SmsRecipient/app/controller/SmsController.php
mao fa38561b19 fix(app/controller): 修复短信内容查询未添加用户权限验证
- 在 SmsController 中查询短信内容时,添加了用户 ID 的条件限制
- 这个修改确保了用户只能查询自己的短信内容,增强了系统安全性
2025-05-06 14:25:37 +08:00

235 lines
9.1 KiB
PHP

<?php
namespace app\controller;
use app\model\SmsApp;
use app\model\SmsContent;
use app\model\User;
use app\model\UsersToken;
use support\Request;
use support\View;
class SmsController
{
public function index(Request $request)
{
if (session('nickname', "未登录") === "未登录") return msg('请先登录', "请登录后继续。", "/user/login", '立即登录');
View::assign(["nickname" => session('nickname', "未登录")]);
View::assign([
"header" => view('common/header')->rawBody(),
"footer" => view('common/footer')->rawBody()
]);
$sms_app = SmsApp::where('user_id', session('user_id'))->get();
// 获取短信内容
$smsContent = SmsContent::select()->where('user_id', session('user_id'));
// 根据应用名称获取短信内容
if (!empty($request->get('app_name'))) {
$smsContent->where('app_name', $request->get('app_name'));
}
// 根据UUID获取短信内容
if (!empty($request->get('app_uuid'))) {
$smsContent->where('app_uuid', $request->get('app_uuid'));
}
// 根据手机号获取短信内容
if (!empty($request->get('from'))) {
$smsContent->whereLike('from', "%" . $request->get('from') . "%");
}
// 根据IP获取短信内容
if (!empty($request->get('ip'))) {
$smsContent->whereLike('ip', "%" . $request->get('ip') . "%");
}
// 根据内容获取短信内容
if (!empty($request->get('content'))) {
$smsContent->whereLike('content', "%" . $request->get('content') . "%");
}
// 根据接收时间获取短信内容
if (!empty($request->get('receive_time'))) {
$rt = $request->get('receive_time');
if (count($rt) === 2) {
if (!empty($rt[0]) && !empty($rt[1])) {
$smsContent->whereBetween('created_at', $request->get('receive_time'));
}
}
}
// 倒序
$smsContent->orderBy('id', 'desc');
$smsContentPaginate = $smsContent->paginate($request->get('limit', 10));
return view('sms/index', ['get' => $request->get(), 'smsContent' => $smsContentPaginate, 'sms_app' => $sms_app]);
}
public function s(Request $request, string $uuid)
{
// token是否存在
$token = $request->get('token', '');
if (!$token) $token = $request->post('token', '');
if (!$token) {
return json(['code' => 1, 'msg' => 'token不存在']);
}
$tokenExist = UsersToken::where('token', $token)->first();
if (!$tokenExist) {
return json(['code' => 2, 'msg' => 'token不存在']);
}
$user_id = $tokenExist->user_id;
$sms_app = SmsApp::where('app_uuid', $uuid)->first();
if (!$sms_app) {
return json(['code' => 3, 'msg' => '应用不存在']);
}
if ($sms_app->user_id !== $user_id) {
return json(['code' => 4, 'msg' => '应用不存在']);
}
$smsContent = new SmsContent();
$smsContent->user_id = $user_id;
$smsContent->app_name = $sms_app->app_name;
$smsContent->app_uuid = $uuid;
$smsContent->headers = json_encode($request->header());
$smsContent->original = json_encode($request->all());
$smsContent->from = $request->input('from', '');
$smsContent->content = $request->input('content', '');
$smsContent->ip = $request->getRemoteIp() . ":" . $request->getRemotePort();
$smsContent->save();
return json(['code' => 0, 'msg' => 'ok']);
}
public function app(Request $request)
{
if (session('nickname', "未登录") === "未登录") return msg('请先登录', "请登录后继续。", "/user/login", '立即登录');
View::assign(["nickname" => session('nickname', "未登录")]);
View::assign([
"header" => view('common/header')->rawBody(),
"footer" => view('common/footer')->rawBody()
]);
$user = User::where('id', session('user_id'))->first();
if (!$user) {
session(['nickname' => null, 'user_id' => null]);
return msg('用户不存在', "请重新登录后继续。", "/user/login", "登录");
}
$sms_app = SmsApp::where('user_id', $user->id)->get();
View::assign([
'sms_app' => $sms_app
]);
return view('sms/app');
}
public function createApp(Request $request)
{
if (session('nickname', "未登录") === "未登录") return msg('请先登录', "请登录后继续。", "/user/login", '立即登录');
View::assign(["nickname" => session('nickname', "未登录")]);
View::assign([
"header" => view('common/header')->rawBody(),
"footer" => view('common/footer')->rawBody()
]);
$user = User::where('id', session('user_id'))->first();
if (!$user) {
session(['nickname' => null, 'user_id' => null]);
return msg('用户不存在', "请重新登录后继续。", "/user/login", "登录");
}
return view('sms/create_app');
}
public function appStore(Request $request)
{
if (session('nickname', "未登录") === "未登录") return msg('请先登录', "请登录后继续。", "/user/login", '立即登录');
View::assign(["nickname" => session('nickname', "未登录")]);
View::assign([
"header" => view('common/header')->rawBody(),
"footer" => view('common/footer')->rawBody()
]);
$user = User::where('id', session('user_id'))->first();
if (!$user) {
session(['nickname' => null, 'user_id' => null]);
return msg('用户不存在', "请重新登录后继续。", "/user/login", "登录");
}
if (empty($request->post('app_name', ''))) {
return msg('请输入应用名称', "请输入应用名称后继续。", "/sms/create-app", "返回");
}
$appName = $request->post('app_name', '');
if (strlen($appName) > 255) {
return msg('应用名称过长', "请输入255个字符内名称后继续。", "/sms/create-app", "返回");
}
$appNameExist = SmsApp::where('app_name', $appName)->first();
if ($appNameExist) {
return msg('应用名称已存在', "请重新创建。", "/sms/create-app", "返回");
}
$uuid = uniqid('', true);
$uuid = md5($uuid);
$uuid = substr($uuid, 0, 8) . '-' . substr($uuid, 8, 4) . '-' . substr($uuid, 12, 4) . '-' . substr($uuid, 16, 4) . '-' . substr($uuid, 20, 12);
$uuidExist = SmsApp::where('app_uuid', $uuid)->first();
if ($uuidExist) {
return msg('UUID已存在', "请重新创建。", "/sms/create-app", "返回");
}
$sms_app = new SmsApp();
$sms_app->user_id = $user->id;
$sms_app->app_name = $request->post('app_name', '');
$sms_app->app_uuid = $uuid;
$sms_app->save();
return msg('创建成功', "请使用个人密钥访问此应用。", "/sms/app", "返回");
}
public function deleteApp(Request $request)
{
if (session('nickname', "未登录") === "未登录") return msg('请先登录', "请登录后继续。", "/user/login", '立即登录');
View::assign(["nickname" => session('nickname', "未登录")]);
View::assign([
"header" => view('common/header')->rawBody(),
"footer" => view('common/footer')->rawBody()
]);
$user = User::where('id', session('user_id'))->first();
if (!$user) {
session(['nickname' => null, 'user_id' => null]);
return msg('用户不存在', "请重新登录后继续。", "/user/login", "登录");
}
$sms_app = SmsApp::where('id', $request->get('id', ''))->where('user_id', $user->id)->first();
if (!$sms_app) {
return msg('应用不存在', "删除失败", "/sms/app", "返回");
}
$sms_app->delete();
return msg('删除成功', "删除成功", "/sms/app", "返回");
}
public function delete(Request $request)
{
if (session('nickname', "未登录") === "未登录") return msg('请先登录', "请登录后继续。", "/user/login", '立即登录');
View::assign(["nickname" => session('nickname', "未登录")]);
View::assign([
"header" => view('common/header')->rawBody(),
"footer" => view('common/footer')->rawBody()
]);
$user = User::where('id', session('user_id'))->first();
if (!$user) {
session(['nickname' => null, 'user_id' => null]);
return msg('用户不存在', "请重新登录后继续。", "/user/login", "登录");
}
$sms_content = SmsContent::where('id', $request->get('id', ''))->where('user_id', $user->id)->first();
if (!$sms_content) {
return msg('短信不存在', "删除失败", "/sms/index", "返回");
}
$sms_content->delete();
return msg('删除成功', "删除成功", "/sms", "返回");
}
}