feat(attachment): 按参考主题重构后台上传配置套件
- 新增 AKSRT\Attachment\UploadLimits：按用户类型解析图片/视频/文件 上传上限（取最大值+默认兜底，钳制到 PHP 上限）、允许/禁止格式过滤、 上传自动重命名、非管理员附件页 404；不含论坛角色 - 后台「附件配置」重做：大小限制/格式限制/上传行为三组配置， PHP Schema 与 SPA Schema 逐字段镜像（v1.2.0） - 定制页 AttachmentPermissions.vue 改为标准 schemaPage，清理失效的 API 包装、组件加载器与旧配置键（submit_image_max_size 等） - 投稿/评论上传、批量上传数量全部切换到新链路；AksField 数字组件 支持单位展示 - 更新 captcha harness 与 front-submit 契约测试；421 项测试通过
This commit is contained in:
@@ -9,6 +9,34 @@ defined('ABSPATH') || exit;
|
||||
|
||||
class SchemaPermissions {
|
||||
|
||||
/**
|
||||
* User type options for upload size limit rows.
|
||||
*
|
||||
* @return array<int, array{label:string, value:string}>
|
||||
*/
|
||||
private static function upload_user_type_options(): array {
|
||||
$options = [];
|
||||
foreach (\AKSRT\Attachment\UploadLimits::user_type_options() as $value => $label) {
|
||||
$options[] = ['label' => $label, 'value' => $value];
|
||||
}
|
||||
return $options;
|
||||
}
|
||||
|
||||
/**
|
||||
* User type options for mime limit rows (adds the "all users" type).
|
||||
*
|
||||
* @return array<int, array{label:string, value:string}>
|
||||
*/
|
||||
private static function upload_mime_user_type_options(): array {
|
||||
$options = [
|
||||
['label' => __('所有用户', 'aksrt'), 'value' => 'all'],
|
||||
];
|
||||
foreach (\AKSRT\Attachment\UploadLimits::user_type_options() as $value => $label) {
|
||||
$options[] = ['label' => $label, 'value' => $value];
|
||||
}
|
||||
return $options;
|
||||
}
|
||||
|
||||
public static function build(): array {
|
||||
$provider_meta = function_exists('aksrt_captcha_provider_metadata') ? aksrt_captcha_provider_metadata() : [];
|
||||
$provider_options = [['label' => '关闭', 'value' => '']];
|
||||
@@ -60,19 +88,58 @@ class SchemaPermissions {
|
||||
'attachment' => [
|
||||
'key' => 'attachment',
|
||||
'title' => '附件配置',
|
||||
'version' => '1.1.0',
|
||||
'version' => '1.2.0',
|
||||
'option_key' => 'aksrt_settings',
|
||||
'groups' => [
|
||||
['key' => 'profile', 'title' => '用户资料卡背景图', 'fields' => [
|
||||
['key' => 'profile', 'title' => '用户头像与资料卡图片', 'fields' => [
|
||||
['key' => 'avatar_max_size', 'label' => '头像/用户资料卡背景图大小上限 (MB)', 'type' => 'number', 'default' => 2, 'min' => 1, 'max' => 10],
|
||||
]],
|
||||
['key' => 'content', 'title' => '内容上传限制', 'fields' => [
|
||||
['key' => 'submit_image_max_size', 'label' => '投稿图片大小上限 (MB)', 'type' => 'number', 'default' => 5, 'min' => 1, 'max' => 20],
|
||||
['key' => 'submit_video_max_size', 'label' => '投稿视频大小上限 (MB)', 'type' => 'number', 'default' => 30, 'min' => 1, 'max' => 200],
|
||||
['key' => 'comment_image_max_size', 'label' => '评论图片大小上限 (MB)', 'type' => 'number', 'default' => 2, 'min' => 1, 'max' => 10],
|
||||
['key' => 'size-limits', 'title' => '上传大小限制', 'fields' => [
|
||||
['key' => 'size_limit_notice', 'label' => '服务器环境提示', 'type' => 'notice', 'alertType' => 'warning', 'alertContent' => '设置上传大小，请考虑服务器负荷、硬盘，以及服务器最大能支持的范围。实际上传大小取「主题限制」与「PHP 环境限制」的较小值，超过 PHP 环境限制时请调整 php.ini 的 upload_max_filesize 与 post_max_size。'],
|
||||
['key' => 'upload_img_size', 'label' => '前端图片上传限制', 'type' => 'repeater', 'default' => [
|
||||
['type' => 'default', 'val' => 5],
|
||||
['type' => 'admin', 'val' => 20],
|
||||
], 'min' => 1, 'button_title' => '添加细分用户权限', 'help' => '投稿、评论等前端场景允许上传的最大图片大小（单位 MB）。同一个用户满足多个条件则取最大值，「最小默认值」为所有人兜底。', 'fields' => [
|
||||
['key' => 'type', 'label' => '用户类型', 'type' => 'select', 'default' => 'logged', 'options' => self::upload_user_type_options()],
|
||||
['key' => 'val', 'label' => '可上传', 'type' => 'number', 'default' => 5, 'min' => 1, 'max' => 2048, 'unit' => 'M'],
|
||||
]],
|
||||
['key' => 'image_upload_multiple', 'label' => '图片批量上传最大数量', 'type' => 'number', 'default' => 6, 'min' => 0, 'max' => 100, 'unit' => '张', 'help' => '前端投稿、评论上传图片允许的单次批量上传数量（为 0 则不限制，为 1 则不能批量上传）。'],
|
||||
['key' => 'upload_video_size', 'label' => '前端视频上传限制', 'type' => 'repeater', 'default' => [
|
||||
['type' => 'default', 'val' => 30],
|
||||
['type' => 'admin', 'val' => 2048],
|
||||
], 'min' => 1, 'button_title' => '添加细分用户权限', 'help' => '前端允许上传的最大视频大小（单位 MB）。同一个用户满足多个条件则取最大值，必须包含最低默认值。', 'fields' => [
|
||||
['key' => 'type', 'label' => '用户类型', 'type' => 'select', 'default' => 'logged', 'options' => self::upload_user_type_options()],
|
||||
['key' => 'val', 'label' => '可上传', 'type' => 'number', 'default' => 30, 'min' => 1, 'max' => 2048, 'unit' => 'M'],
|
||||
]],
|
||||
['key' => 'upload_file_size', 'label' => '前端文件上传大小限制', 'type' => 'repeater', 'default' => [
|
||||
['type' => 'default', 'val' => 30],
|
||||
['type' => 'admin', 'val' => 2048],
|
||||
], 'min' => 1, 'button_title' => '添加细分用户权限', 'help' => '前端允许上传的其他文件（不含视频和图片，建议大于视频图片）最大大小（单位 MB）。同一个用户满足多个条件则取最大值，必须包含最低默认值。', 'fields' => [
|
||||
['key' => 'type', 'label' => '用户类型', 'type' => 'select', 'default' => 'logged', 'options' => self::upload_user_type_options()],
|
||||
['key' => 'val', 'label' => '可上传', 'type' => 'number', 'default' => 30, 'min' => 1, 'max' => 2048, 'unit' => 'M'],
|
||||
]],
|
||||
]],
|
||||
['key' => 'resource', 'title' => '资源附件限制', 'fields' => [
|
||||
['key' => 'resource_max_size', 'label' => '资源附件大小上限 (MB)', 'type' => 'number', 'default' => 50, 'min' => 1, 'max' => 200],
|
||||
['key' => 'mime-limits', 'title' => '上传格式限制', 'fields' => [
|
||||
['key' => 'mime_limit_notice', 'label' => '安全提示', 'type' => 'notice', 'alertType' => 'warning', 'alertContent' => '请添加文件的扩展名和 MIME 类型，用英文逗号分割。格式示例：mp3=audio/mpeg,jpg=image/jpeg。禁止的优先级大于允许。郑重提示：请勿允许上传 php、sh、exe 等可执行文件，会极大增加服务器被入侵攻击的风险。'],
|
||||
['key' => 'upload_file_mimes', 'label' => '前端上传文件格式限制', 'type' => 'repeater', 'default' => [
|
||||
['type' => 'admin', 'pattern' => 'allow', 'val' => 'svg=image/svg+xml'],
|
||||
['type' => 'all', 'pattern' => 'allow', 'val' => ''],
|
||||
], 'min' => 1, 'button_title' => '添加细分用户权限', 'help' => '根据不同的用户类型，添加额外允许或禁止上传的文件格式（禁止的优先级大于允许）。', 'fields' => [
|
||||
['key' => 'type', 'label' => '用户类型', 'type' => 'select', 'default' => 'all', 'options' => self::upload_mime_user_type_options()],
|
||||
['key' => 'pattern', 'label' => '规则', 'type' => 'select', 'default' => 'allow', 'options' => [
|
||||
['label' => '允许', 'value' => 'allow'],
|
||||
['label' => '禁止', 'value' => 'prohibit'],
|
||||
]],
|
||||
['key' => 'val', 'label' => '格式', 'type' => 'textarea', 'default' => '', 'rows' => 1, 'placeholder' => '如：svg=image/svg+xml,mp3=audio/mpeg'],
|
||||
]],
|
||||
]],
|
||||
['key' => 'behavior', 'title' => '上传行为', 'fields' => [
|
||||
['key' => 'newfilename', 'label' => '上传文件自动重命名', 'type' => 'switch', 'default' => false, 'help' => '开启后上传文件按规则重命名，减少重名文件查询，提高上传效率。'],
|
||||
['key' => 'newfilename_type', 'label' => '重命名格式', 'type' => 'radio', 'default' => 'time', 'dependsOn' => ['key' => 'newfilename', 'value' => true], 'options' => [
|
||||
['label' => '时间 + 原文件名', 'value' => 'time'],
|
||||
['label' => '随机字符串', 'value' => 'random'],
|
||||
]],
|
||||
['key' => 'close_attachment_page', 'label' => '非管理员屏蔽附件页面', 'type' => 'switch', 'default' => true, 'help' => '开启后非管理员访问附件（图片、文件等）页面将直接显示 404，可有效提高文件的安全性。'],
|
||||
]],
|
||||
],
|
||||
],
|
||||
|
||||
@@ -546,11 +546,12 @@ class UserController extends ControllerBase {
|
||||
return $this->error(__('图片文件上传失败，请重新选择', 'aksrt'), 400);
|
||||
}
|
||||
|
||||
$settings = class_exists('\\AKSRT\\Settings\\Settings') ? \AKSRT\Settings\Settings::get_all() : [];
|
||||
$max_size_mb = max(1, min(10, (int) ($settings['comment_image_max_size'] ?? 2)));
|
||||
$max_size = class_exists('\AKSRT\Attachment\UploadLimits')
|
||||
? \AKSRT\Attachment\UploadLimits::limit_bytes('image', $user_id)
|
||||
: (int) wp_max_upload_size();
|
||||
$actual_size = !empty($file['tmp_name']) && is_readable($file['tmp_name']) ? (int) filesize($file['tmp_name']) : 0;
|
||||
if ($actual_size <= 0 || $actual_size > $max_size_mb * MB_IN_BYTES) {
|
||||
return $this->error(sprintf(__('图片大小必须在 1 字节至 %dMB 之间', 'aksrt'), $max_size_mb), 413);
|
||||
if ($actual_size <= 0 || $actual_size > $max_size) {
|
||||
return $this->error(sprintf(__('图片大小不能超过 %s。', 'aksrt'), size_format($max_size)), 413);
|
||||
}
|
||||
|
||||
$mimes = [
|
||||
|
||||
Reference in New Issue
Block a user