## 一、支付:改由已安装的 epay 插件承载(不再自研签名)
- 下单:\addons\epay\library\Service::submitOrder($amount 元, $orderNo, 'wechat', $body, $notifyUrl, null, 'miniapp', $openid)
- 验签:Service::checkNotify('wechat')(内部 $pay->verify());应答:$pay->success()(v2 = XML)
- 业务编排仍在 application/api/controller/Pay.php,不改插件源码:
POST /pay/prepay(取调起参数,下发前剔除 appId);POST /pay/notify(公开路由:插件验签 → 金额核对 → 幂等分派)
- 配置真源 = addons/epay/config.php(后台「插件管理 → 微信支付宝整合插件 → 配置」);
fc_config 的 wx.mchId / wx.apiKey / wx.payNotifyUrl 废弃;后台「系统设置」支付表单改只读并跳插件配置页
- 插件 API 保持 version=v2(PHP 7.4 可跑);certs/* 为 0 字节占位,不含任何真实密钥
- 修复 BUG-015:Pay::notify() 与基类站内信同名且签名不兼容导致 /pay/* 全 500,动作改名 notifyCallback()
## 二、插件纳入 Git 版本管理
- .gitignore 移除 /addons/* 与 /public/assets/addons/*(保留 .gitkeep 占位)
- 入库 addons/epay、addons/wechat、public/assets/addons/*、addons/.htaccess(deny from all)
- config.php 入库为空白模板;服务器请在填好密钥后执行
git update-index --skip-worktree addons/epay/config.php,避免真实密钥回传仓库
## 三、安全修复:余额充值资损(高危,已实测复现)
- 现象:POST /order/recharge {payType:'balance'} 只加余额不扣款(余额 134.50 → 1022.50),等于凭空增发余额,
可再去买会员 / 付费发布 / 解锁联系方式
- 修复:/order/recharge 仅接受 payType=wxpay,balance → 「余额充值仅支持微信支付」,其它 → 「支付方式不支持」;
订单恒为 status=pending、pay_type=wxpay、paytime=null;入账只发生在 /pay/notify 回调(Order::creditRecharge)
或后台「会员管理 → 余额充值」(fc/userext/recharge)
- 小程序充值页同步为「仅微信支付」+ 防重复提交 + onShow 刷新资产;mock / 用例 / 文档同步
## 四、其他 v1.1.0 能力
- 媒体上传:POST /post/upload(图片 ≤10MB / 视频 ≤50MB,真落盘),发布页 uni.uploadFile 真上传
- LBS:fc_post.lat/lng、首页 sort=nearby(距离升序、无坐标排最后)、卡片 distance、详情页地图
- 互动:举报 POST /report(原因字典)、收藏 / 关注(fc_favorite / fc_follow、/favorite/*、/follow/toggle)
- 交易:余额充值 POST /order/recharge、优惠券 /coupon/list|receive(fc_coupon / fc_user_coupon、我的资产券)
- 发布计费:会员发布折扣(discountRate/discountText)+ 免费发布条数(freeQuota*)
- 后台新增:数据总览 fc/dashboard、系统设置 fc/setting、优惠券管理 fc/coupon(含菜单与权限节点)
## 五、本批审核修复
- 详情页:游客不再请求登录态接口(避免 401 被清 token 踢去登录);微信付费查看改为支付后轮询解锁,
不再读取 wxpay 分支未返回的 contact;加防重复提交
- 发布页:freeLeftToday → freeQuotaLeft / freeQuotaCycle / freeUnlimited(对齐后端出参);
上传图预览拼后端域名(新增 format.js#assetUrl,后端返回相对路径)
- 收藏空态「去首页」:switchTab → reLaunch(项目用自绘 fc-tabbar,无 tabBar,switchTab 必然失败)
- 会员券 days=0 显示「永久有效」;manifest.json 补 requiredPrivateInfos(getLocation / chooseLocation)
- 后端:publishConfig 补 discountRate/discountText 与 memberPostDiscountText();优惠券总开关 coupon.enabled
真生效(关闭后 list/receive 拒绝);后台 fc/Coupon 的 add/edit 补 strip_tags 过滤(防存储型 XSS)、
补 searchFields='name',列表 name 列再做一次 HTML 转义
- FcInstall:补清理后台菜单缓存 __menu__(否则新菜单要等缓存过期才显示),并同步 README 说明
- 后台语言包 fc/setting.php 按「支付只读 + 跳插件配置」的新页面重写
- 文档同步:uniapp/docs/{01,03,04}、uniapp/README.md、docs/05-后端实现规范.md、后台 README 上线步骤
## 六、校验结果(全部通过)
- 后端端到端:tools/verify-api.mjs 226/226(含新增「拒绝余额充值(资损防护)」用例)
- 小程序:uniapp/tests/run.mjs 167/167;validate.mjs 0 错 0 警;check-scss 19/19
- 后台:check-admin-i18n 0 错 0 警;check-theme 0 错 0 警;9 个页面 HTTP 200 全中文
- php -l 改动/新增 PHP 文件 0 语法错误;探针复测:余额不再增长、epay 插件下单/验签链路通
306 行
10 KiB
PHP
306 行
10 KiB
PHP
<?php
|
||
|
||
namespace app\api\controller;
|
||
|
||
use think\Db;
|
||
|
||
/**
|
||
* 用户端 · 首页与展示(Module-HOME)
|
||
* 路由:
|
||
* GET /api/v1/home/banners H1 轮播广告位
|
||
* GET /api/v1/home/categories H2 分类导航
|
||
* GET /api/v1/home/search/hot H3 热门搜索
|
||
* GET /api/v1/home/feed H4 信息流(支持 lat/lng + sort=nearby 距离排序)
|
||
*/
|
||
class Home extends V1
|
||
{
|
||
/**
|
||
* H1 首页轮播广告位
|
||
* GET /api/v1/home/banners → [{id,title,image,link,color}]
|
||
* 规则:仅 enabled=1,按 sort asc;image 为空返回 ''
|
||
*/
|
||
public function banners()
|
||
{
|
||
$rows = Db::name('fc_banner')
|
||
->where('enabled', 1)
|
||
->order('sort asc')
|
||
->select();
|
||
|
||
$list = [];
|
||
foreach ($rows as $row) {
|
||
$list[] = [
|
||
'id' => (int)$row['id'],
|
||
'title' => (string)$row['title'],
|
||
'image' => (string)$row['image'],
|
||
'link' => (string)$row['link'],
|
||
'color' => (string)$row['color'],
|
||
];
|
||
}
|
||
$this->ok($list);
|
||
}
|
||
|
||
/**
|
||
* H2 分类导航
|
||
* GET /api/v1/home/categories → [{id,name,iconKey,icon,color,count}]
|
||
* 规则:仅 enabled=1,按 sort asc;icon 为固定 /static/icons/ 文件名(按 id 映射)
|
||
*/
|
||
public function categories()
|
||
{
|
||
$rows = Db::name('fc_category')
|
||
->where('enabled', 1)
|
||
->order('sort asc')
|
||
->select();
|
||
|
||
$list = [];
|
||
foreach ($rows as $row) {
|
||
$id = (int)$row['id'];
|
||
$list[] = [
|
||
'id' => $id,
|
||
'name' => (string)$row['name'],
|
||
'iconKey' => (string)$row['icon_key'],
|
||
'icon' => '/static/icons/' . $this->iconFile($id),
|
||
'color' => (string)$row['color'],
|
||
'count' => (int)$row['post_count'],
|
||
];
|
||
}
|
||
$this->ok($list);
|
||
}
|
||
|
||
/**
|
||
* H3 热门搜索
|
||
* GET /api/v1/home/search/hot → [string]
|
||
* 规则:读配置 home.hotKeywords,未配置则返回默认
|
||
*/
|
||
public function hotKeywords()
|
||
{
|
||
$default = ['租房 一室一厅', '二手电动车', '急招快递员', '钢琴家教', '空调维修'];
|
||
$keywords = $this->cfg('home.hotKeywords', $default);
|
||
if (!is_array($keywords) || !$keywords) {
|
||
$keywords = $default;
|
||
}
|
||
$this->ok(array_values($keywords));
|
||
}
|
||
|
||
/**
|
||
* H4 信息流
|
||
* GET /api/v1/home/feed {categoryId?,keyword?,area?,sort?,lat?,lng?,page,size}
|
||
* → {list,page,size,total,hasMore}
|
||
* 规则:仅 audit_status=1 AND status=1 AND deletetime IS NULL
|
||
* - sort=nearby 时按距离升序(无坐标的信息排最后;请求未带 lat/lng 则回落发布时间倒序);
|
||
* - 列表项 distance 为 km(一位小数),请求未带坐标 / 信息未定位时为 null。
|
||
*/
|
||
public function feed()
|
||
{
|
||
list($page, $size) = $this->pager();
|
||
|
||
$categoryId = (int)$this->input('categoryId', 0);
|
||
$keyword = trim((string)$this->input('keyword', ''));
|
||
$area = trim((string)$this->input('area', ''));
|
||
$sort = (string)$this->input('sort', '');
|
||
|
||
$query = Db::name('fc_post')
|
||
->where('audit_status', 1)
|
||
->where('status', 1)
|
||
->whereNull('deletetime');
|
||
if ($categoryId > 0) {
|
||
$query->where('category_id', $categoryId);
|
||
}
|
||
if ($keyword !== '') {
|
||
$query->where('title', 'like', '%' . $keyword . '%');
|
||
}
|
||
if ($area !== '') {
|
||
$query->where('area', $area);
|
||
}
|
||
|
||
$counter = Db::name('fc_post')
|
||
->where('audit_status', 1)
|
||
->where('status', 1)
|
||
->whereNull('deletetime');
|
||
if ($categoryId > 0) {
|
||
$counter->where('category_id', $categoryId);
|
||
}
|
||
if ($keyword !== '') {
|
||
$counter->where('title', 'like', '%' . $keyword . '%');
|
||
}
|
||
if ($area !== '') {
|
||
$counter->where('area', $area);
|
||
}
|
||
$total = $counter->count();
|
||
|
||
// 「附近」:距离在 PHP 内用 Haversine 计算后排序(不用 SQL 距离函数,避免 MySQL 兼容问题);
|
||
// 因排序依赖计算结果,这里取全量匹配行排序后再做**内存分页**,保证 page/size/total 一致。
|
||
if ($sort === 'nearby') {
|
||
$rows = $query->order('createtime desc')->select();
|
||
$items = [];
|
||
foreach ($rows as $row) {
|
||
$items[] = [
|
||
'item' => $this->buildPost($row),
|
||
'distance' => $this->postDistance($row),
|
||
'ct' => (int)$row['createtime'],
|
||
];
|
||
}
|
||
usort($items, function ($a, $b) {
|
||
$na = $a['distance'] === null;
|
||
$nb = $b['distance'] === null;
|
||
if ($na !== $nb) {
|
||
return $na ? 1 : -1; // 无坐标的排最后
|
||
}
|
||
if (!$na && $a['distance'] != $b['distance']) {
|
||
return $a['distance'] < $b['distance'] ? -1 : 1;
|
||
}
|
||
return $b['ct'] - $a['ct']; // 距离相同(或都无坐标):新的在前
|
||
});
|
||
$list = [];
|
||
foreach ($items as $it) {
|
||
$list[] = $it['item'];
|
||
}
|
||
$this->ok($this->paginateArray($list, $page, $size));
|
||
}
|
||
|
||
if ($sort === 'price') {
|
||
$query->order('is_top desc, price asc');
|
||
} elseif ($sort === 'hot') {
|
||
$query->order('is_top desc, views desc');
|
||
} else {
|
||
// 后台「置顶」优先展示,其余按发布时间倒序
|
||
$query->order('is_top desc, createtime desc');
|
||
}
|
||
|
||
$rows = $query->page($page, $size)->select();
|
||
|
||
$list = [];
|
||
foreach ($rows as $row) {
|
||
$list[] = $this->buildPost($row);
|
||
}
|
||
|
||
$this->ok($this->paginate($list, $total, $page, $size));
|
||
}
|
||
|
||
/**
|
||
* Haversine 距离(km,一位小数)—— 与 Post 控制器同一算法
|
||
* @return float
|
||
*/
|
||
protected function haversine($lat1, $lng1, $lat2, $lng2)
|
||
{
|
||
$earth = 6371.0;
|
||
$rad = M_PI / 180;
|
||
$dLat = ($lat2 - $lat1) * $rad;
|
||
$dLng = ($lng2 - $lng1) * $rad;
|
||
$a = sin($dLat / 2) * sin($dLat / 2)
|
||
+ cos($lat1 * $rad) * cos($lat2 * $rad) * sin($dLng / 2) * sin($dLng / 2);
|
||
$c = 2 * asin(min(1.0, sqrt($a)));
|
||
return round($earth * $c, 1);
|
||
}
|
||
|
||
/**
|
||
* 列表项距离(km,一位小数;请求未带坐标 / 信息未定位 = null)
|
||
* @param array $row fc_post 行
|
||
* @return float|null
|
||
*/
|
||
protected function postDistance($row)
|
||
{
|
||
$lat = $this->input('lat', null);
|
||
$lng = $this->input('lng', null);
|
||
if (!is_numeric($lat) || !is_numeric($lng)) {
|
||
return null;
|
||
}
|
||
$lat = (float)$lat;
|
||
$lng = (float)$lng;
|
||
if ($lat == 0.0 && $lng == 0.0) {
|
||
return null;
|
||
}
|
||
$plat = isset($row['lat']) && $row['lat'] !== null ? (float)$row['lat'] : 0.0;
|
||
$plng = isset($row['lng']) && $row['lng'] !== null ? (float)$row['lng'] : 0.0;
|
||
if ($plat == 0.0 && $plng == 0.0) {
|
||
return null;
|
||
}
|
||
return $this->haversine($lat, $lng, $plat, $plng);
|
||
}
|
||
|
||
/**
|
||
* 组装 Post 结构(与前端 mock 数据字段严格对齐)
|
||
* @param array $row fc_post 行
|
||
* @return array
|
||
*/
|
||
protected function buildPost($row)
|
||
{
|
||
$categoryName = '';
|
||
if (!empty($row['category_id'])) {
|
||
$cat = Db::name('fc_category')->where('id', $row['category_id'])->find();
|
||
if ($cat) {
|
||
$categoryName = (string)$cat['name'];
|
||
}
|
||
}
|
||
|
||
$publisher = ['id' => 0, 'name' => '', 'avatar' => '', 'isMerchant' => false, 'verified' => false];
|
||
if (!empty($row['user_id'])) {
|
||
$pub = Db::name('user')->where('id', $row['user_id'])->find();
|
||
if ($pub) {
|
||
$pubExt = Db::name('fc_user_ext')->where('user_id', $pub['id'])->find();
|
||
$isMerchant = $pubExt && (int)$pubExt['user_type'] === 2;
|
||
$publisher = [
|
||
'id' => (int)$pub['id'],
|
||
'name' => (string)$pub['nickname'],
|
||
'avatar' => (string)$pub['avatar'],
|
||
'isMerchant' => (bool)$isMerchant,
|
||
'verified' => (bool)$isMerchant,
|
||
];
|
||
}
|
||
}
|
||
|
||
$tags = [];
|
||
if (!empty($row['tags'])) {
|
||
foreach (explode(',', (string)$row['tags']) as $tag) {
|
||
$tag = trim($tag);
|
||
if ($tag !== '') {
|
||
$tags[] = $tag;
|
||
}
|
||
}
|
||
}
|
||
|
||
return [
|
||
'id' => (int)$row['id'],
|
||
'categoryId' => (int)$row['category_id'],
|
||
'categoryName' => $categoryName,
|
||
'title' => (string)$row['title'],
|
||
'content' => (string)$row['content'],
|
||
'cover' => (string)$row['cover'],
|
||
'price' => (float)$row['price'],
|
||
'priceUnit' => (string)$row['price_unit'],
|
||
'area' => (string)$row['area'],
|
||
'address' => (string)$row['address'],
|
||
'contact' => $this->maskPhone($row['phone']),
|
||
'views' => (int)$row['views'],
|
||
'likes' => (int)$row['likes'],
|
||
'isPaid' => (int)$row['is_paid'] === 1,
|
||
'isTop' => (int)$row['is_top'] === 1,
|
||
'auditStatus' => (int)$row['audit_status'],
|
||
'createdAt' => $this->iso($row['createtime']),
|
||
'tags' => $tags,
|
||
'publisher' => $publisher,
|
||
'commentCount' => (int)$row['comment_count'],
|
||
'distance' => $this->postDistance($row),
|
||
];
|
||
}
|
||
|
||
/**
|
||
* 分类 id → 固定图标文件名
|
||
* @param int $id
|
||
* @return string
|
||
*/
|
||
protected function iconFile($id)
|
||
{
|
||
$map = [
|
||
1 => 'cat-job.png',
|
||
2 => 'cat-house.png',
|
||
3 => 'cat-goods.png',
|
||
4 => 'cat-car.png',
|
||
5 => 'cat-service.png',
|
||
6 => 'cat-education.png',
|
||
7 => 'cat-clean.png',
|
||
8 => 'cat-friend.png',
|
||
];
|
||
return isset($map[$id]) ? $map[$id] : 'cat-job.png';
|
||
}
|
||
}
|