## 一、支付:改由已安装的 epay 插件承载(不再自研签名)
- 下单:\addons\epay\library\Service::submitOrder($amount 元, $orderNo, 'wechat', $body, $notifyUrl, null, 'miniapp', $openid)
- 验签:Service::checkNotify('wechat')(内部 $pay->verify());应答:$pay->success()(v2 = XML)
- 业务编排仍在 application/api/controller/Pay.php,不改插件源码:
POST /pay/prepay(取调起参数,下发前剔除 appId);POST /pay/notify(公开路由:插件验签 → 金额核对 → 幂等分派)
- 配置真源 = addons/epay/config.php(后台「插件管理 → 微信支付宝整合插件 → 配置」);
fc_config 的 wx.mchId / wx.apiKey / wx.payNotifyUrl 废弃;后台「系统设置」支付表单改只读并跳插件配置页
- 插件 API 保持 version=v2(PHP 7.4 可跑);certs/* 为 0 字节占位,不含任何真实密钥
- 修复 BUG-015:Pay::notify() 与基类站内信同名且签名不兼容导致 /pay/* 全 500,动作改名 notifyCallback()
## 二、插件纳入 Git 版本管理
- .gitignore 移除 /addons/* 与 /public/assets/addons/*(保留 .gitkeep 占位)
- 入库 addons/epay、addons/wechat、public/assets/addons/*、addons/.htaccess(deny from all)
- config.php 入库为空白模板;服务器请在填好密钥后执行
git update-index --skip-worktree addons/epay/config.php,避免真实密钥回传仓库
## 三、安全修复:余额充值资损(高危,已实测复现)
- 现象:POST /order/recharge {payType:'balance'} 只加余额不扣款(余额 134.50 → 1022.50),等于凭空增发余额,
可再去买会员 / 付费发布 / 解锁联系方式
- 修复:/order/recharge 仅接受 payType=wxpay,balance → 「余额充值仅支持微信支付」,其它 → 「支付方式不支持」;
订单恒为 status=pending、pay_type=wxpay、paytime=null;入账只发生在 /pay/notify 回调(Order::creditRecharge)
或后台「会员管理 → 余额充值」(fc/userext/recharge)
- 小程序充值页同步为「仅微信支付」+ 防重复提交 + onShow 刷新资产;mock / 用例 / 文档同步
## 四、其他 v1.1.0 能力
- 媒体上传:POST /post/upload(图片 ≤10MB / 视频 ≤50MB,真落盘),发布页 uni.uploadFile 真上传
- LBS:fc_post.lat/lng、首页 sort=nearby(距离升序、无坐标排最后)、卡片 distance、详情页地图
- 互动:举报 POST /report(原因字典)、收藏 / 关注(fc_favorite / fc_follow、/favorite/*、/follow/toggle)
- 交易:余额充值 POST /order/recharge、优惠券 /coupon/list|receive(fc_coupon / fc_user_coupon、我的资产券)
- 发布计费:会员发布折扣(discountRate/discountText)+ 免费发布条数(freeQuota*)
- 后台新增:数据总览 fc/dashboard、系统设置 fc/setting、优惠券管理 fc/coupon(含菜单与权限节点)
## 五、本批审核修复
- 详情页:游客不再请求登录态接口(避免 401 被清 token 踢去登录);微信付费查看改为支付后轮询解锁,
不再读取 wxpay 分支未返回的 contact;加防重复提交
- 发布页:freeLeftToday → freeQuotaLeft / freeQuotaCycle / freeUnlimited(对齐后端出参);
上传图预览拼后端域名(新增 format.js#assetUrl,后端返回相对路径)
- 收藏空态「去首页」:switchTab → reLaunch(项目用自绘 fc-tabbar,无 tabBar,switchTab 必然失败)
- 会员券 days=0 显示「永久有效」;manifest.json 补 requiredPrivateInfos(getLocation / chooseLocation)
- 后端:publishConfig 补 discountRate/discountText 与 memberPostDiscountText();优惠券总开关 coupon.enabled
真生效(关闭后 list/receive 拒绝);后台 fc/Coupon 的 add/edit 补 strip_tags 过滤(防存储型 XSS)、
补 searchFields='name',列表 name 列再做一次 HTML 转义
- FcInstall:补清理后台菜单缓存 __menu__(否则新菜单要等缓存过期才显示),并同步 README 说明
- 后台语言包 fc/setting.php 按「支付只读 + 跳插件配置」的新页面重写
- 文档同步:uniapp/docs/{01,03,04}、uniapp/README.md、docs/05-后端实现规范.md、后台 README 上线步骤
## 六、校验结果(全部通过)
- 后端端到端:tools/verify-api.mjs 226/226(含新增「拒绝余额充值(资损防护)」用例)
- 小程序:uniapp/tests/run.mjs 167/167;validate.mjs 0 错 0 警;check-scss 19/19
- 后台:check-admin-i18n 0 错 0 警;check-theme 0 错 0 警;9 个页面 HTTP 200 全中文
- php -l 改动/新增 PHP 文件 0 语法错误;探针复测:余额不再增长、epay 插件下单/验签链路通
292 行
11 KiB
PHP
292 行
11 KiB
PHP
<?php
|
||
|
||
namespace app\api\controller;
|
||
|
||
use think\Db;
|
||
|
||
/**
|
||
* 后台管理端 · 系统设置(Module-ADM-SETTING)
|
||
* 路由:
|
||
* GET|POST /api/v1/admin/setting/base AS1 基础配置
|
||
* POST /api/v1/admin/setting/pay AS2 微信支付配置
|
||
* GET|POST /api/v1/admin/setting/fee AS3 费用配置
|
||
* GET /api/v1/admin/setting/areas AS4 区域列表
|
||
* POST /api/v1/admin/setting/area AS5 保存区域
|
||
* GET|POST /api/v1/admin/setting/ui AS6 站点 UI 配置
|
||
* POST /api/v1/admin/setting/ui/reset AS7 重置 UI 配置
|
||
* POST /api/v1/admin/upload AS8 文件上传
|
||
*/
|
||
class AdminSetting extends V1
|
||
{
|
||
/**
|
||
* AS1 基础配置
|
||
* GET → {appName,logo,servicePhone,aboutUs,shareTitle}
|
||
* POST 入参 {appName,logo,servicePhone,aboutUs,shareTitle} → 合并后的完整配置
|
||
*/
|
||
public function base()
|
||
{
|
||
if ($this->request->isPost()) {
|
||
$appName = trim((string)$this->input('appName', ''));
|
||
if ($appName === '') {
|
||
$this->fail('小程序名称不能为空');
|
||
}
|
||
$this->setCfg('base.appName', $appName);
|
||
$this->setCfg('base.logo', (string)$this->input('logo', $this->cfg('base.logo', '')));
|
||
$this->setCfg('base.servicePhone', (string)$this->input('servicePhone', $this->cfg('base.servicePhone', '400-000-0000')));
|
||
$this->setCfg('base.aboutUs', (string)$this->input('aboutUs', $this->cfg('base.aboutUs', '')));
|
||
$this->setCfg('base.shareTitle', (string)$this->input('shareTitle', $this->cfg('base.shareTitle', '')));
|
||
$this->adminLog('修改基础配置');
|
||
}
|
||
|
||
$this->ok($this->baseConfig());
|
||
}
|
||
|
||
/**
|
||
* AS2 微信支付配置
|
||
* POST /api/v1/admin/setting/pay 入参 {mchId,apiKey} → {configured:true}
|
||
*
|
||
* 【写入目标:epay 插件配置】支付能力已改由 epay 插件承载,商户号/密钥的真源是插件配置
|
||
* (后台「插件管理 → 微信支付宝整合插件 → 配置」,持久化在 addons/epay/config.php)。
|
||
* 因此本接口把 mchId/apiKey 合并写入插件的 wechat.mch_id / wechat.key,而不再写 fc_config 的 pay.*
|
||
* (历史键 pay.mchId/pay.apiKey 保留在库中仅为兼容,代码已不读取)。
|
||
* 小程序 AppID(wechat.miniapp_id)与回调地址不在此维护:前者请到插件配置页填写,后者由服务端按请求域名动态生成。
|
||
*/
|
||
public function pay()
|
||
{
|
||
$mchId = trim((string)$this->input('mchId', ''));
|
||
$apiKey = trim((string)$this->input('apiKey', ''));
|
||
|
||
if ($mchId === '') {
|
||
$this->fail('微信支付商户号不能为空');
|
||
}
|
||
if ($apiKey === '') {
|
||
$this->fail('支付密钥不能为空');
|
||
}
|
||
|
||
$addonConfig = (array)get_addon_config('epay');
|
||
$wechat = (isset($addonConfig['wechat']) && is_array($addonConfig['wechat'])) ? $addonConfig['wechat'] : [];
|
||
$wechat['mch_id'] = $mchId;
|
||
$wechat['key'] = $apiKey;
|
||
|
||
try {
|
||
// 与后台 Addon::config 同一套写入逻辑(VarExporter 导出回 addons/epay/config.php)
|
||
set_addon_config('epay', ['wechat' => $wechat]);
|
||
} catch (\Exception $e) {
|
||
$this->fail('支付配置写入插件失败:' . $e->getMessage());
|
||
}
|
||
|
||
$this->adminLog('修改微信支付配置(写入 epay 插件)');
|
||
|
||
// 返回体保持原契约({configured:true});是否已具备小程序支付条件(miniapp_id 是否填写)
|
||
// 请看后台「插件管理 → 微信支付宝整合插件 → 配置」或 /pay/prepay 的返回提示。
|
||
$this->ok(['configured' => true]);
|
||
}
|
||
|
||
/**
|
||
* AS3 费用配置
|
||
* GET → {singlePost,freePostPerDay,memberMonth,memberQuarter,memberYear}
|
||
* POST 入参同字段 → 合并后配置;同时同步 fc_plan 价格
|
||
*/
|
||
public function fee()
|
||
{
|
||
if ($this->request->isPost()) {
|
||
$singlePost = (float)$this->input('singlePost', $this->cfg('fee.singlePost', 5));
|
||
if ($singlePost < 0) {
|
||
$this->fail('单条发布价格不能为负');
|
||
}
|
||
$freePostPerDay = (int)$this->input('freePostPerDay', $this->cfg('fee.freePostPerDay', 2));
|
||
$memberMonth = (float)$this->input('memberMonth', $this->cfg('fee.memberMonth', 19.9));
|
||
$memberQuarter = (float)$this->input('memberQuarter', $this->cfg('fee.memberQuarter', 49.9));
|
||
$memberYear = (float)$this->input('memberYear', $this->cfg('fee.memberYear', 168));
|
||
|
||
$this->setCfg('fee.singlePost', $singlePost);
|
||
$this->setCfg('fee.freePostPerDay', $freePostPerDay);
|
||
$this->setCfg('fee.memberMonth', $memberMonth);
|
||
$this->setCfg('fee.memberQuarter', $memberQuarter);
|
||
$this->setCfg('fee.memberYear', $memberYear);
|
||
|
||
Db::name('fc_plan')->where('plan_code', 'M1')->update(['price' => $memberMonth]);
|
||
Db::name('fc_plan')->where('plan_code', 'M3')->update(['price' => $memberQuarter]);
|
||
Db::name('fc_plan')->where('plan_code', 'M12')->update(['price' => $memberYear]);
|
||
|
||
$this->adminLog('修改费用配置');
|
||
}
|
||
|
||
$this->ok($this->feeConfig());
|
||
}
|
||
|
||
/**
|
||
* AS4 区域列表
|
||
* GET /api/v1/admin/setting/areas → 数组 [{id,name,sort,enabled}]
|
||
*/
|
||
public function areas()
|
||
{
|
||
$rows = Db::name('fc_area')->order('sort asc')->select();
|
||
|
||
$list = [];
|
||
foreach ($rows as $row) {
|
||
$list[] = [
|
||
'id' => (int)$row['id'],
|
||
'name' => (string)$row['name'],
|
||
'sort' => (int)$row['sort'],
|
||
'enabled' => (bool)$row['enabled'],
|
||
];
|
||
}
|
||
|
||
$this->ok($list);
|
||
}
|
||
|
||
/**
|
||
* AS5 保存区域
|
||
* POST /api/v1/admin/setting/area 入参 {id?,name,sort,enabled} → {id,name}
|
||
*/
|
||
public function saveArea()
|
||
{
|
||
$id = (int)$this->input('id', 0);
|
||
$name = trim((string)$this->input('name', ''));
|
||
$sort = (int)$this->input('sort', 0);
|
||
$enabled = (bool)$this->input('enabled', true);
|
||
|
||
if ($name === '') {
|
||
$this->fail('区域名称不能为空');
|
||
}
|
||
|
||
$data = [
|
||
'name' => $name,
|
||
'sort' => $sort,
|
||
'enabled' => $enabled ? 1 : 0,
|
||
];
|
||
|
||
if ($id && Db::name('fc_area')->where('id', $id)->find()) {
|
||
Db::name('fc_area')->where('id', $id)->update($data);
|
||
} else {
|
||
$id = Db::name('fc_area')->insertGetId($data);
|
||
}
|
||
|
||
$this->adminLog('保存区域 #' . $id . ' ' . $name);
|
||
|
||
$this->ok(['id' => (int)$id, 'name' => $name]);
|
||
}
|
||
|
||
/**
|
||
* AS6 站点 UI 配置(LOGO / 图标)
|
||
* GET → {siteName,logo,icons,updatedAt}
|
||
* POST 入参 {siteName?,logo?,icons?}(合并语义:只覆盖传入的 key) → 完整配置
|
||
*/
|
||
public function ui()
|
||
{
|
||
if ($this->request->isPost()) {
|
||
$siteName = $this->input('siteName', null);
|
||
if ($siteName !== null) {
|
||
$this->setCfg('ui.siteName', (string)$siteName);
|
||
}
|
||
|
||
$logo = $this->input('logo', null);
|
||
if ($logo !== null) {
|
||
$this->setCfg('ui.logo', (string)$logo);
|
||
}
|
||
|
||
// 注意:icons 可能是数组,不能走 $this->input()(TP5.0 Request::input 默认按字符串强转,
|
||
// 传入数组会抛 "variable type error:array" 导致 HTTP 500);统一从 inputs() 取原始值。
|
||
$allInputs = $this->inputs();
|
||
$icons = array_key_exists('icons', $allInputs) ? $allInputs['icons'] : null;
|
||
if ($icons !== null) {
|
||
if (is_string($icons)) {
|
||
$icons = json_decode($icons, true);
|
||
}
|
||
$icons = is_array($icons) ? $icons : (array)$icons;
|
||
$merged = (array)$this->cfg('ui.icons', []);
|
||
foreach ($icons as $k => $v) {
|
||
if (!is_string($v)) {
|
||
$this->fail('图标 ' . $k . ' 的地址必须是字符串');
|
||
}
|
||
$merged[$k] = $v;
|
||
}
|
||
$this->setCfg('ui.icons', $merged);
|
||
}
|
||
|
||
$this->setCfg('ui.updatedAt', date('c'));
|
||
$this->adminLog('修改LOGO与图标配置');
|
||
}
|
||
|
||
$this->ok($this->uiConfig());
|
||
}
|
||
|
||
/**
|
||
* AS7 重置 UI 配置
|
||
* POST /api/v1/admin/setting/ui/reset → {siteName,logo,icons,reset}
|
||
*/
|
||
public function uiReset()
|
||
{
|
||
$this->setCfg('ui.logo', '');
|
||
$this->setCfg('ui.icons', []);
|
||
$this->setCfg('ui.updatedAt', date('c'));
|
||
$this->adminLog('重置LOGO与图标配置');
|
||
|
||
$this->ok([
|
||
'siteName' => (string)$this->cfg('ui.siteName', '同城分类信息'),
|
||
'logo' => '',
|
||
'icons' => (object)[],
|
||
'reset' => true,
|
||
]);
|
||
}
|
||
|
||
/**
|
||
* AS8 文件上传
|
||
* POST /api/v1/admin/upload multipart 字段 file → {url}
|
||
*/
|
||
public function upload()
|
||
{
|
||
$file = $this->request->file('file');
|
||
if (!$file) {
|
||
$this->fail('未接收到上传文件');
|
||
}
|
||
try {
|
||
$upload = new \app\common\library\Upload($file);
|
||
$attachment = $upload->upload();
|
||
} catch (\Exception $e) {
|
||
$this->fail($e->getMessage());
|
||
}
|
||
|
||
$this->ok(['url' => cdnurl($attachment->url, true)]);
|
||
}
|
||
|
||
/** 基础配置结构 */
|
||
protected function baseConfig()
|
||
{
|
||
return [
|
||
'appName' => (string)$this->cfg('base.appName', '同城分类信息'),
|
||
'logo' => (string)$this->cfg('base.logo', ''),
|
||
'servicePhone' => (string)$this->cfg('base.servicePhone', '400-000-0000'),
|
||
'aboutUs' => (string)$this->cfg('base.aboutUs', ''),
|
||
'shareTitle' => (string)$this->cfg('base.shareTitle', ''),
|
||
];
|
||
}
|
||
|
||
/** 费用配置结构 */
|
||
protected function feeConfig()
|
||
{
|
||
return [
|
||
'singlePost' => (float)$this->cfg('fee.singlePost', 5),
|
||
'freePostPerDay' => (int)$this->cfg('fee.freePostPerDay', 2),
|
||
'memberMonth' => (float)$this->cfg('fee.memberMonth', 19.9),
|
||
'memberQuarter' => (float)$this->cfg('fee.memberQuarter', 49.9),
|
||
'memberYear' => (float)$this->cfg('fee.memberYear', 168),
|
||
];
|
||
}
|
||
|
||
/** UI 配置结构(icons 保证为对象) */
|
||
protected function uiConfig()
|
||
{
|
||
$icons = $this->cfg('ui.icons', []);
|
||
$icons = is_array($icons) ? $icons : (array)$icons;
|
||
|
||
return [
|
||
'siteName' => (string)$this->cfg('ui.siteName', '同城分类信息'),
|
||
'logo' => (string)$this->cfg('ui.logo', ''),
|
||
'icons' => (object)$icons,
|
||
'updatedAt' => (string)$this->cfg('ui.updatedAt', date('c')),
|
||
];
|
||
}
|
||
}
|