From 50f8a89d51eba744828e41281efc3f764e3487fa Mon Sep 17 00:00:00 2001
From: cs10086 <1291454411@qq.com>
Date: Thu, 10 Sep 2026 21:31:25 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BA=91=E5=87=BD=E6=95=B0=E9=89=B4?=
 =?UTF-8?q?=E6=9D=83=E5=8A=A0=E5=9B=BA=E4=B8=8E=E6=8A=95=E7=A5=A8=E6=95=B0?=
 =?UTF-8?q?=E6=8D=AE=E9=98=B2=E6=8A=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- follow/cms-vote/cms-articles-like/cms-articles-collect 云对象写操作强制 checkToken,uid 以服务端令牌为准,杜绝客户端伪造身份
- user-info.getIP 仅允许查询本人登录 IP(get_user_info 公开资料保持不变)
- ext-storage-co 上传凭证需登录,删除文件仅限 admin 角色(原为完全裸奔)
- cms-vote/cms-vote-info/user_select_vote 三表 schema 写权限全部关闭(投票读写均走云对象)
- 修复 follow.reFollow 中 total<0 永假导致的逻辑错误
- 各云对象 package.json 补 uni-id-common 依赖声明
- main.js 登录过期跳转修正为实际页面路径 /pages/login/login
---
 main.js                                       |  2 +-
 .../cms-articles-collect/index.obj.js         | 15 ++++++++----
 .../cms-articles-collect/package.json         |  4 +++-
 .../cms-articles-like/index.obj.js            | 13 ++++++++---
 .../cms-articles-like/package.json            |  4 +++-
 .../cloudfunctions/cms-vote/index.obj.js      |  8 ++++++-
 .../cloudfunctions/cms-vote/package.json      |  4 +++-
 .../ext-storage-co/index.obj.js               |  8 ++++++-
 .../ext-storage-co/package.json               |  4 +++-
 .../cloudfunctions/follow/index.obj.js        | 23 +++++++++++--------
 .../cloudfunctions/follow/package.json        |  4 +++-
 .../cloudfunctions/user-info/index.obj.js     |  9 ++++++--
 .../cloudfunctions/user-info/package.json     |  4 +++-
 .../database/cms-vote-info.schema.json        |  6 ++---
 uniCloud-alipay/database/cms-vote.schema.json |  6 ++---
 .../database/user_select_vote.schema.json     |  6 ++---
 16 files changed, 83 insertions(+), 37 deletions(-)

diff --git a/main.js b/main.js
index daa4e7a..d1be966 100644
--- a/main.js
+++ b/main.js
@@ -94,7 +94,7 @@ function handleTokenExpired() {
     showCancel: false,
     success: () => {
       uni.removeStorageSync('uni_id_token')
-      uni.reLaunch({ url: '/pages/login' })
+      uni.reLaunch({ url: '/pages/login/login' })
     }
   })
 }
diff --git a/uniCloud-alipay/cloudfunctions/cms-articles-collect/index.obj.js b/uniCloud-alipay/cloudfunctions/cms-articles-collect/index.obj.js
index 6adcadc..3986f7a 100644
--- a/uniCloud-alipay/cloudfunctions/cms-articles-collect/index.obj.js
+++ b/uniCloud-alipay/cloudfunctions/cms-articles-collect/index.obj.js
@@ -1,13 +1,18 @@
 const db = uniCloud.database();
 const _ = db.command;
+const uniID = require('uni-id-common');
 
 module.exports = {
 	_before: function () { // 通用预处理器
-
+		this.uniID = uniID.createInstance({
+			context: this.getClientInfo()
+		});
 	},
-	
+
 	async collectArticle(query) {
-		let user_id = query.user_id;
+		const payload = await this.uniID.checkToken(this.getUniIdToken());
+		if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+		let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
 		let article_id = query.article_id;
 		let datetime = new Date().getTime();
 		const transaction = await db.startTransaction();
@@ -49,7 +54,9 @@ module.exports = {
 	async recollectArticle(query) {
 		
 		try {
-			let user_id = query.user_id;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
 			let article_id = query.article_id;
 	
 			const reclollectRes = await db.collection('cms-articles-collect')
diff --git a/uniCloud-alipay/cloudfunctions/cms-articles-collect/package.json b/uniCloud-alipay/cloudfunctions/cms-articles-collect/package.json
index 42efe1c..48fdaa3 100644
--- a/uniCloud-alipay/cloudfunctions/cms-articles-collect/package.json
+++ b/uniCloud-alipay/cloudfunctions/cms-articles-collect/package.json
@@ -1,6 +1,8 @@
 {
   "name": "cms-articles-collect",
-  "dependencies": {},
+  "dependencies": {
+    "uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
+  },
   "extensions": {
     "uni-cloud-jql": {}
   }
diff --git a/uniCloud-alipay/cloudfunctions/cms-articles-like/index.obj.js b/uniCloud-alipay/cloudfunctions/cms-articles-like/index.obj.js
index 673d9d4..be8dba0 100644
--- a/uniCloud-alipay/cloudfunctions/cms-articles-like/index.obj.js
+++ b/uniCloud-alipay/cloudfunctions/cms-articles-like/index.obj.js
@@ -1,13 +1,18 @@
 const db = uniCloud.database();
 const _ = db.command;
+const uniID = require('uni-id-common');
 
 module.exports = {
 	_before: function () {
-
+		this.uniID = uniID.createInstance({
+			context: this.getClientInfo()
+		});
 	},
 
 	async likeArticle(query) {
-		let user_id = query.user_id;
+		const payload = await this.uniID.checkToken(this.getUniIdToken());
+		if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+		let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
 		let article_id = query.article_id;
 		let datetime = new Date().getTime();
 		
@@ -50,7 +55,9 @@ module.exports = {
 	async relikeArticle(query) {
 		
 		try {
-			let user_id = query.user_id;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			let user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
 			let article_id = query.article_id;
 			let datetime = new Date().getTime();
 			
diff --git a/uniCloud-alipay/cloudfunctions/cms-articles-like/package.json b/uniCloud-alipay/cloudfunctions/cms-articles-like/package.json
index d7c4879..480e87d 100644
--- a/uniCloud-alipay/cloudfunctions/cms-articles-like/package.json
+++ b/uniCloud-alipay/cloudfunctions/cms-articles-like/package.json
@@ -1,6 +1,8 @@
 {
   "name": "cms-articles-like",
-  "dependencies": {},
+  "dependencies": {
+    "uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
+  },
   "extensions": {
     "uni-cloud-jql": {}
   }
diff --git a/uniCloud-alipay/cloudfunctions/cms-vote/index.obj.js b/uniCloud-alipay/cloudfunctions/cms-vote/index.obj.js
index 4213a72..b1bfac3 100644
--- a/uniCloud-alipay/cloudfunctions/cms-vote/index.obj.js
+++ b/uniCloud-alipay/cloudfunctions/cms-vote/index.obj.js
@@ -1,10 +1,13 @@
 const { count } = require("console");
+const uniID = require('uni-id-common');
 
 const db = uniCloud.database();
 const _ =db.command;
 module.exports = {
 	_before: function () { // 通用预处理器
-
+		this.uniID = uniID.createInstance({
+			context: this.getClientInfo()
+		});
 	},
 	async getVoteInfo(query) {
 		try {
@@ -42,12 +45,15 @@ module.exports = {
 	},
 	async add_vote(query) {
 		try {
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
 			let {
 				vote_id,
 				selectValue,
 				user_id,
 				type
 			} = query;
+			user_id = payload.uid; // 以服务端令牌为准，忽略客户端传入
 			
 			let t = await db.collection("cms-vote")
 			.where({
diff --git a/uniCloud-alipay/cloudfunctions/cms-vote/package.json b/uniCloud-alipay/cloudfunctions/cms-vote/package.json
index 6b65650..300c9c3 100644
--- a/uniCloud-alipay/cloudfunctions/cms-vote/package.json
+++ b/uniCloud-alipay/cloudfunctions/cms-vote/package.json
@@ -1,6 +1,8 @@
 {
   "name": "cms-vote",
-  "dependencies": {},
+  "dependencies": {
+    "uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
+  },
   "extensions": {
     "uni-cloud-jql": {}
   }
diff --git a/uniCloud-alipay/cloudfunctions/ext-storage-co/index.obj.js b/uniCloud-alipay/cloudfunctions/ext-storage-co/index.obj.js
index 0750546..668c248 100644
--- a/uniCloud-alipay/cloudfunctions/ext-storage-co/index.obj.js
+++ b/uniCloud-alipay/cloudfunctions/ext-storage-co/index.obj.js
@@ -1,4 +1,6 @@
 
+const uniID = require('uni-id-common');
+
 const extStorageManager = uniCloud.getExtStorageManager({
 	provider: "qiniu",
 	domain:"qnycdn.mymoyu.top",
@@ -10,7 +12,9 @@ module.exports = {
 	_before: function() {
 
 	},
-	getUploadFileOptions(data = {}) {
+	async getUploadFileOptions(data = {}) {
+		const { errCode } = await uniID.createInstance({ context: this.getClientInfo() }).checkToken(this.getUniIdToken());
+		if (errCode) throw new Error('请先登录后再上传文件');
 		let {
 			cloudPath
 		} = data;
@@ -48,6 +52,8 @@ module.exports = {
 	// },
 	// // 删除文件
 	async deleteFile(data = {}) {
+		const { role, errCode } = await uniID.createInstance({ context: this.getClientInfo() }).checkToken(this.getUniIdToken());
+		if (errCode || !(role || []).includes('admin')) throw new Error('仅管理员可删除文件');
 		let {
 			fileList
 		} = data;
diff --git a/uniCloud-alipay/cloudfunctions/ext-storage-co/package.json b/uniCloud-alipay/cloudfunctions/ext-storage-co/package.json
index 5c44141..d527593 100644
--- a/uniCloud-alipay/cloudfunctions/ext-storage-co/package.json
+++ b/uniCloud-alipay/cloudfunctions/ext-storage-co/package.json
@@ -1,7 +1,9 @@
 {
   "type": "module",
   "name": "ext-storage-co",
-  "dependencies": {},
+  "dependencies": {
+    "uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
+  },
   "extensions": {
     "uni-cloud-ext-storage": {}
   },
diff --git a/uniCloud-alipay/cloudfunctions/follow/index.obj.js b/uniCloud-alipay/cloudfunctions/follow/index.obj.js
index bd2c0b8..8f60799 100644
--- a/uniCloud-alipay/cloudfunctions/follow/index.obj.js
+++ b/uniCloud-alipay/cloudfunctions/follow/index.obj.js
@@ -1,8 +1,11 @@
 const db = uniCloud.database();
 const _ = db.command;
+const uniID = require('uni-id-common');
 module.exports = {
 	_before: function () { // 通用预处理器
-
+		this.uniID = uniID.createInstance({
+			context: this.getClientInfo()
+		});
 	},
 	async getIsFollow(query) {
 		try {
@@ -35,10 +38,10 @@ module.exports = {
 	},
 	async follow(query) {
 		try {
-			const {
-				uid,
-				fid
-			} = query;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			const uid = payload.uid; // 以服务端令牌为准，忽略客户端传入
+			const fid = query.fid;
 			const res = await db.collection("follow").where({
 				uid: uid,
 				fid: fid
@@ -70,15 +73,15 @@ module.exports = {
 	},
 	async reFollow(query) {
 		try {
-			const {
-				uid,
-				fid
-			} = query;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			const uid = payload.uid; // 以服务端令牌为准，忽略客户端传入
+			const fid = query.fid;
 			const res = await db.collection("follow").where({
 				uid: uid,
 				fid: fid
 			}).count();
-			if (res.total < 0) {
+			if (res.total == 0) {
 				return {
 					code: 201,
 					msg: "未关注"
diff --git a/uniCloud-alipay/cloudfunctions/follow/package.json b/uniCloud-alipay/cloudfunctions/follow/package.json
index 119457c..6e5de01 100644
--- a/uniCloud-alipay/cloudfunctions/follow/package.json
+++ b/uniCloud-alipay/cloudfunctions/follow/package.json
@@ -1,6 +1,8 @@
 {
   "name": "follow",
-  "dependencies": {},
+  "dependencies": {
+    "uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
+  },
   "extensions": {
     "uni-cloud-jql": {}
   }
diff --git a/uniCloud-alipay/cloudfunctions/user-info/index.obj.js b/uniCloud-alipay/cloudfunctions/user-info/index.obj.js
index 14be990..db527d2 100644
--- a/uniCloud-alipay/cloudfunctions/user-info/index.obj.js
+++ b/uniCloud-alipay/cloudfunctions/user-info/index.obj.js
@@ -1,6 +1,7 @@
 const db = uniCloud.database();
 const _ = db.command;
 const crypto = require('crypto');
+const uniID = require('uni-id-common');
 let obj = {
 	isValidIP(ip) {
 	    // ------------------------- IPv4 验证 -------------------------
@@ -134,11 +135,15 @@ let obj = {
 }
 module.exports = {
 	_before: function () { // 通用预处理器
-
+		this.uniID = uniID.createInstance({
+			context: this.getClientInfo()
+		});
 	},
 	async getIP(query) {
 		try {
-			let { uid } = query;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			let uid = payload.uid; // 仅允许查询自己的登录 IP
 			let res = await db.collection("uni-id-users")
 			.doc(uid)
 			.field({
diff --git a/uniCloud-alipay/cloudfunctions/user-info/package.json b/uniCloud-alipay/cloudfunctions/user-info/package.json
index 6c90dbe..7b721bc 100644
--- a/uniCloud-alipay/cloudfunctions/user-info/package.json
+++ b/uniCloud-alipay/cloudfunctions/user-info/package.json
@@ -1,6 +1,8 @@
 {
   "name": "user-info",
-  "dependencies": {},
+  "dependencies": {
+    "uni-id-common": "file:../../../uni_modules/uni-id-common/uniCloud/cloudfunctions/common/uni-id-common"
+  },
   "extensions": {
     "uni-cloud-ext-storage": {}
   }
diff --git a/uniCloud-alipay/database/cms-vote-info.schema.json b/uniCloud-alipay/database/cms-vote-info.schema.json
index c34b09e..752dc0d 100644
--- a/uniCloud-alipay/database/cms-vote-info.schema.json
+++ b/uniCloud-alipay/database/cms-vote-info.schema.json
@@ -3,9 +3,9 @@
 	"required": [],
 	"permission": {
 		"read": true,
-		"create": true,
-		"update": true,
-		"delete": true
+		"create": false,
+		"update": false,
+		"delete": false
 	},
 	"properties": {
 		"_id": {
diff --git a/uniCloud-alipay/database/cms-vote.schema.json b/uniCloud-alipay/database/cms-vote.schema.json
index 7df81b3..7c48b4c 100644
--- a/uniCloud-alipay/database/cms-vote.schema.json
+++ b/uniCloud-alipay/database/cms-vote.schema.json
@@ -3,9 +3,9 @@
 	"required": [],
 	"permission": {
 		"read": true,
-		"create": true,
-		"update": true,
-		"delete": true
+		"create": false,
+		"update": false,
+		"delete": false
 	},
 	"properties": {
 		"_id": {
diff --git a/uniCloud-alipay/database/user_select_vote.schema.json b/uniCloud-alipay/database/user_select_vote.schema.json
index 3c5c244..2bb2f83 100644
--- a/uniCloud-alipay/database/user_select_vote.schema.json
+++ b/uniCloud-alipay/database/user_select_vote.schema.json
@@ -4,9 +4,9 @@
 	"required": [],
 	"permission": {
 		"read": true,
-		"create": true,
-		"update": true,
-		"delete": true
+		"create": false,
+		"update": false,
+		"delete": false
 	},
 	"properties": {
 		"_id": {