yunzerwebsite/yunzerwebsiteallinone
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

更新

Browse Source
This commit is contained in:
hero920103 committed 2026-10-19 01:13:17 +08:00
1 parent 5718a00e31
commit 1850ac640e
226 files changed
+37772 -12071
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

go/controllers/backend_file.go
+39 -42
View File
@@ -12,6 +12,7 @@ import (
"time"
"server/models"
"server/pkg/identity"
"server/pkg/jwtutil"
"server/services"
@@ -46,34 +47,13 @@ var allowedExtByCategory = map[string][]string{
}
func (c *BackendFileController) backendClaims() (*jwtutil.Claims, error) {
auth := c.Ctx.Request.Header.Get("Authorization")
if auth == "" {
return nil, fmt.Errorf("未登录")
}
parts := strings.SplitN(auth, " ", 2)
if len(parts) != 2 || parts[0] != "Bearer" {
return nil, fmt.Errorf("认证信息格式错误")
}
claims, err := jwtutil.ParseToken(parts[1])
if err != nil {
return nil, fmt.Errorf("无效的token")
}
if claims.UserType != "backend" {
return nil, fmt.Errorf("无权访问")
}
return claims, nil
return identity.Claims(c.Ctx.Request.Header.Get("Authorization"), identity.EndBackend)
}
// effectiveTid 取文件归属租户 ID：只认令牌 claims。
// ?tid= 与 X-Tenant-Id 此前可覆盖登录态，等于让任意 backend 账号往别人的目录树写文件。
func (c *BackendFileController) effectiveTid(claims *jwtutil.Claims) uint64 {
_ = c.ParseForm(1 << 20)
if tid, err := c.GetUint64("tid"); err == nil && tid > 0 {
return tid
}
if h := strings.TrimSpace(c.Ctx.Request.Header.Get("X-Tenant-Id")); h != "" {
if v, e := strconv.ParseUint(h, 10, 64); e == nil {
return v
}
}
_ = c.ParseForm(1 << 20) // 上传接口需要先解析表单字段
if claims != nil && claims.TenantId > 0 {
return uint64(claims.TenantId)
}
@@ -195,7 +175,8 @@ func removePhysicalBySrc(webSrc string) {
func (c *BackendFileController) GetAllFiles() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -249,7 +230,8 @@ func (c *BackendFileController) GetAllFiles() {
func (c *BackendFileController) GetUserCate() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -290,7 +272,8 @@ type createCateBody struct {
func (c *BackendFileController) CreateFileCate() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -337,7 +320,8 @@ type renameCateBody struct {
func (c *BackendFileController) RenameFileCate() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -383,7 +367,8 @@ func (c *BackendFileController) RenameFileCate() {
func (c *BackendFileController) DeleteFileCate() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -428,7 +413,8 @@ func (c *BackendFileController) DeleteFileCate() {
func (c *BackendFileController) GetCateFiles() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -486,7 +472,8 @@ func (c *BackendFileController) GetCateFiles() {
func (c *BackendFileController) GetFileByID() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -513,7 +500,8 @@ func (c *BackendFileController) GetFileByID() {
func (c *BackendFileController) UploadFile() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
if err := c.Ctx.Request.ParseMultipartForm(fileUploadMaxBytes); err != nil {
@@ -659,7 +647,8 @@ type updateFileBody struct {
func (c *BackendFileController) UpdateFile() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -713,7 +702,8 @@ func (c *BackendFileController) UpdateFile() {
func (c *BackendFileController) DeleteFile() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -745,7 +735,8 @@ func (c *BackendFileController) DeleteFile() {
func (c *BackendFileController) DeleteFilePermanently() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -783,7 +774,8 @@ func (c *BackendFileController) DeleteFilePermanently() {
func (c *BackendFileController) MoveFile() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -821,7 +813,8 @@ type idsBody struct {
func (c *BackendFileController) BatchDeleteFiles() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -861,7 +854,8 @@ func (c *BackendFileController) BatchDeleteFiles() {
func (c *BackendFileController) BatchDeleteFilesPermanently() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)
@@ -925,7 +919,8 @@ var avatarAllowedExts = map[string]bool{
func (c *BackendFileController) UploadAvatar() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
if err := c.Ctx.Request.ParseMultipartForm(avatarUploadMaxBytes); err != nil {
@@ -1023,7 +1018,8 @@ func (c *BackendFileController) saveAvatarAndReply(identityID int, url, name str
func (c *BackendFileController) UpdateAvatar() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
idStr := c.Ctx.Input.Param(":id")
@@ -1048,7 +1044,8 @@ func (c *BackendFileController) UpdateAvatar() {
func (c *BackendFileController) BatchMoveFiles() {
claims, err := c.backendClaims()
if err != nil {
c.jsonErr(401, 401, err.Error())
code := identity.Status(err)
c.jsonErr(code, code, err.Error())
return
}
tid := c.effectiveTid(claims)