106 lines
3.7 KiB
PHP
106 lines
3.7 KiB
PHP
|
<?php
|
|||
|
|
/**
|
|||
|
|
* 头像上传：裁成正方形、缩到 512×512、转成 JPEG 落盘。
|
|||
|
|
*
|
|||
|
|
* 安全要点：
|
|||
|
|
* - 用 finfo 判断真实 MIME，不信浏览器给的扩展名
|
|||
|
|
* - 文件名随机，绝不使用用户提供的名字（防路径穿越与扩展名绕过）
|
|||
|
|
* - 只写进 uploads/avatars/，该目录有 .htaccess 禁止执行脚本
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
declare(strict_types=1);
|
|||
|
|
|
|||
|
|
namespace App;
|
|||
|
|
|
|||
|
|
final class Upload
|
|||
|
|
{
|
|||
|
|
private const MAX_BYTES = 5 * 1024 * 1024;
|
|||
|
|
private const SIZE = 512;
|
|||
|
|
|
|||
|
|
/** @return array{ok:bool,file?:string,error?:string} */
|
|||
|
|
public static function avatar(array $file): array
|
|||
|
|
{
|
|||
|
|
if (!isset($file['error']) || is_array($file['error'])) {
|
|||
|
|
return ['ok' => false, 'error' => '上传参数不对'];
|
|||
|
|
}
|
|||
|
|
switch ($file['error']) {
|
|||
|
|
case UPLOAD_ERR_OK:
|
|||
|
|
break;
|
|||
|
|
case UPLOAD_ERR_NO_FILE:
|
|||
|
|
return ['ok' => false, 'error' => ''];
|
|||
|
|
case UPLOAD_ERR_INI_SIZE:
|
|||
|
|
case UPLOAD_ERR_FORM_SIZE:
|
|||
|
|
return ['ok' => false, 'error' => '图片太大了（上限 5MB）'];
|
|||
|
|
default:
|
|||
|
|
return ['ok' => false, 'error' => '上传失败（错误码 ' . (int)$file['error'] . '）'];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ($file['size'] > self::MAX_BYTES) {
|
|||
|
|
return ['ok' => false, 'error' => '图片太大了（上限 5MB）'];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
$finfo = new \finfo(FILEINFO_MIME_TYPE);
|
|||
|
|
$mime = $finfo->file($file['tmp_name']);
|
|||
|
|
$allow = ['image/jpeg' => 'imagecreatefromjpeg', 'image/png' => 'imagecreatefrompng',
|
|||
|
|
'image/gif' => 'imagecreatefromgif', 'image/webp' => 'imagecreatefromwebp'];
|
|||
|
|
if (!isset($allow[$mime])) {
|
|||
|
|
return ['ok' => false, 'error' => '只支持 JPG / PNG / GIF / WebP 图片'];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
$src = $allow[$mime]($file['tmp_name']);
|
|||
|
|
if (!$src) {
|
|||
|
|
return ['ok' => false, 'error' => '图片读不出来'];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
$w = imagesx($src);
|
|||
|
|
$h = imagesy($src);
|
|||
|
|
// 居中裁成正方形
|
|||
|
|
$side = min($w, $h);
|
|||
|
|
$sx = (int)(($w - $side) / 2);
|
|||
|
|
$sy = (int)(($h - $side) / 2);
|
|||
|
|
|
|||
|
|
$canvas = imagecreatetruecolor(self::SIZE, self::SIZE);
|
|||
|
|
// PNG/GIF 的透明区转成纸白，不然头像会是黑底
|
|||
|
|
$bg = imagecolorallocate($canvas, 253, 251, 245);
|
|||
|
|
imagefilledrectangle($canvas, 0, 0, self::SIZE, self::SIZE, $bg);
|
|||
|
|
imagecopyresampled($canvas, $src, 0, 0, $sx, $sy, self::SIZE, self::SIZE, $side, $side);
|
|||
|
|
|
|||
|
|
$dir = FB_UPLOADS . '/avatars';
|
|||
|
|
if (!is_dir($dir)) {
|
|||
|
|
mkdir($dir, 0755, true);
|
|||
|
|
}
|
|||
|
|
$name = bin2hex(random_bytes(12)) . '.jpg';
|
|||
|
|
if (!imagejpeg($canvas, $dir . '/' . $name, 88)) {
|
|||
|
|
imagedestroy($canvas);
|
|||
|
|
imagedestroy($src);
|
|||
|
|
return ['ok' => false, 'error' => '保存失败'];
|
|||
|
|
}
|
|||
|
|
imagedestroy($canvas);
|
|||
|
|
imagedestroy($src);
|
|||
|
|
|
|||
|
|
return ['ok' => true, 'file' => 'avatars/' . $name];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/** 头像访问地址（无头像时回退到内置剪影，保证永远不出现破图） */
|
|||
|
|
public static function avatarUrl(?string $rel): string
|
|||
|
|
{
|
|||
|
|
if ($rel && is_file(FB_UPLOADS . '/' . $rel)) {
|
|||
|
|
$p = FB_UPLOADS . '/' . $rel;
|
|||
|
|
// 注意：filemtime() 返回 int，本文件开了 strict_types，直接喂给 md5() 会 TypeError
|
|||
|
|
return 'uploads/' . $rel . '?v=' . substr(md5(filemtime($p) . filesize($p)), 0, 8);
|
|||
|
|
}
|
|||
|
|
return asset('/assets/avatar-default.svg');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
public static function remove(?string $rel): void
|
|||
|
|
{
|
|||
|
|
if (!$rel) {
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
$p = FB_UPLOADS . '/' . $rel;
|
|||
|
|
if (is_file($p)) {
|
|||
|
|
@unlink($p);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|