Victor_Jay
2449a27eb5
Some checks failed
CI / Lint + Build (push) Has been cancelled
审计修复: - CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用 - HSTS: 始终启用(不再依赖release模式) - Controller Exp: common.GetGinExp包装, 不再直接读context - UID解析: common.ParseUIDParam统一, follow/admin controller改用 重构: - router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio - 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单 - 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件 新增: - DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面 - 时区配置: config.yaml server.timezone→time.Local初始化 - .gitea/workflows/ci.yml: strict模式CI流水线
119 lines
3.1 KiB
Go
119 lines
3.1 KiB
Go
package controller
|
||
|
||
import (
|
||
"bytes"
|
||
"image"
|
||
"image/jpeg"
|
||
"image/png"
|
||
"io"
|
||
"net/http"
|
||
"os"
|
||
"path/filepath"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"metazone.cc/mce/internal/common"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
// UploadImage 上传评论图片 POST /api/comments/upload-image
|
||
// 需要 LV4+（Exp ≥ 1500），复用帖子图片上传的 WebP 转码逻辑
|
||
func (ctrl *CommentController) UploadImage(c *gin.Context) {
|
||
uid, _, ok := common.GetGinUser(c)
|
||
if !ok {
|
||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||
return
|
||
}
|
||
|
||
// LV4+ 检查（Exp ≥ 1500）
|
||
exp, ok := common.GetGinExp(c)
|
||
if !ok {
|
||
common.Error(c, http.StatusForbidden, "无法获取经验值")
|
||
return
|
||
}
|
||
if exp < 1500 {
|
||
common.Error(c, http.StatusForbidden, "需 Lv4 以上才能上传评论图片")
|
||
return
|
||
}
|
||
|
||
file, header, err := c.Request.FormFile("file")
|
||
if err != nil {
|
||
common.Error(c, http.StatusBadRequest, "请选择文件")
|
||
return
|
||
}
|
||
defer func() { _ = file.Close() }()
|
||
|
||
// 检查扩展名
|
||
ext := strings.ToLower(filepath.Ext(header.Filename))
|
||
allowedExt := map[string]bool{".jpg": true, ".jpeg": true, ".png": true, ".gif": true, ".webp": true}
|
||
if !allowedExt[ext] {
|
||
common.Error(c, http.StatusBadRequest, "仅支持 jpg/jpeg/png/gif/webp 格式")
|
||
return
|
||
}
|
||
|
||
// 限制 5MB
|
||
if header.Size > 5<<20 {
|
||
common.Error(c, http.StatusBadRequest, "图片大小不能超过 5MB")
|
||
return
|
||
}
|
||
|
||
data, err := io.ReadAll(file)
|
||
if err != nil {
|
||
common.Error(c, http.StatusInternalServerError, "读取文件失败")
|
||
return
|
||
}
|
||
|
||
storageDir := "storage/uploads/posts"
|
||
if err := os.MkdirAll(storageDir, 0o755); err != nil { //nolint:gosec // 上传目录标准权限
|
||
common.Error(c, http.StatusInternalServerError, "存储初始化失败")
|
||
return
|
||
}
|
||
|
||
ts := time.Now().UnixMilli()
|
||
isJPEGPNG := ext == ".jpg" || ext == ".jpeg" || ext == ".png"
|
||
|
||
var savePath, url string
|
||
|
||
// JPEG/PNG 转 WebP
|
||
if isJPEGPNG {
|
||
img, _, err := image.Decode(bytes.NewReader(data))
|
||
if err != nil {
|
||
common.Error(c, http.StatusBadRequest, "图片格式无效")
|
||
return
|
||
}
|
||
webpData := encodeWebPBinary(img, len(data))
|
||
if webpData != nil && len(webpData) < len(data) {
|
||
filename := strconv.FormatUint(uint64(uid), 10) + "_" + strconv.FormatInt(ts, 10) + ".webp"
|
||
savePath = filepath.Join(storageDir, filename)
|
||
_ = os.WriteFile(savePath, webpData, 0o644) //nolint:gosec // 上传文件标准权限
|
||
url = "/uploads/posts/" + filename
|
||
}
|
||
}
|
||
|
||
// 回退存储
|
||
if savePath == "" {
|
||
dataOut := data
|
||
if isJPEGPNG {
|
||
decImg, _, decErr := image.Decode(bytes.NewReader(data))
|
||
if decErr == nil {
|
||
var buf bytes.Buffer
|
||
if ext == ".png" {
|
||
_ = png.Encode(&buf, decImg)
|
||
} else {
|
||
_ = jpeg.Encode(&buf, decImg, &jpeg.Options{Quality: 92})
|
||
}
|
||
dataOut = buf.Bytes()
|
||
}
|
||
}
|
||
filename := strconv.FormatUint(uint64(uid), 10) + "_" + strconv.FormatInt(ts, 10) + ext
|
||
savePath = filepath.Join(storageDir, filename)
|
||
_ = os.WriteFile(savePath, dataOut, 0o644) //nolint:gosec // 上传文件标准权限
|
||
url = "/uploads/posts/" + filename
|
||
}
|
||
|
||
// 返回标准 JSON（前端将 URL 插入评论文本）
|
||
common.Ok(c, gin.H{"url": url})
|
||
}
|