优化API文档生成

优化公共接口输出
优化用户退出逻辑
优化头像保存
优化模板变量输出

application/admin/command/Api.php

@@ -19,8 +19,8 @@ class Api extends Command
             ->setName('api')
             ->addOption('url', 'u', Option::VALUE_OPTIONAL, 'default api url', '')
             ->addOption('cdnurl', 'd', Option::VALUE_OPTIONAL, 'default cdn url', '')
-            ->addOption('module', 'm', Option::VALUE_OPTIONAL, 'module name(admin/index/api)', 'api')
-            ->addOption('output', 'o', Option::VALUE_OPTIONAL, 'output index file name', 'api.html')
+            ->addOption('module', 'm', Option::VALUE_OPTIONAL, 'module name(index/api)', 'api')
+            ->addOption('output', 'o', Option::VALUE_OPTIONAL, 'output index file name', '')
             ->addOption('template', 'e', Option::VALUE_OPTIONAL, '', 'index.html')
             ->addOption('force', 'f', Option::VALUE_OPTIONAL, 'force override general file', false)
             ->addOption('title', 't', Option::VALUE_OPTIONAL, 'document title', $site['name'] ?? '')
@@ -43,22 +43,30 @@ class Api extends Command
         if (!preg_match("/^([a-z0-9]+)\.html\$/i", $template)) {
             throw new Exception('template file not correct');
         }
-        $language = $language ? $language : 'zh-cn';
+        $language = $language ?: 'zh-cn';
         $langFile = $apiDir . 'lang' . DS . $language . '.php';
         if (!is_file($langFile)) {
             throw new Exception('language file not found');
         }
         $lang = include_once $langFile;
+
         // 目标目录
-        $output_dir = ROOT_PATH . 'public' . DS;
-        $output_file = $output_dir . $input->getOption('output');
-        if (is_file($output_file) && !$force) {
+        $outputDir = ROOT_PATH . 'runtime' . DS . 'docs' . DS;
+        if (!is_dir($outputDir)) {
+            mkdir($outputDir, 0755, true);
+        }
+        $outputFilename = $input->getOption('output') ?: 'apidoc_' . date('Ymd_') . strtolower(\fast\Random::alnum(6)) . '.html';
+        if ($outputFilename === 'api.html') {
+            throw new Exception('api.html cannot be used as the output file name');
+        }
+        $outputFile = $outputDir . $outputFilename;
+        if (is_file($outputFile) && !$force) {
             throw new Exception("api index file already exists!\nIf you need to rebuild again, use the parameter --force=true ");
         }
         // 模板文件
-        $template_dir = $apiDir . 'template' . DS;
-        $template_file = $template_dir . $template;
-        if (!is_file($template_file)) {
+        $templateDir = $apiDir . 'template' . DS;
+        $templateFile = $templateDir . $template;
+        if (!is_file($templateFile)) {
             throw new Exception('template file not found');
         }
         // 额外的类
@@ -70,7 +78,6 @@ class Api extends Command
         // 插件
         $addon = $input->getOption('addon');
 
-        $moduleDir = $addonDir = '';
         if ($addon) {
             $addonInfo = get_addon_info($addon);
             if (!$addonInfo) {
@@ -83,9 +90,12 @@ class Api extends Command
         if (!is_dir($moduleDir)) {
             throw new Exception('module not found');
         }
+        if (in_array($module, ['admin', 'common'])) {
+            throw new Exception('module not allowed');
+        }
 
-        if (version_compare(PHP_VERSION, '7.0.0', '<')) {
-            throw new Exception("Requires PHP version 7.0 or newer");
+        if (version_compare(PHP_VERSION, '7.4.0', '<')) {
+            throw new Exception("Requires PHP version 7.4 or newer");
         }
 
         //控制器名
@@ -118,7 +128,7 @@ class Api extends Command
 
         $classes = array_unique(array_filter($classes));
 
-        $cdnurl = $cdnurl ? : Config::get('site.cdnurl');
+        $cdnurl = $cdnurl ?: Config::get('site.cdnurl');
 
         $config = [
             'sitename'    => config('site.name'),
@@ -132,12 +142,13 @@ class Api extends Command
 
         Config::set('view_replace_str.__CDN__', $cdnurl);
         $builder = new Builder($classes);
-        $content = $builder->render($template_file, ['config' => $config, 'lang' => $lang]);
+        $content = $builder->render($templateFile, ['config' => $config, 'lang' => $lang]);
 
-        if (!file_put_contents($output_file, $content)) {
-            throw new Exception('Cannot save the content to ' . $output_file);
+        if (!file_put_contents($outputFile, $content)) {
+            throw new Exception('Cannot save the content to ' . $outputFile);
         }
         $output->info("Build Successed!");
+        $output->info("Docs Location:" . $outputFile);
     }
 
     /**

application/api/controller/Common.php

@@ -39,37 +39,20 @@ class Common extends Api
      * 加载初始化
      *
      * @ApiParams (name="version", type="string", required=true, description="版本号")
-     * @ApiParams (name="lng", type="string", required=true, description="经度")
-     * @ApiParams (name="lat", type="string", required=true, description="纬度")
      */
     public function init()
     {
         if ($version = $this->request->request('version')) {
-            $lng = $this->request->request('lng');
-            $lat = $this->request->request('lat');
-
             //配置信息
             $upload = Config::get('upload');
-            //如果非服务端中转模式需要修改为中转
-            if ($upload['storage'] != 'local' && isset($upload['uploadmode']) && $upload['uploadmode'] != 'server') {
-                //临时修改上传模式为服务端中转
-                set_addon_config($upload['storage'], ["uploadmode" => "server"], false);
 
-                $upload = \app\common\model\Config::upload();
-                // 上传信息配置后
-                Hook::listen("upload_config_init", $upload);
-
-                $upload = Config::set('upload', array_merge(Config::get('upload'), $upload));
-            }
-
-            $upload['cdnurl'] = $upload['cdnurl'] ? $upload['cdnurl'] : cdnurl('', true);
-            $upload['uploadurl'] = preg_match("/^((?:[a-z]+:)?\/\/)(.*)/i", $upload['uploadurl']) ? $upload['uploadurl'] : url($upload['storage'] == 'local' ? '/api/common/upload' : $upload['uploadurl'], '', false, true);
+            $uploaddata = [];
+            $uploaddata['cdnurl'] = $upload['cdnurl'] ?: cdnurl('', true);
+            $uploaddata['uploadurl'] = url('/api/common/upload', '', false, true);
 
             $content = [
-                'citydata'    => Area::getCityFromLngLat($lng, $lat),
                 'versiondata' => Version::check($version),
-                'uploaddata'  => $upload,
-                'coverdata'   => Config::get("cover"),
+                'uploaddata'  => $uploaddata,
             ];
             $this->success('', $content);
         } else {

application/api/controller/User.php

@@ -179,8 +179,15 @@ class User extends Api
             }
             $user->nickname = $nickname;
         }
+        if ($avatar) {
+            //判断是否匹配config('upload.cdnurl')开头以及当前$SERVER['HTTP_HOST']开头。
+            if (preg_match('/^' . preg_quote(config('upload.cdnurl') . '/', '/') . '/i', $avatar)
+                || preg_match('/^' . preg_quote(substr(config('upload.savekey'), 0, strpos(config('upload.savekey'), '{')), '/') . '/i', $avatar)
+                || preg_match('/^' . preg_quote($_SERVER['HTTP_HOST'] . '/', '/') . '/i', $avatar)) {
+                $user->avatar = $avatar;
+            }
+        }
         $user->bio = $bio;
-        $user->avatar = $avatar;
         $user->save();
         $this->success();
     }

application/common/view/tpl/dispatch_jump.tpl

@@ -9,7 +9,7 @@
         *{box-sizing:border-box;margin:0;padding:0;font-family:Lantinghei SC,Open Sans,Arial,Hiragino Sans GB,Microsoft YaHei,"微软雅黑",STHeiti,WenQuanYi Micro Hei,SimSun,sans-serif;-webkit-font-smoothing:antialiased}
         body{padding:70px 50px;background:#f4f6f8;font-weight:400;font-size:1pc;-webkit-text-size-adjust:none;color:#333}
         a{outline:0;color:#3498db;text-decoration:none;cursor:pointer}
-        .system-message{margin:20px auto;padding:50px 0px;background:#fff;box-shadow:0 0 30px hsla(0,0%,39%,.06);text-align:center;width:100%;border-radius:2px;}
+        .system-message{margin:20px auto;padding:80px 0px;background:#fff;box-shadow:0 0 30px hsla(0,0%,39%,.06);text-align:center;width:100%;border-radius:10px;}
         .system-message h1{margin:0;margin-bottom:9pt;color:#444;font-weight:400;font-size:30px}
         .system-message .jump,.system-message .image{margin:20px 0;padding:0;padding:10px 0;font-weight:400}
         .system-message .jump{font-size:14px}
@@ -32,7 +32,7 @@
     <div class="image">
         <img src="__CDN__/assets/img/{$codeText}.svg" alt="" width="120" />
     </div>
-    <h1>{$msg}</h1>
+    <h1>{$msg|htmlentities}</h1>
     {if $url}
         <p class="jump">
             {:__('This page will be re-directed in %s seconds', '<span id="wait">' . $wait . '</span>')}

application/index/controller/User.php

@@ -195,16 +195,21 @@ class User extends Frontend
      */
     public function logout()
     {
+        // 加强校验referer是否来自服务器
+        $referer = $this->request->server('HTTP_REFERER');
+        if (!$referer || strtolower(parse_url($referer, PHP_URL_HOST)) != strtolower($this->request->host())) {
+            $this->error(__('Invalid request'));
+        }
+
         if ($this->request->isPost()) {
             $this->token();
             //退出本站
             $this->auth->logout();
             $this->success(__('Logout successful'), url('user/index'));
         }
-        $html = "<form id='logout_submit' name='logout_submit' action='' method='post'>" . token() . "<input type='submit' value='ok' style='display:none;'></form>";
-        $html .= "<script>document.forms['logout_submit'].submit();</script>";
 
-        return $html;
+        $this->view->assign('title', __('Logout'));
+        return $this->view->fetch();
     }
 
     /**

application/index/view/user/logout.html

@@ -0,0 +1,16 @@
+<div id="content-container" class="container">
+    <div class="user-section login-section">
+        <div class="login-main text-center">
+            <div class="image">
+                <img src="__CDN__/assets/img/info.svg" alt="" width="100" />
+            </div>
+            <h3 class="my-4" style="font-size:16px;">{:__('Are you sure you want to sign out?')}</h3 class="my-4" style="font-size:16px;">
+            <form name="form" id="login-form" class="form-vertical" method="POST" action="#">
+                {:token()}
+                <div class="form-group">
+                    <button type="submit" class="btn btn-primary btn-lg btn-block">{:__('Confirm sign out')}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>