
if (empty($ids)) {
$this->result->error('请选择要恢复的数据');
}
$idsArray = array_filter(explode(',', $ids), 'is_numeric');
Db::startTrans();
try {
$this->model->withTrashed()->where('id', 'in', $idsArray)->select()
->each(function ($item) { $item->restore(); });
Db::commit();
$this->result->success('恢复成功');
} catch (DbException $e) {
Db::rollback();
$this->result->error('恢复失败: ' . $e->getMessage());
}
}
}
}