From 41aa81083f32c48c1a3700c5c97b6bd75180d530 Mon Sep 17 00:00:00 2001 From: liucheng Date: Sat, 25 Jul 2026 14:59:15 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20tts=20fileID=20=E6=A0=A1=E9=AA=8C?= =?UTF-8?q?=E5=BD=92=E5=B1=9E=20+=20=E6=8E=92=E8=A1=8C=E6=A6=9C=E4=B8=8D?= =?UTF-8?q?=E4=B8=8B=E5=8F=91=E4=BB=96=E4=BA=BA=20openid?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - tts: client 传的 fileID 校验必须属于 tts-cache 目录,防伪造 cloud:// 换取他人私有文件 - leaderboard: ranked 去掉他人 openid 改用 isMe 标记,wxml 用 item.isMe 高亮 Co-Authored-By: Claude --- cloudfunctions/leaderboard/index.js | 2 +- cloudfunctions/tts/index.js | 2 ++ pages/leaderboard/leaderboard.wxml | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/cloudfunctions/leaderboard/index.js b/cloudfunctions/leaderboard/index.js index c712edc..7a07f69 100644 --- a/cloudfunctions/leaderboard/index.js +++ b/cloudfunctions/leaderboard/index.js @@ -155,7 +155,7 @@ exports.main = async (event) => { // Top N for the board const ranked = allSorted.slice(0, limit).map((item, i) => ({ rank: i + 1, - openid: item.openid, + isMe: item.openid === myOpenid, nickname: item.nickname || '', name: _displayName(item), duration: item.duration, diff --git a/cloudfunctions/tts/index.js b/cloudfunctions/tts/index.js index dc70be2..f6f741a 100644 --- a/cloudfunctions/tts/index.js +++ b/cloudfunctions/tts/index.js @@ -85,6 +85,8 @@ exports.main = async (event) => { // 解析 fileID:优先 client 传入,否则查服务端 tts_cache,防 client 传 null 强制重合成(刷 TTS 账单) let resolvedFileID = fileID || null + // 校验 client 传的 fileID 必须属于 tts-cache 目录,防伪造 cloud:// 换取他人私有文件 + if (resolvedFileID && !resolvedFileID.includes(CACHE_DIR)) resolvedFileID = null if (!resolvedFileID) { try { const r = await db.collection('tts_cache').doc(cacheKey).get() diff --git a/pages/leaderboard/leaderboard.wxml b/pages/leaderboard/leaderboard.wxml index 95d97c8..697e61b 100644 --- a/pages/leaderboard/leaderboard.wxml +++ b/pages/leaderboard/leaderboard.wxml @@ -75,7 +75,7 @@ wx:for="{{rankedList}}" wx:key="openid" wx:if="{{rankedList.length < 3 || index >= 3}}" - class="rank-item {{myEntry && item.openid === myEntry.openid ? 'is-me' : ''}} rank-item--enter" + class="rank-item {{item.isMe ? 'is-me' : ''}} rank-item--enter" style="animation-delay: {{index < 10 ? index * 60 : 0}}ms;" >