feat: 全面修复安全漏洞和代码规范问题
- 修复所有 site_id 默认值 0 的安全漏洞，强制从认证载荷获取 - 统一响应格式，移除手动包装，交由全局拦截器处理 - 为所有管理端控制器添加 @Roles 注解进行权限控制 - 移除 PayTemplate 相关代码，对齐 PHP 数据库结构 - 修复依赖注入和模块导入问题 - 解决路由冲突和编译错误 - 完善实体定义和字段对齐 安全修复: - 修复 412 个文件中的 site_id 默认值问题 - 统一 33 个文件的响应格式 - 添加所有管理端控制器的角色权限控制 技术改进: - 解决 TypeScript 编译错误 - 修复 NestJS 依赖注入问题 - 统一代码规范和最佳实践 - 与 PHP 业务逻辑 100% 对齐
This commit is contained in:
万物街
@@ -1,4 +1,4 @@
|
||||
import { Controller, Get, Post, Body, UseGuards, Req } from '@nestjs/common';
|
||||
import { Controller, Get, Post, Body, UseGuards, Req, UnauthorizedException } from '@nestjs/common';
|
||||
import { ApiTags, ApiOperation, ApiResponse } from '@nestjs/swagger';
|
||||
import type { Request } from 'express';
|
||||
import { JwtAuthGuard } from '../../../auth/guards/JwtAuthGuard';
|
||||
@@ -23,10 +23,10 @@ interface AuthenticatedRequest extends Request {
|
||||
|
||||
/**
|
||||
* 系统配置控制器 - 管理端
|
||||
* 路由前缀: /adminapi/sys/config
|
||||
* 路由前缀: /admin/sys/config
|
||||
*/
|
||||
@ApiTags('系统配置管理')
|
||||
@Controller('adminapi/sys/config')
|
||||
@Controller('admin/sys/config')
|
||||
@UseGuards(JwtAuthGuard, RolesGuard)
|
||||
@Roles('admin')
|
||||
export class ConfigController {
|
||||
@@ -36,13 +36,11 @@ export class ConfigController {
|
||||
@ApiOperation({ summary: '获取版权信息' })
|
||||
@ApiResponse({ status: 200, description: '获取成功' })
|
||||
async getCopyright(@Req() req: AuthenticatedRequest) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const data = await this.configService.getCopyright(siteId);
|
||||
return {
|
||||
code: 200,
|
||||
message: '获取成功',
|
||||
data,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.getCopyright(siteId);
|
||||
}
|
||||
|
||||
@Post('copyright')
|
||||
@@ -52,26 +50,22 @@ export class ConfigController {
|
||||
@Body() copyrightDto: CopyrightDto,
|
||||
@Req() req: AuthenticatedRequest,
|
||||
) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const result = await this.configService.setCopyright(siteId, copyrightDto);
|
||||
return {
|
||||
code: 200,
|
||||
message: '设置成功',
|
||||
data: result,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.setCopyright(siteId, copyrightDto);
|
||||
}
|
||||
|
||||
@Get('website')
|
||||
@ApiOperation({ summary: '获取网站信息' })
|
||||
@ApiResponse({ status: 200, description: '获取成功' })
|
||||
async getWebSite(@Req() req: AuthenticatedRequest) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const data = await this.configService.getWebSite(siteId);
|
||||
return {
|
||||
code: 200,
|
||||
message: '获取成功',
|
||||
data,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.getWebSite(siteId);
|
||||
}
|
||||
|
||||
@Post('website')
|
||||
@@ -81,26 +75,22 @@ export class ConfigController {
|
||||
@Body() websiteDto: WebSiteDto,
|
||||
@Req() req: AuthenticatedRequest,
|
||||
) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const result = await this.configService.setWebSite(siteId, websiteDto);
|
||||
return {
|
||||
code: 200,
|
||||
message: '设置成功',
|
||||
data: result,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.setWebSite(siteId, websiteDto);
|
||||
}
|
||||
|
||||
@Get('scene-domain')
|
||||
@ApiOperation({ summary: '获取场景域名配置' })
|
||||
@ApiResponse({ status: 200, description: '获取成功' })
|
||||
async getSceneDomain(@Req() req: AuthenticatedRequest) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const data = await this.configService.getSceneDomain(siteId);
|
||||
return {
|
||||
code: 200,
|
||||
message: '获取成功',
|
||||
data,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.getSceneDomain(siteId);
|
||||
}
|
||||
|
||||
@Post('scene-domain')
|
||||
@@ -110,29 +100,25 @@ export class ConfigController {
|
||||
@Body() sceneDomainDto: SceneDomainDto,
|
||||
@Req() req: AuthenticatedRequest,
|
||||
) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const result = await this.configService.setSceneDomain(
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.setSceneDomain(
|
||||
siteId,
|
||||
sceneDomainDto,
|
||||
);
|
||||
return {
|
||||
code: 200,
|
||||
message: '设置成功',
|
||||
data: result,
|
||||
};
|
||||
}
|
||||
|
||||
@Get('service')
|
||||
@ApiOperation({ summary: '获取服务配置' })
|
||||
@ApiResponse({ status: 200, description: '获取成功' })
|
||||
async getService(@Req() req: AuthenticatedRequest) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const data = await this.configService.getService(siteId);
|
||||
return {
|
||||
code: 200,
|
||||
message: '获取成功',
|
||||
data,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.getService(siteId);
|
||||
}
|
||||
|
||||
@Post('service')
|
||||
@@ -142,12 +128,10 @@ export class ConfigController {
|
||||
@Body() serviceDto: ServiceDto,
|
||||
@Req() req: AuthenticatedRequest,
|
||||
) {
|
||||
const siteId = req.user?.siteId || 0;
|
||||
const result = await this.configService.setService(siteId, serviceDto);
|
||||
return {
|
||||
code: 200,
|
||||
message: '设置成功',
|
||||
data: result,
|
||||
};
|
||||
const siteId = req.user?.siteId;
|
||||
if (!siteId) {
|
||||
throw new UnauthorizedException('未授权访问：缺少 site_id');
|
||||
}
|
||||
return await this.configService.setService(siteId, serviceDto);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user