twikoo-vercel 1.5.4 → 1.5.7

package/api/index.js

@@ -163,7 +163,7 @@ module.exports = async (requestArg, responseArg) => {
 function allowCors () {
   if (request.headers.origin) {
     response.setHeader('Access-Control-Allow-Credentials', true)
-    response.setHeader('Access-Control-Allow-Origin', config.CORS_ALLOW_ORIGIN || request.headers.origin)
+    response.setHeader('Access-Control-Allow-Origin', getAllowedOrigin())
     response.setHeader('Access-Control-Allow-Methods', 'POST')
     response.setHeader(
       'Access-Control-Allow-Headers',
@@ -172,6 +172,18 @@ function allowCors () {
   }
 }
 
+function getAllowedOrigin () {
+  const localhostRegex = /^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:\d{1,5})?$/
+  if (localhostRegex.test(request.headers.origin)) {
+    return request.headers.origin
+  } else if (config.CORS_ALLOW_ORIGIN) {
+    // 许多用户设置安全域名时，喜欢带结尾的 "/"，必须处理掉
+    return config.CORS_ALLOW_ORIGIN.replace(/\/$/, '')
+  } else {
+    return request.headers.origin
+  }
+}
+
 function anonymousSignIn () {
   if (request.body) {
     if (request.body.accessToken) {
@@ -1133,7 +1145,7 @@ async function parse (comment) {
     comment: DOMPurify.sanitize(comment.comment, { FORBID_TAGS: ['style'], FORBID_ATTR: ['style'] }),
     pid: comment.pid ? comment.pid : comment.rid,
     rid: comment.rid,
-    isSpam: isAdminUser ? false : preCheckSpam(comment.comment),
+    isSpam: isAdminUser ? false : preCheckSpam(comment),
     created: timestamp,
     updated: timestamp
   }
@@ -1177,7 +1189,7 @@ async function limitFilter () {
 }
 
 // 预垃圾评论检测
-function preCheckSpam (comment) {
+function preCheckSpam ({ comment, nick }) {
   // 长度限制
   let limitLength = parseInt(config.LIMIT_LENGTH)
   if (Number.isNaN(limitLength)) limitLength = 500
@@ -1191,7 +1203,7 @@ function preCheckSpam (comment) {
   } else if (config.FORBIDDEN_WORDS) {
     // 违禁词检测
     for (const forbiddenWord of config.FORBIDDEN_WORDS.split(',')) {
-      if (comment.indexOf(forbiddenWord.trim()) !== -1) {
+      if (comment.indexOf(forbiddenWord.trim()) !== -1 || nick.indexOf(forbiddenWord.trim()) !== -1) {
         console.log('包含违禁词，直接标记为垃圾评论~')
         return true
       }
@@ -1432,11 +1444,11 @@ async function uploadImage (event) {
     }
     // tip: qcloud 图床走前端上传，其他图床走后端上传
     if (config.IMAGE_CDN === '7bu') {
-      await uploadImageTo7Bu({ photo, fileName, config, res })
+      await uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: 'https://7bu.top' })
     } else if (config.IMAGE_CDN === 'smms') {
       await uploadImageToSmms({ photo, fileName, config, res })
     } else if (isUrl(config.IMAGE_CDN)) {
-      await uploadImageToLskyPro({ photo, fileName, config, res })
+      await uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: config.IMAGE_CDN })
     }
   } catch (e) {
     console.error(e)
@@ -1446,24 +1458,6 @@ async function uploadImage (event) {
   return res
 }
 
-async function uploadImageTo7Bu ({ photo, fileName, config, res }) {
-  // 去不图床旧版本 https://7bu.top
-  // TODO: 2022 年 4 月 30 日后去不图床将会升级新版本，此处逻辑要同步更新
-  const formData = new FormData()
-  formData.append('image', base64UrlToReadStream(photo, fileName))
-  const uploadResult = await axios.post('https://7bu.top/api/upload', formData, {
-    headers: {
-      ...formData.getHeaders(),
-      token: config.IMAGE_CDN_TOKEN
-    }
-  })
-  if (uploadResult.data.code === 200) {
-    res.data = uploadResult.data.data
-  } else {
-    throw new Error(uploadResult.data.msg)
-  }
-}
-
 async function uploadImageToSmms ({ photo, fileName, config, res }) {
   // SM.MS 图床 https://sm.ms
   const formData = new FormData()
@@ -1481,11 +1475,11 @@ async function uploadImageToSmms ({ photo, fileName, config, res }) {
   }
 }
 
-async function uploadImageToLskyPro ({ photo, fileName, config, res }) {
+async function uploadImageToLskyPro ({ photo, fileName, config, res, imageCdn }) {
   // 自定义兰空图床（v2）URL
   const formData = new FormData()
   formData.append('file', base64UrlToReadStream(photo, fileName))
-  const url = `${config.IMAGE_CDN}/api/v1/upload`
+  const url = `${imageCdn}/api/v1/upload`
   let token = config.IMAGE_CDN_TOKEN
   if (!token.startsWith('Bearer')) {
     token = `Bearer ${token}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-vercel",
-  "version": "1.5.4",
+  "version": "1.5.7",
   "description": "A simple comment system based on Tencent CloudBase (tcb).",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",