Upload.php

<?php

declare(strict_types=1);
/**
 * +----------------------------------------------------------------------
 * | ThinkAdmin Plugin for ThinkAdmin
 * +----------------------------------------------------------------------
 * | 版权所有 2014~2026 ThinkAdmin [ thinkadmin.top ]
 * +----------------------------------------------------------------------
 * | 官方网站: https://thinkadmin.top
 * +----------------------------------------------------------------------
 * | 开源协议 ( https://mit-license.org )
 * | 免责声明 ( https://thinkadmin.top/disclaimer )
 * | 会员特权 ( https://thinkadmin.top/vip-introduce )
 * +----------------------------------------------------------------------
 * | gitee 代码仓库：https://gitee.com/zoujingli/ThinkAdmin
 * | github 代码仓库：https://github.com/zoujingli/ThinkAdmin
 * +----------------------------------------------------------------------
 */

namespace app\admin\controller\api;

use app\admin\service\UploadSecurity;
use think\admin\Controller;
use think\admin\helper\QueryHelper;
use think\admin\model\SystemFile;
use think\admin\service\AdminService;
use think\admin\Storage;
use think\admin\storage\AliossStorage;
use think\admin\storage\AlistStorage;
use think\admin\storage\LocalStorage;
use think\admin\storage\MinioStorage;
use think\admin\storage\QiniuStorage;
use think\admin\storage\TxcosStorage;
use think\admin\storage\UpyunStorage;
use think\db\exception\DataNotFoundException;
use think\db\exception\DbException;
use think\db\exception\ModelNotFoundException;
use think\exception\HttpResponseException;
use think\file\UploadedFile;
use think\Response;

/**
 * 文件上传接口.
 * @class Upload
 */
class Upload extends Controller
{
    /**
     * 文件上传脚本.
     * @throws \think\admin\Exception
     */
    public function index(): Response
    {
        $data = ['exts' => []];
        [$uuid, $unid, $exts] = $this->initUnid(false);
        $allows = str2arr(sysconf('storage.allow_exts|raw'));
        if (empty($uuid) && $unid > 0) {
            $allows = array_intersect($exts, $allows);
        }
        foreach ($allows as $ext) {
            $data['exts'][$ext] = Storage::mime($ext);
        }
        $data['exts'] = json_encode($data['exts'], JSON_UNESCAPED_UNICODE);
        $data['nameType'] = sysconf('storage.name_type|raw') ?: 'xmd5';
        return view(dirname(__DIR__, 2) . '/view/api/upload.js', $data)->contentType('application/x-javascript');
    }

    /**
     * 文件选择器.
     * @throws DataNotFoundException
     * @throws DbException
     * @throws ModelNotFoundException
     */
    public function image()
    {
        [$uuid, $unid] = $this->initUnid();
        SystemFile::mQuery()->layTable(function () {
            $this->title = '文件选择器';
        }, function (QueryHelper $query) use ($unid, $uuid) {
            if ($unid && $uuid) {
                $query->where(function ($query) use ($uuid, $unid) {
                    /* @var \think\db\Query $query */
                    $query->whereOr([['uuid', '=', $uuid], ['unid', '=', $unid]]);
                });
            } else {
                $query->where($unid ? ['unid' => $unid] : ['uuid' => $uuid]);
            }
            $query->where(['status' => 2, 'issafe' => 0])->in('xext#type');
            $query->like('name,hash')->dateBetween('create_at')->order('id desc');
        });
    }

    /**
     * 文件上传检查；MinIO 普通文件签发单键授权，安全文件沿用本地安全目录.
     */
    public function state()
    {
        try {
            [$uuid, $unid] = $this->initUnid();
            [$name, $safe] = [input('name'), $this->getSafe()];
            $key = input('key', '');
            $data = ['uptype' => $this->getType(), 'safe' => intval($safe), 'key' => is_string($key) ? $key : ''];
            if ($safe && $data['uptype'] === 'minio') {
                $data['uptype'] = 'local';
            }
            $file = SystemFile::mk()->data($this->_vali([
                'xkey.value' => $data['key'],
                'type.value' => $data['uptype'],
                'uuid.value' => $uuid,
                'unid.value' => $unid,
                'name.require' => '名称不能为空！',
                'hash.require' => '哈希不能为空！',
                'xext.require' => '后缀不能为空！',
                'size.require' => '大小不能为空！',
                'mime.default' => '',
                'status.value' => 1,
            ]));
            $mime = $file->getAttr('mime');
            if (empty($mime)) {
                $file->setAttr('mime', Storage::mime($file->getAttr('xext')));
            }
            $extension = $file->getAttr('xext');
            $extension = is_string($extension) ? strtolower($extension) : '';
            if (!UploadSecurity::isNameSafe($data['key'], $extension)) {
                $this->error('文件路径或后缀异常，请重新上传文件！');
            }
            if (!UploadSecurity::isExtensionSafe($extension)) {
                $this->error('文件安全保护，禁止上传可执行文件！');
            }
            $info = Storage::instance($data['uptype'])->info($data['key'], $safe, $name);
            if (isset($info['url'], $info['key'])) {
                $file->save(['xurl' => $info['url'], 'isfast' => 1, 'issafe' => $data['safe']]);
                $extr = ['id' => $file->id ?? 0, 'url' => $info['url'], 'key' => $info['key']];
                $this->success('文件已经上传', array_merge($data, $extr), 200);
            } elseif ($data['uptype'] === 'local') {
                $local = LocalStorage::instance();
                $data['url'] = $local->url($data['key'], $safe, $name);
                $data['server'] = $local->upload();
            } elseif ($data['uptype'] === 'minio') {
                $minio = MinioStorage::instance();
                $token = $minio->token($data['key'], 3600, $name);
                $data['url'] = $token['siteurl'];
                $data['fields'] = $token['fields'];
                $data['server'] = $minio->upload();
            } elseif ($data['uptype'] === 'qiniu') {
                $qiniu = QiniuStorage::instance();
                $data['url'] = $qiniu->url($data['key'], $safe, $name);
                $data['token'] = $qiniu->token($data['key'], 3600, $name);
                $data['server'] = $qiniu->upload();
            } elseif ($data['uptype'] === 'alioss') {
                $alioss = AliossStorage::instance();
                $token = $alioss->token($data['key'], 3600, $name);
                $data['url'] = $token['siteurl'];
                $data['policy'] = $token['policy'];
                $data['signature'] = $token['signature'];
                $data['OSSAccessKeyId'] = $token['keyid'];
                $data['server'] = $alioss->upload();
            } elseif ($data['uptype'] === 'txcos') {
                $txcos = TxcosStorage::instance();
                $token = $txcos->token($data['key'], 3600, $name);
                $data['url'] = $token['siteurl'];
                $data['q-ak'] = $token['q-ak'];
                $data['policy'] = $token['policy'];
                $data['q-key-time'] = $token['q-key-time'];
                $data['q-signature'] = $token['q-signature'];
                $data['q-sign-algorithm'] = $token['q-sign-algorithm'];
                $data['server'] = $txcos->upload();
            } elseif ($data['uptype'] === 'upyun') {
                $upyun = UpyunStorage::instance();
                $token = $upyun->token($data['key'], 3600, $name, input('hash', ''));
                $data['url'] = $token['siteurl'];
                $data['policy'] = $token['policy'];
                $data['server'] = $upyun->upload();
                $data['authorization'] = $token['authorization'];
            } elseif ($data['uptype'] === 'alist') {
                $alist = AlistStorage::instance();
                $data['url'] = $alist->url($data['key']);
                $data['server'] = $alist->upload();
                $data['filepath'] = $alist->real($data['key']);
                $data['authorization'] = $alist->token();
            } else {
                $this->error('未知的存储引擎！');
            }
            $file->save(['xurl' => $data['url'], 'isfast' => 0, 'issafe' => $data['safe']]);
            $this->success('获取上传授权参数', array_merge($data, ['id' => $file->id ?? 0]), 404);
        } catch (HttpResponseException $exception) {
            throw $exception;
        } catch (\Exception $exception) {
            $this->error($exception->getMessage());
        }
    }

    /**
     * 更新文件状态
     */
    public function done()
    {
        [$uuid, $unid] = $this->initUnid();
        $data = $this->_vali([
            'id.require' => '编号不能为空！',
            'hash.require' => '哈希不能为空！',
            'uuid.value' => $uuid,
            'unid.value' => $unid,
        ]);
        $file = SystemFile::mk()->where($data)->findOrEmpty();
        if ($file->isEmpty()) {
            $this->error('文件不存在！');
        }
        if ($file->save(['status' => 2])) {
            $this->success('更新成功！');
        } else {
            $this->error('更新失败！');
        }
    }

    /**
     * 文件上传入口.
     * @throws \think\admin\Exception
     */
    public function file()
    {
        [$uuid, $unid, $unexts] = $this->initUnid();
        // 开始处理文件上传
        $file = $this->getFile();
        $extension = strtolower($file->getOriginalExtension());
        $key = input('key', '');
        if (!is_string($key) && $key !== '') {
            $this->error('文件路径或后缀异常，请重新上传文件！');
        }
        $saveFileName = is_string($key) ? $key : '';
        $saveFileName = $saveFileName ?: Storage::name($file->getPathname(), $extension, '', 'md5_file');
        if (!UploadSecurity::isNameSafe($saveFileName, $extension)) {
            $this->error('文件路径或后缀异常，请重新上传文件！');
        }
        // 屏蔽禁止上传指定后缀的文件
        if (!in_array($extension, str2arr(sysconf('storage.allow_exts|raw')))) {
            $this->error('文件类型受限，请在后台配置规则！');
        }
        // 前端用户上传后缀检查处理
        if (empty($uuid) && $unid > 0 && !in_array($extension, $unexts)) {
            $this->error('文件类型受限，请上传允许的文件类型！');
        }
        if (!UploadSecurity::isExtensionSafe($extension)) {
            $this->error('文件安全保护，禁止上传可执行文件！');
        }
        try {
            $safeMode = $this->getSafe();
            if (in_array($extension, ['jpg', 'gif', 'png', 'bmp', 'jpeg', 'wbmp'])) {
                $imageSize = @getimagesize($file->getPathname());
                if (!UploadSecurity::isImageSafe($file->getPathname()) || $imageSize === false || $imageSize[0] < 1 || $imageSize[1] < 1) {
                    $this->error('图片未通过安全检查！');
                }
            }
            if (($type = $this->getType()) === 'local') {
                $local = LocalStorage::instance();
                $distName = $local->path($saveFileName, $safeMode);
                if (PHP_SAPI === 'cli') {
                    is_dir(dirname($distName)) || mkdir(dirname($distName), 0777, true);
                    rename($file->getPathname(), $distName);
                } else {
                    $file->move(dirname($distName), basename($distName));
                }
                $info = $local->info($saveFileName, $safeMode, $file->getOriginalName());
            } else {
                $bina = file_get_contents($file->getPathname());
                $info = Storage::instance($type)->set($saveFileName, $bina, $safeMode, $file->getOriginalName());
            }
            if (isset($info['url'])) {
                $this->success('文件上传成功！', ['url' => $safeMode ? $saveFileName : $info['url']]);
            } else {
                $this->error('文件处理失败，请稍候再试！');
            }
        } catch (HttpResponseException $exception) {
            throw $exception;
        } catch (\Exception $exception) {
            trace_file($exception);
            $this->error($exception->getMessage());
        }
    }

    /**
     * 获取上传类型.
     */
    private function getSafe(): bool
    {
        return boolval(input('safe', '0'));
    }

    /**
     * 获取上传方式.
     * @throws \think\admin\Exception
     */
    private function getType(): string
    {
        $type = strtolower(input('uptype', ''));
        if (in_array($type, array_keys(Storage::types()))) {
            return $type;
        }
        return strtolower(sysconf('storage.type|raw'));
    }

    /**
     * 获取文件对象
     * @return UploadedFile|void
     */
    private function getFile(): UploadedFile
    {
        try {
            $file = $this->request->file('file');
            if ($file instanceof UploadedFile) {
                return $file;
            }
            $this->error('读取临时文件失败！');
        } catch (HttpResponseException $exception) {
            throw $exception;
        } catch (\Exception $exception) {
            trace_file($exception);
            $this->error(lang($exception->getMessage()));
        }
    }

    /**
     * 初始化用户状态
     */
    private function initUnid(bool $check = true): array
    {
        $uuid = AdminService::getUserId();
        [$unid, $exts] = AdminService::withUploadUnid();
        if ($check && empty($uuid) && empty($unid)) {
            $this->error('未登录，禁止使用文件上传！');
        } else {
            return [$uuid, $unid, $exts];
        }
    }
}