Skip to content

Commit 256c7cd

Browse files
author
Colin Yang
committed
Both - Implemented setting allow_browser
1 parent c19824e commit 256c7cd

File tree

6 files changed

+73
-35
lines changed

6 files changed

+73
-35
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,12 +171,12 @@ STATUS_EXPORT_XLSX_UNSUPPORTED | 导出数据(仅限xlsx) | 61 | 200 | 服务器
171171
* 参数
172172
* `settingId` - 必需 - 设置Id，详见设置列表
173173
* `value` - 必需 - 值，详见设置列表
174-
* 返回值 - [ "status": 状态码, "result": 所有非默认设置，如`{ "all_category": "#student_#teacher_" }` ]
174+
* 返回值 - [ "status": 状态码, "result": 提示文本 ]
175175
* 可能返回的非全局状态码 - STATUS_SETTING_NOT_RECOGNISED
176176
* settings - 获取所有设置
177177
* 请求头
178178
* `X-TPV-Manage-Token` - 必须
179-
* 返回值 - [ "status": 状态码, "result": 所有非默认设置，如`{ "all_category": "#student_#teacher_" }` ]
179+
* 返回值 - [ "status": 状态码, "result": 所有变更过的设置，如`{ "all_category": "#student_#teacher_" }` ]
180180
* update - 更新标签的值，标签必须存在
181181
* 请求头
182182
* `X-TPV-Manage-Token` - 必须
@@ -191,3 +191,4 @@ STATUS_EXPORT_XLSX_UNSUPPORTED | 导出数据(仅限xlsx) | 61 | 200 | 服务器
191191
设置Id | 设置名 | 接受的值
192192
-|-|-
193193
all_category | 标签浏览页·分类列表 | 使用井号#分隔的文本
194+
allow_browser | 允许来自浏览器的读写 | 不是`"false"`默认为`"true"`

‎backend/class/api/Getvalue.class.php

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,21 @@
22

33
class ApiGetvalue extends Api {
44

5+
static function checkAllowBrowser() {
6+
if (json_decode(DbProvider::getDb()->get(DbBase::$KEY_MANAGE_SETTINGS), true)['allow_browser'] === 'false'
7+
&& (isset($_SERVER['HTTP_ORIGIN'])
8+
|| isset($_SERVER['HTTP_REFERER'])
9+
|| isset($_SERVER['HTTP_USER_AGENT'])
10+
|| isset($_SERVER['HTTP_COOKIE'])
11+
|| $_SERVER['HTTP_ACCEPT'] != 'application/json')) {
12+
http_response_code(403);
13+
echo json_encode([ 'RESUFED VIA SETTING (allow_browser = false)', '', '' ]);
14+
die();
15+
}
16+
}
17+
518
function handle() {
19+
self::checkAllowBrowser();
620
$key = (string) $_REQUEST['tag'];
721
if (DbBase::keyReserved($key)) {
822
http_response_code(403);

‎backend/class/api/Manage.class.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -341,12 +341,13 @@ function handle() {
341341
case 'setting_update': {
342342
$settingId = (string) $_REQUEST['settingId'];
343343
switch ($settingId) {
344-
case 'all_category': {
344+
case 'all_category':
345+
case 'allow_browser': {
345346
self::updateSetting($settingId, $value);
346347
return [ 'result' => 'Succeed' ];
347348
}
348349
default: {
349-
return [ 'status' => STATUS_API_FAILED, 'result' => 'The settingId can not be recognised.' ];
350+
return [ 'status' => STATUS_SETTING_NOT_RECOGNISED, 'result' => 'The settingId can not be recognised.' ];
350351
}
351352
}
352353
}

‎backend/class/api/Storeavalue.class.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
class ApiStoreavalue extends Api {
44

55
function handle() {
6+
ApiGetvalue::checkAllowBrowser();
67
$key = (string) $_REQUEST['tag'];
78
$value = (string) $_REQUEST['value'];
89
if (DbBase::keyReserved($key)) {

‎frontend/tinywebdb-php-vue/src/components/Index.vue

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ export default {
7575
setTimeout(() => (this.get_succeed = false), 800)
7676
} catch (e) {
7777
if (e.response && e.response.status === 403) {
78-
this.$root.showInfo('', '获取失败，该标签属于系统保留标签')
78+
this.$root.showInfo('', '获取失败，该标签属于系统保留标签 或 根据设定，浏览器的访问不被允许')
7979
} else {
8080
console.error(e)
8181
this.$root.showInfo('', '获取失败，错误信息见console')
@@ -91,7 +91,7 @@ export default {
9191
setTimeout(() => (this.store_succeed = false), 800)
9292
} catch (e) {
9393
if (e.response && e.response.status === 403) {
94-
this.$root.showInfo('', '保存失败，该标签属于系统保留标签')
94+
this.$root.showInfo('', '保存失败，该标签属于系统保留标签 或 根据设定，浏览器的访问不被允许')
9595
} else {
9696
console.error(e)
9797
this.$root.showInfo('', '保存失败，错误信息见console')

‎frontend/tinywebdb-php-vue/src/components/manage/Setting.vue

Lines changed: 50 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,17 @@
33
<template slot="header">设置</template>
44

55
<div v-if="loaded === true">
6-
<div style="font-weight:bold; margin-bottom:10px" disabled>标签浏览页·分类列表</div>
6+
<div class="setting-header">标签浏览页·分类列表</div>
77
<div>
88
<b-form-group>
9-
<b-input v-model="setting.all_category" />
9+
<b-input v-model="all_category.value" />
1010
<template slot="description">
1111
使用井号#分隔每一项（重复项会被隐藏）<br>
1212
例如：默认显示全部，可选显示“student_”或者“teacher_”开头的标签，则应当这么填：
13-
<b-link @click="setting.all_category = '#student_#teacher_'">#student_#teacher_（点击预览）</b-link>
13+
<b-link @click="all_category.value = '#student_#teacher_'">#student_#teacher_（点击预览）</b-link>
1414
<br>
1515
例如：默认显示“student_”，可选显示全部和开头为“teacher_”的标签，则应当这么填：
16-
<b-link @click="setting.all_category = 'student_##teacher_'">student_##teacher_（点击预览）</b-link>
16+
<b-link @click="all_category.value = 'student_##teacher_'">student_##teacher_（点击预览）</b-link>
1717
</template>
1818
</b-form-group>
1919
<b-form-group label="预览">
@@ -23,15 +23,29 @@
2323
:select-size="Math.min(5, all_category_preview.length)" />
2424
</b-form-group>
2525
<SpinnerButton
26-
:variant="typeof buttonVariant.all_category === 'string' ? buttonVariant.all_category : 'secondary'"
27-
@click="updateCategory">
28-
<span v-text="typeof buttonText.all_category === 'string' ? buttonText.all_category : '保存'"/>
26+
:variant="typeof all_category.variant === 'string' ? all_category.variant : 'secondary'"
27+
@click="onDone => save('all_category', onDone)">
28+
<span v-text="typeof all_category.text === 'string' ? all_category.text : '保存'"/>
2929
</SpinnerButton>
3030
</div>
3131

3232
<hr>
3333

34-
<div style="font-weight:bold; margin-bottom:10px" disabled>危险选项</div>
34+
<div class="setting-header">数据安全</div>
35+
<div>
36+
<b-form-group description="说明：本功能对于数据防修改能力较弱，仅做简单的浏览器级别防御，请不要过度依赖">
37+
<b-checkbox v-model="allow_browser.value">允许来自浏览器的读写</b-checkbox>
38+
</b-form-group>
39+
<SpinnerButton
40+
:variant="typeof allow_browser.variant === 'string' ? allow_browser.variant : 'secondary'"
41+
@click="onDone => save('allow_browser', onDone)">
42+
<span v-text="typeof allow_browser.text === 'string' ? allow_browser.text : '保存'"/>
43+
</SpinnerButton>
44+
</div>
45+
46+
<hr>
47+
48+
<div class="setting-header">危险选项</div>
3549
<div>
3650
<b-form-group>
3751
<SpinnerButton @click="eraseData" variant="danger">清除数据库</SpinnerButton>
@@ -66,20 +80,21 @@ export default {
6680
data () {
6781
return {
6882
loaded: false,
69-
setting: {
70-
all_category: ''
71-
},
72-
buttonVariant: {
73-
all_category: undefined
83+
all_category: {
84+
value: '',
85+
variant: undefined,
86+
text: undefined
7487
},
75-
buttonText: {
76-
all_category: undefined
88+
allow_browser: {
89+
value: true,
90+
variant: undefined,
91+
text: undefined
7792
}
7893
}
7994
},
8095
computed: {
8196
all_category_preview () {
82-
return Array.from(new Set(this.setting.all_category.split('#')))
97+
return Array.from(new Set(this.all_category.value.split('#')))
8398
.map(item => ({value: item, text: item.length === 0 ? '显示所有' : `前缀\`${item}\``}))
8499
}
85100
},
@@ -92,7 +107,8 @@ export default {
92107
let { status, result } = (await this.$parent.service.get('settings')).data
93108
switch (status) {
94109
case 0: {
95-
if (result.hasOwnProperty('all_category')) this.setting.all_category = result.all_category
110+
this.all_category.value = result.all_category || ''
111+
this.allow_browser.value = result.allow_browser !== 'false'
96112
this.loaded = true
97113
break
98114
}
@@ -101,27 +117,29 @@ export default {
101117
}
102118
}
103119
},
104-
async save (settingId, value) {
120+
async save (settingId, onDone = () => {}) {
121+
let value = (this[settingId] || {}).value
122+
if (value === undefined || value === null) {
123+
this.$root.showInfo('', '设置内容为undefined或null，请刷新页面后重试。如反复出现请联系作者排查问题')
124+
return
125+
}
105126
let { status } = (await this.$parent.service.post('setting_update', { settingId, value })).data
106127
switch (status) {
107128
case 0: {
108-
return true
129+
this[settingId].text = '保存成功'
130+
this[settingId].variant = 'success'
131+
onDone()
132+
await this.$root.sleep(1000)
133+
this[settingId].text = undefined
134+
this[settingId].variant = undefined
135+
break
109136
}
110137
default: {
111138
throw new Error(`保存设置'${settingId}'失败，错误码${status}`)
112139
}
113140
}
114141
},
115142
116-
async updateCategory (onDone) {
117-
let result = await this.save('all_category', this.setting.all_category)
118-
onDone()
119-
this.buttonText.all_category = result ? '保存成功' : '保存失败'
120-
this.buttonVariant.all_category = result ? 'success' : 'danger'
121-
await this.$root.sleep(1000)
122-
this.buttonText.all_category = undefined
123-
this.buttonVariant.all_category = undefined
124-
},
125143
eraseData (onDone) {
126144
this.$root.showConfirm('', '确认要清空数据库吗？该操作无法逆转！请提前做好数据备份', async () => {
127145
let { status } = (await this.$parent.service.post('erase_data')).data
@@ -176,5 +194,8 @@ export default {
176194
</script>
177195

178196
<style>
179-
197+
.setting-header {
198+
font-weight: bold;
199+
margin-bottom: 10px;
200+
}
180201
</style>

0 commit comments

Comments
 (0)