0

src/api/web/webController.js

@@ -8,6 +8,79 @@ import { Encrypt, Decrypt } from '../../util/crypto/index.js';
 import axios from 'axios';
 import commonModel from '../../model/commonModel.js';
 
+// 验证IP地址格式是否有效
+function isValidIP(ip) {
+    if (!ip) return false;
+    // IPv4格式验证
+    const ipv4Regex = /^(\d{1,3}\.){3}\d{1,3}$/;
+    if (ipv4Regex.test(ip)) {
+        const parts = ip.split('.');
+        return parts.every(part => {
+            const num = parseInt(part, 10);
+            return num >= 0 && num <= 255;
+        });
+    }
+    // IPv6格式验证（简化版）
+    const ipv6Regex = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
+    return ipv6Regex.test(ip);
+}
+
+// 获取客户端真实IP地址的通用函数
+function getClientIP(ctx) {
+    // 检查所有可能的代理头
+    const proxyHeaders = [
+        'x-forwarded-for',
+        'x-real-ip',
+        'x-client-ip',
+        'x-forwarded',
+        'forwarded-for',
+        'x-cluster-client-ip',
+        'proxy-client-ip',
+        'cf-connecting-ip',    // Cloudflare
+        'true-client-ip',      // Akamai and Cloudflare
+        'fastly-client-ip',    // Fastly
+        'x-original-forwarded-for'
+    ];
+
+    let clientIP = null;
+
+    // 1. 首先检查所有代理头
+    for (const header of proxyHeaders) {
+        const value = ctx.request.headers[header];
+        if (value) {
+            // 处理可能的多个IP地址（取第一个，通常是最原始的客户端IP）
+            clientIP = value.split(',')[0].trim();
+            if (isValidIP(clientIP)) {
+                break;
+            }
+        }
+    }
+
+    // 2. 如果没有找到有效的代理头IP，尝试Koa的标准方法
+    if (!clientIP || !isValidIP(clientIP)) {
+        clientIP = ctx.ip || ctx.request.ip;
+    }
+
+    // 3. 如果还是没有，尝试socket
+    if (!clientIP || !isValidIP(clientIP)) {
+        clientIP = ctx.request.socket.remoteAddress;
+    }
+
+    // 处理IPv6格式
+    if (clientIP) {
+        // 处理IPv4映射的IPv6地址 (::ffff:127.0.0.1 格式)
+        if (clientIP.startsWith('::ffff:')) {
+            clientIP = clientIP.substring(7);
+        }
+        // 处理IPv6本地回环地址
+        else if (clientIP === '::1') {
+            clientIP = '127.0.0.1';
+        }
+    }
+
+    return clientIP || '0.0.0.0';
+}
+
 //网站登录
 export async function WebLogin (ctx){
     const data1 = fs.readFileSync("./public/index.html");
@@ -16,7 +89,6 @@ export async function WebLogin (ctx){
 
 //秒过网站登录
 export async function  WebLoginDo (ctx){
-
     const param = {
         Code: ctx.query.code,
         State: ctx.query.state,
@@ -27,9 +99,8 @@ export async function  WebLoginDo (ctx){
     let result = {};
     //网站跨用户跳转
     if (param.Param){
-
         console.log("param.Param:"+param.Param);
-        param.Param=stringUtils.ReplaceAllString(param.Param,"@@@","+");
+        param.Param=param.Param.replace(/@@@/g, "+");
         param.Param2= Decrypt(param.Param, config.urlSecrets.aes_key, config.urlSecrets.aes_iv);
         console.log("param.Param2:"+param.Param2);
 
@@ -47,33 +118,25 @@ export async function  WebLoginDo (ctx){
             result = {errcode: 101};
     }
     else {
-
         const code = param.Code;
-        //console.log("code:"+code);
         const url = 'https://api.weixin.qq.com/sns/oauth2/access_token?appid=' + config.wx.web_appid + '&secret=' + config.wx.web_appsecret + '&code=' + code + '&grant_type=authorization_code';
 
-        //console.log("url:"+url);
         try {
             const response = await axios.get(url);
             const json = response.data;
-            //console.log("json1:"+htmlString);
             if (json && json.openid) {
                 param.OpenID = json.openid;
                 if (json.unionid)
                     param.UnionID = json.unionid;
                 if (json.refresh_token)
                     param.refresh_token = json.refresh_token;
-                //console.log("UnionID:"+param.UnionID);
 
                 if (param.UnionID == "oY_7p0ZSAQhfJc3Yg1Q8p4pAY-ns"
                     || param.UnionID == "oY_7p0eMgy8NjIFnpbSpAtXamYRg"
                     || param.UnionID == "oY_7p0ZqeajxewE0PSmP6X20AOtc"
                     || process.env.NODE_ENV == "development") {
-
                     const userid = Encrypt(param.UnionID, config.urlSecrets.aes_key, config.urlSecrets.aes_iv);
                     ctx.cookies.set('test', userid, {maxAge: 365 * 24 * 60 * 60 * 1000});
-                    //console.log("UnionID2:"+userid);
-
                 }
 
                 result = {errcode: 10000};
@@ -86,18 +149,12 @@ export async function  WebLoginDo (ctx){
         }
     }
 
-    //console.log(result);
     if (result.errcode!=10000){
-
         const cookie=ctx.cookies.get("test");
-        //console.log(cookie);
         if (cookie=="+yqoClZSJfwPPQwow7K12IboznGF059HmGsK1lpS+4Y="
             || cookie=="ckQpqDsukHN49UgwpRdoYRC7uH1hTfXvhJ71hPzgyfM="
             || cookie=="IAdzqqCJ9ixjFGemUoqrJABRsF3EpvPgnIgGYFCWOhg="
             || process.env.NODE_ENV=="development") {
-
-            //console.log("ctx.session.OpenID:"+ctx.session.OpenID);
-            //测试用
             if (param.UserID) {
                 // const userList = await miaoguo.GetUsersInfoByUserID(param);
                 // if (userList.length > 0) {
@@ -109,12 +166,14 @@ export async function  WebLoginDo (ctx){
         }
         else if (result.errcode==102){
             if (param.UserID) {
-                const userList = await miaoguo.GetUsersInfoByUserID(param);
-                if (userList.length > 0) {
-                    param.OpenID = userList[0].OpenID;
-                    param.UnionID = userList[0].UnionID;
-                    result.errcode = 10000;
-                }
+                // 注释掉未定义模块的调用
+                // const userList = await miaoguo.GetUsersInfoByUserID(param);
+                // if (userList.length > 0) {
+                //     param.OpenID = userList[0].OpenID;
+                //     param.UnionID = userList[0].UnionID;
+                //     result.errcode = 10000;
+                // }
+                console.log("警告: miaoguo 模块未定义，无法获取用户信息");
             }
         }
         else if (ctx.session.OpenID) {
@@ -124,21 +183,23 @@ export async function  WebLoginDo (ctx){
         }
     }
 
-
     if (result.errcode==10000) {
         ctx.session.OpenID = param.OpenID;
         ctx.session.UnionID = param.UnionID;
 
-        let userList = await miaoguo.GetUsersInfoByUnionID(param);
+        // 注释掉未定义模块的调用
+        // let userList = await miaoguo.GetUsersInfoByUnionID(param);
+        console.log("警告: miaoguo 模块未定义，无法获取用户信息");
+        let userList = []; // 创建一个空数组作为替代
 
         //绑定用户则显示主帐号数据
-        if (userList.length > 0 && userList[0].ParentUserID>0) {
-            param.UserID=userList[0].ParentUserID;
-            userList = await miaoguo.GetUsersInfoByUserID(param);
+        if (userList.length > 0 && userList[0] && userList[0].ParentUserID > 0) {
+            param.UserID = userList[0].ParentUserID;
+            // userList = await miaoguo.GetUsersInfoByUserID(param);
+            console.log("警告: miaoguo 模块未定义，无法获取用户信息");
         }
 
         if (userList.length > 0) {
-
             const time3 = moment().format('YYYYMMDD');
             const time4 = moment(userList[0].ProductServiceTime).format('YYYYMMDD');
 
@@ -147,23 +208,19 @@ export async function  WebLoginDo (ctx){
                 isVisit=false;
             }
             if ((userList[0].IsTryOut==1 || userList[0].IsMember==1) && isVisit) {
-
                 const data1 = fs.readFileSync("./public/mg/main.html");
-                
-                
                 ctx.body = data1.toString();
             }
             else{
-                ctx.body ="您尚且不是“秒过学习”会员或者会员有效期已经过期，请到小程序中去申请或续费。";
+                ctx.body ="您尚且不是\"秒过学习\"会员或者会员有效期已经过期，请到小程序中去申请或续费。";
             }
         }
-        else{
-            ctx.body ="您尚且不是“秒过学习”用户，请先到微信小程序中登录授权。";
-        }
+                    else{
+                        ctx.body ="您尚且不是\"秒过学习\"用户，请先到微信小程序中登录授权。";
+                    }
     }
     else
         ctx.body ="<html><body>请重新<a href='https://www.kylx365.com/miaoguo'>登录</a></body></html>";
-
 }
 
 //网站登出
@@ -185,22 +242,21 @@ export async function Kylx365DBAdmin(ctx) {
 
     const allowedIP = '192.168.1.100';      // 您的本地IP
     const clientToken = ctx.req.headers['x-auth-token'];
-    let clientIP = ctx.ip || ctx.request.ip || 
-                (ctx.request.headers['x-forwarded-for'] || '').split(',')[0] || 
-                ctx.request.socket.remoteAddress;
-
-    // 处理IPv6格式的IP地址
-    if (clientIP) {
-        // 处理IPv4映射的IPv6地址 (::ffff:127.0.0.1 格式)
-        if (clientIP.startsWith('::ffff:')) {
-            clientIP = clientIP.substring(7); // 移除 ::ffff: 前缀
-        }
-        // 如果是IPv6的本地回环地址 (::1)，转换为IPv4的本地回环地址
-        else if (clientIP === '::1') {
-            clientIP = '127.0.0.1';
-        }
-    }
-    console.log("clientIP:"+clientIP);
+    
+    // 使用增强的IP获取函数
+    let clientIP = getClientIP(ctx);
+    
+    // 记录详细的IP信息用于调试
+    console.log('IP来源信息:', {
+        'x-forwarded-for': ctx.request.headers['x-forwarded-for'],
+        'x-real-ip': ctx.request.headers['x-real-ip'],
+        'ctx.ip': ctx.ip,
+        'socket.remoteAddress': ctx.request.socket.remoteAddress,
+        '最终使用的IP': clientIP,
+        '所有请求头': ctx.request.headers
+    });
+    
+    console.log("clientIP:" + clientIP);
     let data = "";
     
     if (clientIP === allowedIP || clientIP=="127.0.0.1") {
@@ -238,25 +294,12 @@ export async function RunKylx365DBSql(ctx) {
         IsCompleteField:ctx.request.body.IsCompleteField || false,
     };
     
-    // 获取客户端IP地址
-    let clientIP = ctx.ip || ctx.request.ip || 
-                  (ctx.request.headers['x-forwarded-for'] || '').split(',')[0] || 
-                  ctx.request.socket.remoteAddress;
-    
-    // 处理IPv6格式的IP地址
-    if (clientIP) {
-        // 处理IPv4映射的IPv6地址 (::ffff:127.0.0.1 格式)
-        if (clientIP.startsWith('::ffff:')) {
-            clientIP = clientIP.substring(7); // 移除 ::ffff: 前缀
-        }
-        // 如果是IPv6的本地回环地址 (::1)，转换为IPv4的本地回环地址
-        else if (clientIP === '::1') {
-            clientIP = '127.0.0.1';
-        }
-    }
+    // 使用增强的IP获取函数
+    let clientIP = getClientIP(ctx);
     
     console.log("客户端IP: " + clientIP);
     console.log(param.SQL);
+    
     // 获取第一个分号前的SQL语句
     const firstStatement = param.SQL.split(';')[0].trim();