You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
76 lines
2.4 KiB
76 lines
2.4 KiB
<?php
|
|
namespace app\controller;
|
|
|
|
use app\BaseController;
|
|
use app\model\Message as MessageModel;
|
|
|
|
class Message extends BaseController
|
|
{
|
|
// BUG-03: 聊天记录读取保持原有逻辑
|
|
public function list()
|
|
{
|
|
$cardNo = $this->request->get('card_no', '');
|
|
$since = $this->request->get('since', 0);
|
|
|
|
if (empty($cardNo)) {
|
|
return json(['code' => -1, 'data' => null, 'msg' => '缺少号码牌']);
|
|
}
|
|
|
|
$query = MessageModel::where('card_no', $cardNo)
|
|
->order('created_at', 'asc');
|
|
|
|
if ($since > 0) {
|
|
$query->where('id', '>', intval($since));
|
|
}
|
|
|
|
$messages = $query->select()->toArray();
|
|
$list = array_map(function ($m) {
|
|
return [
|
|
'id' => $m['id'],
|
|
'cardNo' => $m['card_no'],
|
|
'senderType' => $m['sender_type'],
|
|
'content' => $m['content'],
|
|
'time' => date('H:i', strtotime($m['created_at'])),
|
|
'staffId' => $m['staff_id'] ?? null,
|
|
];
|
|
}, $messages);
|
|
|
|
return json(['code' => 0, 'data' => $list, 'msg' => 'ok']);
|
|
}
|
|
|
|
// BUG-03: 增加输入校验 + XSS防护
|
|
public function send()
|
|
{
|
|
$cardNo = $this->request->post('cardNo', '');
|
|
$senderType = $this->request->post('senderType', 'customer');
|
|
$content = $this->request->post('content', '');
|
|
$staffId = $this->request->post('staffId', null);
|
|
|
|
// 必填校验
|
|
if (empty($cardNo) || empty($content)) {
|
|
return json(['code' => -1, 'data' => null, 'msg' => '参数不完整']);
|
|
}
|
|
|
|
// senderType 枚举校验
|
|
if (!in_array($senderType, ['customer', 'staff', 'system'])) {
|
|
return json(['code' => -1, 'data' => null, 'msg' => '发送者类型无效']);
|
|
}
|
|
|
|
// 内容长度校验 (DB VARCHAR 500)
|
|
if (mb_strlen($content) > 500) {
|
|
return json(['code' => -1, 'data' => null, 'msg' => '消息过长，最多500字']);
|
|
}
|
|
|
|
// XSS 防护 — HTML 转义
|
|
$content = htmlspecialchars($content, ENT_QUOTES, 'UTF-8');
|
|
|
|
$msg = MessageModel::create([
|
|
'card_no' => $cardNo,
|
|
'sender_type' => $senderType,
|
|
'staff_id' => $staffId,
|
|
'content' => $content,
|
|
]);
|
|
|
|
return json(['code' => 0, 'data' => ['id' => $msg->id], 'msg' => 'ok']);
|
|
}
|
|
}
|