"临时文件错误", "ERROR_TMP_FILE_NOT_FOUND" => "找不到临时文件", "ERROR_SIZE_EXCEED" => "文件大小超出网站限制", "ERROR_TYPE_NOT_ALLOWED" => "文件类型不允许", "ERROR_CREATE_DIR" => "目录创建失败", "ERROR_DIR_NOT_WRITEABLE" => "目录没有写权限", "ERROR_FILE_MOVE" => "文件保存时出错", "ERROR_FILE_NOT_FOUND" => "找不到上传文件", "ERROR_WRITE_CONTENT" => "写入文件内容错误", "ERROR_UNKNOWN" => "未知错误", "ERROR_DEAD_LINK" => "链接不可用", "ERROR_HTTP_LINK" => "链接不是http链接", "ERROR_HTTP_CONTENTTYPE" => "链接contentType不正确", "INVALID_URL" => "非法 URL", "INVALID_IP" => "非法 IP" ); /** * 构造函数 * @param string $fileField 表单名称 * @param array $config 配置项 * @param bool $base64 是否解析base64编码,可省略。若开启,则$fileField代表的是base64编码的字符串表单名 */ public function init($fileField, $config, $type = "upload", $request = null) { $this->fileField = $fileField; $this->config = $config; $this->type = $type; if ($type == "remote") { $this->saveRemote($request); } else if($type == "base64") { $this->upBase64($request); } else { $this->upFile($request); } } public function handler(Request $request){ $action = htmlspecialchars($request->action); $callback = $request->callback; if(_empty_($action)){ return array( 'state'=> 'callback参数不合法' ); } $CONFIG = json_decode(preg_replace("/\/\*[\s\S]+?\*\//", "", file_get_contents(app_path('Lib/Ueditor/config.json'))), true); switch ($action) { case 'config': $result = $CONFIG; break; /* 上传图片 */ case 'uploadimage': /* 上传涂鸦 */ case 'uploadscrawl': /* 上传视频 */ case 'uploadvideo': /* 上传文件 */ case 'uploadfile': $result = $this->action_upload($action, $CONFIG, $request); break; /* 列出图片 */ case 'listimage': $result = $this->action_list($action, $CONFIG, $request); break; /* 列出文件 */ case 'listfile': $result = $this->action_list($action, $CONFIG, $request); break; /* 抓取远程文件 */ case 'catchimage': $result = $this->action_crawler($action, $CONFIG, $request); break; default: $result = array( 'state'=> '请求地址出错' ); break; } /* 输出结果 */ if ($callback) { if (preg_match("/^[\w_]+$/", $callback)) { return response( htmlspecialchars($callback) . '(' . json_encode($result). ')', 200)->withHeaders(['Content-Type' => 'text/html; charset=utf-8']); } else { return response(json_encode(array( 'state'=> 'callback参数不合法' )), 200)->withHeaders(['Content-Type' => 'text/html; charset=utf-8']); } } else { return response(json_encode($result), 200)->withHeaders(['Content-Type' => 'text/html; charset=utf-8']); } } private function action_list($action, $CONFIG, $request) { /* 判断类型 */ switch ($action) { /* 列出文件 */ case 'listfile': $allowFiles = $CONFIG['fileManagerAllowFiles']; $listSize = $CONFIG['fileManagerListSize']; $path = $CONFIG['fileManagerListPath']; break; /* 列出图片 */ case 'listimage': default: $allowFiles = $CONFIG['imageManagerAllowFiles']; $listSize = $CONFIG['imageManagerListSize']; $path = $CONFIG['imageManagerListPath']; } $allowFiles = substr(str_replace(".", "|", join("", $allowFiles)), 1); /* 获取参数 */ $size = isset($_GET['size']) ? htmlspecialchars($_GET['size']) : $listSize; $start = isset($_GET['start']) ? htmlspecialchars($_GET['start']) : 0; $end = $start + $size; /* 获取文件列表 */ $path = $_SERVER['DOCUMENT_ROOT'] . (substr($path, 0, 1) == "/" ? "" : "/") . $path; $files = $this->getfiles($path, $allowFiles); if (!count($files)) { return array( "state" => "no match file", "list" => array(), "start" => $start, "total" => count($files) ); } /* 获取指定范围的列表 */ $len = count($files); for ($i = min($end, $len) - 1, $list = array(); $i < $len && $i >= 0 && $i >= $start; $i--) { $list[] = $files[$i]; } //倒序 //for ($i = $end, $list = array(); $i < $len && $i < $end; $i++){ // $list[] = $files[$i]; //} return array( "state" => "SUCCESS", "list" => $list, "start" => $start, "total" => count($files) ); } /** * 遍历获取目录下的指定类型的文件 * @param $path * @param array $files * @return array */ private function getfiles($path, $allowFiles, &$files = array()) { if (!is_dir($path)) return null; if(substr($path, strlen($path) - 1) != '/') $path .= '/'; $handle = opendir($path); while (false !== ($file = readdir($handle))) { if ($file != '.' && $file != '..') { $path2 = $path . $file; if (is_dir($path2)) { getfiles($path2, $allowFiles, $files); } else { if (preg_match("/\.(".$allowFiles.")$/i", $file)) { $files[] = array( 'url'=> substr($path2, strlen($_SERVER['DOCUMENT_ROOT'])), 'mtime'=> filemtime($path2) ); } } } } return $files; } private function action_crawler($action, $CONFIG, $request){ /* 上传配置 */ $config = array( "pathFormat" => $CONFIG['catcherPathFormat'], "maxSize" => $CONFIG['catcherMaxSize'], "allowFiles" => $CONFIG['catcherAllowFiles'], "oriName" => "remote.png" ); $fieldName = $CONFIG['catcherFieldName']; /* 抓取远程图片 */ $list = array(); $source = $request->images; foreach ($source as $imgUrl) { $this->init($imgUrl, $config, "remote", $request); $info = $this->getFileInfo(); array_push($list, array( "state" => $info["state"], "url" => $info["url"], "size" => $info["size"], "title" => htmlspecialchars($info["title"]), "original" => htmlspecialchars($info["original"]), "source" => htmlspecialchars($imgUrl) )); } /* 返回抓取数据 */ return array( 'state'=> count($list) ? 'SUCCESS':'ERROR', 'responseText' => '', 'list'=> $list ); } private function action_upload($action, $CONFIG, $request){ /* 上传配置 */ $base64 = "upload"; switch ($action) { case 'uploadimage': $config = array( "pathFormat" => $CONFIG['imagePathFormat'], "maxSize" => $CONFIG['imageMaxSize'], "allowFiles" => $CONFIG['imageAllowFiles'] ); $fieldName = $CONFIG['imageFieldName']; break; case 'uploadscrawl': $config = array( "pathFormat" => $CONFIG['scrawlPathFormat'], "maxSize" => $CONFIG['scrawlMaxSize'], "allowFiles" => $CONFIG['scrawlAllowFiles'], "oriName" => "scrawl.png" ); $fieldName = $CONFIG['scrawlFieldName']; $base64 = "base64"; break; case 'uploadvideo': $config = array( "pathFormat" => $CONFIG['videoPathFormat'], "maxSize" => $CONFIG['videoMaxSize'], "allowFiles" => $CONFIG['videoAllowFiles'] ); $fieldName = $CONFIG['videoFieldName']; break; case 'uploadfile': default: $config = array( "pathFormat" => $CONFIG['filePathFormat'], "maxSize" => $CONFIG['fileMaxSize'], "allowFiles" => $CONFIG['fileAllowFiles'] ); $fieldName = $CONFIG['fileFieldName']; break; } /* 生成上传实例对象并完成上传 */ $this->init($fieldName, $config, $base64, $request); return $this->getFileInfo(); } /** * 上传文件的主处理方法 * @return mixed */ private function upFile($request) { $file = $this->file(); if(_empty_($file)){ $file = $request->file('file'); } if (!$file) { $this->stateInfo = $this->getStateInfo("ERROR_FILE_NOT_FOUND"); return; } $path = UploadHandler::handle($file); if($path){ $this->oriName = ''; $this->fileSize = 100; $this->fileType = ''; $this->fullName = $path['url']; $this->filePath = $path['path']; $this->fileName = $path['name']; $this->stateInfo = $this->stateMap[0]; }else{ $this->stateInfo = $this->getStateInfo("ERROR_HTTP_CONTENTTYPE"); } } /** * 处理base64编码的图片上传 * @return mixed */ private function upBase64() { $base64Data = $_POST[$this->fileField]; $img = base64_decode($base64Data); $this->oriName = $this->config['oriName']; $this->fileSize = strlen($img); $this->fileType = $this->getFileExt(); $this->fullName = $this->getFullName(); $this->filePath = $this->getFilePath(); $this->fileName = $this->getFileName(); $dirname = dirname($this->filePath); //检查文件大小是否超出限制 if (!$this->checkSize()) { $this->stateInfo = $this->getStateInfo("ERROR_SIZE_EXCEED"); return; } //创建目录失败 if (!file_exists($dirname) && !mkdir($dirname, 0777, true)) { $this->stateInfo = $this->getStateInfo("ERROR_CREATE_DIR"); return; } else if (!is_writeable($dirname)) { $this->stateInfo = $this->getStateInfo("ERROR_DIR_NOT_WRITEABLE"); return; } //移动文件 if (!(file_put_contents($this->filePath, $img) && file_exists($this->filePath))) { //移动失败 $this->stateInfo = $this->getStateInfo("ERROR_WRITE_CONTENT"); } else { //移动成功 $this->stateInfo = $this->stateMap[0]; } } /** * 拉取远程图片 * @return mixed */ private function saveRemote($request) { $imgUrl = htmlspecialchars($this->fileField); $imgUrl = str_replace("&", "&", $imgUrl); //http开头验证 if (strpos($imgUrl, "http") !== 0) { $this->stateInfo = $this->getStateInfo("ERROR_HTTP_LINK"); return; } preg_match('/(^https*:\/\/[^:\/]+)/', $imgUrl, $matches); $host_with_protocol = count($matches) > 1 ? $matches[1] : ''; // 判断是否是合法 url if (!filter_var($host_with_protocol, FILTER_VALIDATE_URL)) { $this->stateInfo = $this->getStateInfo("INVALID_URL"); return; } preg_match('/^https*:\/\/(.+)/', $host_with_protocol, $matches); $host_without_protocol = count($matches) > 1 ? $matches[1] : ''; // 此时提取出来的可能是 ip 也有可能是域名,先获取 ip $ip = gethostbyname($host_without_protocol); // 判断是否是私有 ip if(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE)) { $this->stateInfo = $this->getStateInfo("INVALID_IP"); return; } //获取请求头并检测死链 $heads = get_headers($imgUrl, 1); if (!(stristr($heads[0], "200") && stristr($heads[0], "OK"))) { $this->stateInfo = $this->getStateInfo("ERROR_DEAD_LINK"); return; } //格式验证(扩展名验证和Content-Type验证) $fileType = strtolower(strrchr($imgUrl, '.')); if (!in_array($fileType, $this->config['allowFiles']) || !isset($heads['Content-Type']) || !stristr($heads['Content-Type'], "image")) { $this->stateInfo = $this->getStateInfo("ERROR_HTTP_CONTENTTYPE"); return; } $path = ImageUtils::upload_url_img($imgUrl, '', [], [], true, 1, 1, 3); if($path){ $this->oriName = $imgUrl; $this->fileSize = 100; $this->fileType = ''; $this->fullName = $path['url']; $this->filePath = $path['path']; $this->fileName = $path['name']; $this->stateInfo = $this->stateMap[0]; }else{ $this->stateInfo = $this->getStateInfo("ERROR_HTTP_CONTENTTYPE"); } } /** * 上传错误检查 * @param $errCode * @return string */ private function getStateInfo($errCode) { return !$this->stateMap[$errCode] ? $this->stateMap["ERROR_UNKNOWN"] : $this->stateMap[$errCode]; } /** * 获取文件扩展名 * @return string */ private function getFileExt() { return strtolower(strrchr($this->oriName, '.')); } /** * 重命名文件 * @return string */ private function getFullName() { //替换日期事件 $t = time(); $d = explode('-', date("Y-y-m-d-H-i-s")); $format = $this->config["pathFormat"]; $format = str_replace("{yyyy}", $d[0], $format); $format = str_replace("{yy}", $d[1], $format); $format = str_replace("{mm}", $d[2], $format); $format = str_replace("{dd}", $d[3], $format); $format = str_replace("{hh}", $d[4], $format); $format = str_replace("{ii}", $d[5], $format); $format = str_replace("{ss}", $d[6], $format); $format = str_replace("{time}", $t, $format); //过滤文件名的非法自负,并替换文件名 $oriName = substr($this->oriName, 0, strrpos($this->oriName, '.')); $oriName = preg_replace("/[\|\?\"\<\>\/\*\\\\]+/", '', $oriName); $format = str_replace("{filename}", $oriName, $format); //替换随机字符串 $randNum = rand(1, 10000000000) . rand(1, 10000000000); if (preg_match("/\{rand\:([\d]*)\}/i", $format, $matches)) { $format = preg_replace("/\{rand\:[\d]*\}/i", substr($randNum, 0, $matches[1]), $format); } $ext = $this->getFileExt(); return $format . $ext; } /** * 获取文件名 * @return string */ private function getFileName () { return substr($this->filePath, strrpos($this->filePath, '/') + 1); } /** * 获取文件完整路径 * @return string */ private function getFilePath() { $fullname = $this->fullName; $rootPath = $_SERVER['DOCUMENT_ROOT']; if (substr($fullname, 0, 1) != '/') { $fullname = '/' . $fullname; } return $rootPath . $fullname; } /** * 文件类型检测 * @return bool */ private function checkType() { return in_array($this->getFileExt(), $this->config["allowFiles"]); } /** * 文件大小检测 * @return bool */ private function checkSize() { return $this->fileSize <= ($this->config["maxSize"]); } /** * 获取当前上传成功文件的各项信息 * @return array */ public function getFileInfo() { return array( "state" => $this->stateInfo, "url" => $this->fullName, "title" => $this->fileName, "original" => $this->oriName, "type" => $this->fileType, "size" => $this->fileSize ); } }