root/t
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 云函数鉴权加固与投票数据防护

Browse Source 
- follow/cms-vote/cms-articles-like/cms-articles-collect 云对象写操作强制 checkToken,uid 以服务端令牌为准,杜绝客户端伪造身份
- user-info.getIP 仅允许查询本人登录 IP(get_user_info 公开资料保持不变)
- ext-storage-co 上传凭证需登录,删除文件仅限 admin 角色(原为完全裸奔)
- cms-vote/cms-vote-info/user_select_vote 三表 schema 写权限全部关闭(投票读写均走云对象)
- 修复 follow.reFollow 中 total<0 永假导致的逻辑错误
- 各云对象 package.json 补 uni-id-common 依赖声明
- main.js 登录过期跳转修正为实际页面路径 /pages/login/login
This commit is contained in:
root
2026-09-10 21:31:25 +08:00
parent 3cd8fc247d
commit 50f8a89d51
16 changed files with 83 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.js
+1 -1
View File
@@ -94,7 +94,7 @@ function handleTokenExpired() {
showCancel: false,
success: () => {
uni.removeStorageSync('uni_id_token')
uni.reLaunch({ url: '/pages/login' })
uni.reLaunch({ url: '/pages/login/login' })
}
})
}
uniCloud-alipay/cloudfunctions/cms-articles-collect/index.obj.js
+11 -4
View File
@@ -1,13 +1,18 @@
const db = uniCloud.database();
const _ = db.command;
const uniID = require('uni-id-common');
module.exports = {
_before: function () { // 通用预处理器
this.uniID = uniID.createInstance({
context: this.getClientInfo()
});
},
async collectArticle(query) {
let user_id = query.user_id;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
let article_id = query.article_id;
let datetime = new Date().getTime();
const transaction = await db.startTransaction();
@@ -49,7 +54,9 @@ module.exports = {
async recollectArticle(query) {
try {
let user_id = query.user_id;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
let article_id = query.article_id;
const reclollectRes = await db.collection('cms-articles-collect')
uniCloud-alipay/cloudfunctions/cms-articles-collect/package.json
+3 -1
View File
@@ -1,6 +1,8 @@
{
"name": "cms-articles-collect",
"dependencies": {},
"dependencies": {
"uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
},
"extensions": {
"uni-cloud-jql": {}
}
uniCloud-alipay/cloudfunctions/cms-articles-like/index.obj.js
+10 -3
View File
@@ -1,13 +1,18 @@
const db = uniCloud.database();
const _ = db.command;
const uniID = require('uni-id-common');
module.exports = {
_before: function () {
this.uniID = uniID.createInstance({
context: this.getClientInfo()
});
},
async likeArticle(query) {
let user_id = query.user_id;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
let article_id = query.article_id;
let datetime = new Date().getTime();
@@ -50,7 +55,9 @@ module.exports = {
async relikeArticle(query) {
try {
let user_id = query.user_id;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
let article_id = query.article_id;
let datetime = new Date().getTime();
uniCloud-alipay/cloudfunctions/cms-articles-like/package.json
+3 -1
View File
@@ -1,6 +1,8 @@
{
"name": "cms-articles-like",
"dependencies": {},
"dependencies": {
"uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
},
"extensions": {
"uni-cloud-jql": {}
}
uniCloud-alipay/cloudfunctions/cms-vote/index.obj.js
+7 -1
View File
@@ -1,10 +1,13 @@
const { count } = require("console");
const uniID = require('uni-id-common');
const db = uniCloud.database();
const _ =db.command;
module.exports = {
_before: function () { // 通用预处理器
this.uniID = uniID.createInstance({
context: this.getClientInfo()
});
},
async getVoteInfo(query) {
try {
@@ -42,12 +45,15 @@ module.exports = {
},
async add_vote(query) {
try {
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
let {
vote_id,
selectValue,
user_id,
type
} = query;
user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
let t = await db.collection("cms-vote")
.where({
uniCloud-alipay/cloudfunctions/cms-vote/package.json
+3 -1
View File
@@ -1,6 +1,8 @@
{
"name": "cms-vote",
"dependencies": {},
"dependencies": {
"uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
},
"extensions": {
"uni-cloud-jql": {}
}
uniCloud-alipay/cloudfunctions/ext-storage-co/index.obj.js
+7 -1
View File
@@ -1,4 +1,6 @@
const uniID = require('uni-id-common');
const extStorageManager = uniCloud.getExtStorageManager({
provider: "qiniu",
domain:"qnycdn.mymoyu.top",
@@ -10,7 +12,9 @@ module.exports = {
_before: function() {
},
getUploadFileOptions(data = {}) {
async getUploadFileOptions(data = {}) {
const { errCode } = await uniID.createInstance({ context: this.getClientInfo() }).checkToken(this.getUniIdToken());
if (errCode) throw new Error('请先登录后再上传文件');
let {
cloudPath
} = data;
@@ -48,6 +52,8 @@ module.exports = {
// },
// // 删除文件
async deleteFile(data = {}) {
const { role, errCode } = await uniID.createInstance({ context: this.getClientInfo() }).checkToken(this.getUniIdToken());
if (errCode || !(role || []).includes('admin')) throw new Error('仅管理员可删除文件');
let {
fileList
} = data;
uniCloud-alipay/cloudfunctions/ext-storage-co/package.json
+3 -1
View File
@@ -1,7 +1,9 @@
{
"type": "module",
"name": "ext-storage-co",
"dependencies": {},
"dependencies": {
"uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
},
"extensions": {
"uni-cloud-ext-storage": {}
},
uniCloud-alipay/cloudfunctions/follow/index.obj.js
+13 -10
View File
@@ -1,8 +1,11 @@
const db = uniCloud.database();
const _ = db.command;
const uniID = require('uni-id-common');
module.exports = {
_before: function () { // 通用预处理器
this.uniID = uniID.createInstance({
context: this.getClientInfo()
});
},
async getIsFollow(query) {
try {
@@ -35,10 +38,10 @@ module.exports = {
},
async follow(query) {
try {
const {
uid,
fid
} = query;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
const uid = payload.uid; // 以服务端令牌为准，忽略客户端传入
const fid = query.fid;
const res = await db.collection("follow").where({
uid: uid,
fid: fid
@@ -70,15 +73,15 @@ module.exports = {
},
async reFollow(query) {
try {
const {
uid,
fid
} = query;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
const uid = payload.uid; // 以服务端令牌为准，忽略客户端传入
const fid = query.fid;
const res = await db.collection("follow").where({
uid: uid,
fid: fid
}).count();
if (res.total < 0) {
if (res.total == 0) {
return {
code: 201,
msg: "未关注"
uniCloud-alipay/cloudfunctions/follow/package.json
+3 -1
View File
@@ -1,6 +1,8 @@
{
"name": "follow",
"dependencies": {},
"dependencies": {
"uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
},
"extensions": {
"uni-cloud-jql": {}
}
uniCloud-alipay/cloudfunctions/user-info/index.obj.js
+7 -2
View File
@@ -1,6 +1,7 @@
const db = uniCloud.database();
const _ = db.command;
const crypto = require('crypto');
const uniID = require('uni-id-common');
let obj = {
isValidIP(ip) {
// ------------------------- IPv4 验证 -------------------------
@@ -134,11 +135,15 @@ let obj = {
}
module.exports = {
_before: function () { // 通用预处理器
this.uniID = uniID.createInstance({
context: this.getClientInfo()
});
},
async getIP(query) {
try {
let { uid } = query;
const payload = await this.uniID.checkToken(this.getUniIdToken());
if (payload.errCode) throw new Error('登录状态失效，请重新登录');
let uid = payload.uid; // 仅允许查询自己的登录 IP
let res = await db.collection("uni-id-users")
.doc(uid)
.field({
uniCloud-alipay/cloudfunctions/user-info/package.json
+3 -1
View File
@@ -1,6 +1,8 @@
{
"name": "user-info",
"dependencies": {},
"dependencies": {
"uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
},
"extensions": {
"uni-cloud-ext-storage": {}
}
uniCloud-alipay/database/cms-vote-info.schema.json
+3 -3
View File
@@ -3,9 +3,9 @@
"required": [],
"permission": {
"read": true,
"create": true,
"update": true,
"delete": true
"create": false,
"update": false,
"delete": false
},
"properties": {
"_id": {
uniCloud-alipay/database/cms-vote.schema.json
+3 -3
View File
@@ -3,9 +3,9 @@
"required": [],
"permission": {
"read": true,
"create": true,
"update": true,
"delete": true
"create": false,
"update": false,
"delete": false
},
"properties": {
"_id": {
uniCloud-alipay/database/user_select_vote.schema.json
+3 -3
View File
@@ -4,9 +4,9 @@
"required": [],
"permission": {
"read": true,
"create": true,
"update": true,
"delete": true
"create": false,
"update": false,
"delete": false
},
"properties": {
"_id": {