laoyang/FamilyBook
1
0
Fork 0
Code Issues 29 Pull Requests Actions Packages Projects Releases Wiki Activity

阶段 0 完整版：名册 + 账号 + 安装向导 + 设置（宣纸主题）

Browse Source 
这一版把「家」的地基铺完：

功能
- 安装向导 install.php：建四张表 → 建家庭 → 建第一人（兼管理员），装完自删；
  「是否已装」以数据库四张表为准，不以文件是否存在为准
- 家庭名册：成员增删改查、头像上传（居中裁方 512×512 转 JPEG、finfo 校验、
  随机文件名）、生日自动算年龄与倒数天数
- 敏感信息加密存储：手机号双写（SHA-256 哈希用于登录 + AES-256-CBC 密文用于显示）、
  身份证只存密文；页面上永远只显示脱敏后的 138****8000 / 前 6 后 4
- 账号体系：人与账号分离（孩子可入名册但无需密码）、开通/停用/角色、
  防爆破（5 次失败锁 60 秒）、修改密码、最后一个管理员不可移除
- 设置页：家庭名称与座右铭、加密密钥状态
- 宣纸主题 UI：砖红取自图标，扁平、留白充足；移动端顶栏收紧不换行

安全
- 所有 POST 走 CSRF；输出全量 e() 转义；uploads/ 禁执行脚本
- app/ 与 templates/ 加 .htaccess 整体拒绝直连（直接请求模板会 Fatal 并
  把服务器绝对路径打在页面上 —— 这是线上真实抓到过的问题）
- 已安装的 install.php 返回 404；display_errors 线上关闭

工程
- 无框架无 Composer，query-string 路由（index.php?r=模块/动作），不依赖 rewrite
- 静态资源带 mtime+size 版本号，改版后浏览器不会吃旧缓存
- 配套部署与冒烟（_tooling/，不入库）：部署脚本容忍 tar 对非属主目录的
  元数据回填失败；冒烟断言「状态码 + 正文无 PHP 错误 + </html> 收尾 +
  无绝对路径泄露 + 断言总数下限」—— 只看状态码会把「200 但正文中间
  Fatal」当成通过，这一版在线上真实抓到过一次
This commit is contained in:
laoyang
2026-09-30 00:49:53 +08:00
parent ecafa110f2
commit 8eb19267bc
30 changed files with 2462 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/people/form.php
+113
View File
@@ -0,0 +1,113 @@
<?php
$isEdit = !empty($person['id']);
$avatarUrl = \App\Upload::avatarUrl($person['avatar'] ?? null);
?>
<div class="page-head">
<h1><?= $isEdit ? '编辑成员' : '添加成员' ?></h1>
<span class="sub"><?= $isEdit ? e($person['name']) : '填姓名就行，其他都可以以后再补' ?></span>
</div>
<form method="post" enctype="multipart/form-data"
action="<?= e(url($isEdit ? 'people/update' : 'people/create')) ?>">
<?= csrf_field() ?>
<?php if ($isEdit): ?>
<input type="hidden" name="id" value="<?= (int)$person['id'] ?>">
<?php endif; ?>
<div class="card card-pad">
<div class="form-grid">
<div class="field">
<label for="name">姓名 *</label>
<input class="input" id="name" name="name" value="<?= e(old('name', $person['name'] ?? '')) ?>" required>
<?php if (!empty($errors['name'])): ?><span class="err"><?= e($errors['name']) ?></span><?php endif; ?>
</div>
<div class="field">
<label for="nickname">小名</label>
<input class="input" id="nickname" name="nickname"
value="<?= e(old('nickname', $person['nickname'] ?? '')) ?>" placeholder="家里怎么叫他/她">
</div>
<div class="field">
<label for="gender">性别</label>
<select class="select" id="gender" name="gender">
<?php $g = old('gender', $person['gender'] ?? ''); ?>
<option value="" <?= $g === '' ? 'selected' : '' ?>>不填</option>
<option value="m" <?= $g === 'm' ? 'selected' : '' ?>>男</option>
<option value="f" <?= $g === 'f' ? 'selected' : '' ?>>女</option>
</select>
</div>
<div class="field">
<label for="birthday">生日</label>
<input class="input" id="birthday" name="birthday" type="date"
value="<?= e(old('birthday', $person['birthday'] ?? '')) ?>">
<span class="tip">填了之后，首页会提醒还有几天过生日。</span>
<?php if (!empty($errors['birthday'])): ?><span class="err"><?= e($errors['birthday']) ?></span><?php endif; ?>
</div>
<div class="field">
<label for="phone">手机号</label>
<input class="input" id="phone" name="phone" inputmode="numeric"
value="<?= e(old('phone', $phoneValue ?? '')) ?>" placeholder="可留空">
<span class="tip">开通登录后用它登录；加密存储，列表里只显示部分。</span>
<?php if (!empty($errors['phone'])): ?><span class="err"><?= e($errors['phone']) ?></span><?php endif; ?>
</div>
<div class="field">
<label for="email">邮箱</label>
<input class="input" id="email" name="email" type="email"
value="<?= e(old('email', $person['email'] ?? '')) ?>">
<?php if (!empty($errors['email'])): ?><span class="err"><?= e($errors['email']) ?></span><?php endif; ?>
</div>
<div class="field full">
<label for="id_card">身份证号</label>
<input class="input mono" id="id_card" name="id_card"
value="<?= e(old('id_card', $idCardValue ?? '')) ?>" placeholder="可留空">
<span class="tip">
加密存储，页面上一律只显示前 6 后 4 位。
家庭场景里真正需要它的场合很少 —— 能不填就别填。
</span>
<?php if (!empty($errors['id_card'])): ?><span class="err"><?= e($errors['id_card']) ?></span><?php endif; ?>
</div>
<div class="field full">
<label for="address">住址</label>
<input class="input" id="address" name="address"
value="<?= e(old('address', $person['address'] ?? '')) ?>">
</div>
<div class="field full">
<label for="note">备注</label>
<textarea class="input" id="note" name="note" placeholder="爱吃辣、对芒果过敏、怕坐过山车……"><?= e(old('note', $person['note'] ?? '')) ?></textarea>
</div>
<div class="field">
<label for="avatar">头像</label>
<input class="input" id="avatar" name="avatar" type="file" accept="image/*">
<span class="tip">会自动裁成正方形，上限 5MB。</span>
</div>
<div class="field">
<label>当前头像</label>
<img id="avatar-preview" src="<?= e($avatarUrl) ?>" alt=""
style="width:88px;height:88px;border-radius:12px;object-fit:cover;border:1px solid var(--line)">
</div>
<div class="field">
<label for="sort_order">排序号</label>
<input class="input" id="sort_order" name="sort_order" type="number"
value="<?= e(old('sort_order', $person['sort_order'] ?? 1000)) ?>">
<span class="tip">小的排前面。</span>
</div>
</div>
<div class="btn-row">
<button class="btn" type="submit"><?= $isEdit ? '保存' : '加入名册' ?></button>
<a class="btn btn-ghost" href="<?= e($isEdit ? url('people/show', ['id' => (int)$person['id']]) : url('people')) ?>">取消</a>
</div>
</div>
</form>
templates/people/index.php
+46
View File
@@ -0,0 +1,46 @@
<div class="page-head">
<h1>家庭名册</h1>
<span class="sub">共 <?= count($people) ?> 人</span>
<div class="actions">
<?php if (\App\Auth::isAdmin()): ?>
<a class="btn btn-sm" href="<?= e(url('people/new')) ?>">添加成员</a>
<?php endif; ?>
</div>
</div>
<form class="search" method="get" action="index.php">
<input type="hidden" name="r" value="people">
<input class="input" name="q" value="<?= e($q) ?>" placeholder="按姓名、小名或邮箱搜索">
<button class="btn btn-ghost btn-sm" type="submit">搜索</button>
<?php if ($q !== ''): ?>
<a class="link-quiet" href="<?= e(url('people')) ?>">清除</a>
<?php endif; ?>
</form>
<?php if (!$people): ?>
<div class="empty">
<b><?= $q !== '' ? '没有匹配的人' : '名册还是空的' ?></b>
<?= $q !== '' ? '换个词试试。' : '把家里人加进来，之后观影、旅行的同行人就可以直接从名册里选。' ?>
</div>
<?php else: ?>
<div class="people-grid">
<?php foreach ($people as $p): ?>
<a class="person" href="<?= e(url('people/show', ['id' => (int)$p['id']])) ?>">
<div class="ph"><img src="<?= e(\App\Upload::avatarUrl($p['avatar'])) ?>" alt=""></div>
<div class="pb">
<div class="pname"><?= e($p['name']) ?></div>
<div class="pmeta">
<?php if ($p['account_role'] === 'admin' && $p['account_status'] === 'active'): ?>
<span class="badge badge-admin">管理员</span>
<?php elseif (!empty($p['account_id'])): ?>
<span class="badge badge-open">已开通</span>
<?php else: ?>
<span class="badge">未开通</span>
<?php endif; ?>
<?php if (!empty($p['nickname'])): ?> · <?= e($p['nickname']) ?><?php endif; ?>
</div>
</div>
</a>
<?php endforeach; ?>
</div>
<?php endif; ?>
templates/people/show.php
+147
View File
@@ -0,0 +1,147 @@
<?php
$age = age_from($person['birthday'] ?? '');
$isMe = (int)$person['id'] === (int)\App\Auth::personId();
$admin = \App\Auth::isAdmin();
?>
<div class="page-head">
<h1><?= e($person['name']) ?></h1>
<span class="sub">
<?php if (!empty($person['nickname'])): ?>小名 <?= e($person['nickname']) ?><?php endif; ?>
</span>
<div class="actions">
<?php if ($admin): ?>
<a class="btn btn-ghost btn-sm" href="<?= e(url('people/edit', ['id' => (int)$person['id']])) ?>">编辑</a>
<form method="post" action="<?= e(url('people/destroy')) ?>" style="display:inline"
onsubmit="return confirm('确定要从名册里移除 <?= e($person['name']) ?> 吗？相关的账号也会一起删掉。')">
<?= csrf_field() ?>
<input type="hidden" name="id" value="<?= (int)$person['id'] ?>">
<button class="btn btn-danger btn-sm" type="submit">移除</button>
</form>
<?php endif; ?>
</div>
</div>
<div class="detail">
<aside class="detail-photo">
<img src="<?= e(\App\Upload::avatarUrl($person['avatar'])) ?>" alt="">
<div class="name"><?= e($person['name']) ?></div>
<div class="sub">
<?php if ($person['account_role'] === 'admin' && $person['account_status'] === 'active'): ?>
家庭管理员
<?php elseif (!empty($person['account_id'])): ?>
已开通登录<?= $person['account_status'] === 'disabled' ? '（已停用）' : '' ?>
<?php else: ?>
还没有开通登录
<?php endif; ?>
</div>
</aside>
<div>
<div class="card card-pad">
<dl class="kv">
<div class="kv-row">
<dt>姓名</dt><dd><?= e($person['name']) ?></dd>
</div>
<?php if (!empty($person['nickname'])): ?>
<div class="kv-row"><dt>小名</dt><dd><?= e($person['nickname']) ?></dd></div>
<?php endif; ?>
<div class="kv-row">
<dt>性别</dt>
<dd><?= $person['gender'] === 'm' ? '男' : ($person['gender'] === 'f' ? '女' : '未填写') ?></dd>
</div>
<div class="kv-row">
<dt>生日</dt>
<dd>
<?php if (!empty($person['birthday'])): ?>
<?= e($person['birthday']) ?>
<?php if ($age !== null): ?> · <?= (int)$age ?> 岁<?php endif; ?>
<?php $d = days_until_birthday($person['birthday']); ?>
<?php if ($d === 0): ?> · <span style="color:var(--brand)">今天生日</span>
<?php elseif ($d !== null): ?> · 还有 <?= (int)$d ?> 天<?php endif; ?>
<?php else: ?>
<span class="muted">未填写</span>
<?php endif; ?>
</dd>
</div>
<div class="kv-row">
<dt>手机号</dt>
<dd class="mono"><?= e(\App\Crypto::maskPhone($person['phone_encrypted'] ?? '')) ?></dd>
</div>
<div class="kv-row">
<dt>身份证号</dt>
<dd class="mono"><?= e(\App\Crypto::maskIdCard($person['id_card_encrypted'] ?? '')) ?></dd>
</div>
<?php if (!empty($person['email'])): ?>
<div class="kv-row"><dt>邮箱</dt><dd><?= e($person['email']) ?></dd></div>
<?php endif; ?>
<?php if (!empty($person['address'])): ?>
<div class="kv-row"><dt>住址</dt><dd><?= e($person['address']) ?></dd></div>
<?php endif; ?>
<?php if (!empty($person['note'])): ?>
<div class="kv-row"><dt>备注</dt><dd><?= nl2br(e($person['note'])) ?></dd></div>
<?php endif; ?>
<div class="kv-row">
<dt>最近登录</dt>
<dd><?= !empty($person['last_login_at']) ? e($person['last_login_at']) : '从未登录' ?></dd>
</div>
</dl>
</div>
<?php if ($admin): ?>
<div class="card card-pad" style="margin-top:16px">
<h2 class="section-title">登录账号</h2>
<?php if (empty($person['account_id'])): ?>
<p class="small muted" style="margin:0 0 14px">
开通后，<?= e($person['name']) ?> 就能用手机号和密码登录家书了。
</p>
<form method="post" action="<?= e(url('accounts/create')) ?>" class="form-grid">
<?= csrf_field() ?>
<input type="hidden" name="person_id" value="<?= (int)$person['id'] ?>">
<div class="field">
<label>登录密码</label>
<input class="input" name="password" type="password" placeholder="至少 8 位，含字母和数字" required>
</div>
<div class="field">
<label>角色</label>
<select class="select" name="role">
<option value="member">普通成员</option>
<option value="admin">管理员</option>
</select>
</div>
<div class="field full">
<button class="btn btn-sm" type="submit">开通账号</button>
</div>
</form>
<?php else: ?>
<p class="small muted" style="margin:0 0 14px">
账号已开通，登录名是 <?= e($person['name']) ?> 的手机号。
</p>
<div class="btn-row" style="margin-top:0;flex-wrap:wrap">
<?php if (!$isMe): ?>
<form method="post" action="<?= e(url('accounts/role')) ?>" style="display:inline">
<?= csrf_field() ?>
<input type="hidden" name="person_id" value="<?= (int)$person['id'] ?>">
<input type="hidden" name="role" value="<?= $person['account_role'] === 'admin' ? 'member' : 'admin' ?>">
<button class="btn btn-ghost btn-sm" type="submit">
<?= $person['account_role'] === 'admin' ? '取消管理员' : '设为管理员' ?>
</button>
</form>
<form method="post" action="<?= e(url('accounts/status')) ?>" style="display:inline">
<?= csrf_field() ?>
<input type="hidden" name="person_id" value="<?= (int)$person['id'] ?>">
<input type="hidden" name="status" value="<?= $person['account_status'] === 'active' ? 'disabled' : 'active' ?>">
<button class="btn btn-ghost btn-sm" type="submit">
<?= $person['account_status'] === 'active' ? '停用账号' : '启用账号' ?>
</button>
</form>
<?php else: ?>
<span class="small muted">这是你自己 —— 要改自己的权限，请让另一位管理员来操作。</span>
<?php endif; ?>
</div>
<?php endif; ?>
</div>
<?php endif; ?>
</div>
</div>