Update nonce handling for form submissions (#53)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.distignore

@@ -1,6 +1,10 @@
 /.git
 /.github
 /.distignore
+/.wordpress-org
 /sdk/composer.lock
 /sdk/vendor/aliyuncs/oss-sdk-php/samples/
 /sdk/vendor/aliyuncs/oss-sdk-php/tests/
+/sdk/vendor/aliyuncs/oss-sdk-php/.coveralls.yml
+*.github
+*.php_cs*

.github/workflows/asset-update.yaml

@@ -7,4 +7,6 @@ on:
 jobs:
   update:
     uses: sy-records/.github/.github/workflows/wordpress-plugin-asset-update.yaml@main
+    with:
+      skip_assets: false
     secrets: inherit

.wordpress-org/blueprints/blueprint.json

@@ -0,0 +1,27 @@
+{
+  "landingPage": "/wp-admin/admin.php?page=oss-aliyun%2Faliyun-oss-wordpress.php",
+  "preferredVersions": {
+    "php": "latest",
+    "wp": "latest"
+  },
+  "phpExtensionBundles": [
+    "kitchen-sink"
+  ],
+  "steps": [
+    {
+      "step": "login",
+      "username": "admin",
+      "password": "password"
+    },
+    {
+      "step": "installPlugin",
+      "pluginZipFile": {
+        "resource": "wordpress.org/plugins",
+        "slug": "oss-aliyun"
+      },
+      "options": {
+        "activate": true
+      }
+    }
+  ]
+}

README.md

@@ -10,6 +10,8 @@
 [![plugin installs](https://img.shields.io/wordpress/plugin/installs/oss-aliyun)](https://wordpress.org/plugins/oss-aliyun/)
 [![Deploy to WordPress.org](https://github.com/sy-records/aliyun-oss-wordpress/actions/workflows/deploy.yml/badge.svg)](https://github.com/sy-records/aliyun-oss-wordpress/actions/workflows/deploy.yml)
 
+> 使用 WordPress Playground 在线预览 [OSS Aliyun](https://wordpress.org/plugins/oss-aliyun/?preview=1) 插件
+
 ## 插件特色
 
 - [x] 可配置是否上传缩略图和是否保留本地备份
@@ -20,7 +22,11 @@
 - [x] 支持同步历史附件到阿里云对象存储 OSS
 - [x] 支持阿里云 OSS 图片处理
 - [x] 支持上传文件自动重命名
-- [x] 支持使用 RAM 操作
+- [x] 支持使用 ECS 的 RAM 操作
+- [x] 支持原图保护
+- [x] 支持 `wp-cli` 命令上传/删除文件
+- [x] 支持多站点
+- [x] 支持图片裁剪编辑等操作后的上传
 
 ## 安装
 
@@ -54,6 +60,6 @@ GitHub 下载节点：[https://github.com/sy-records/aliyun-oss-wordpress/releas
 
 ## 插件截图
 
-![设置页面](screenshot-1.png)
+![设置页面](.wordpress-org/screenshot-1.png)
 
-![update-wordpress-posts-photos.png](screenshot-2.png)
+![update-wordpress-posts-photos.png](.wordpress-org/screenshot-2.png)

aliyun-oss-wordpress.php

@@ -2,8 +2,8 @@
 /*
 Plugin Name: OSS Aliyun
 Plugin URI: https://github.com/sy-records/aliyun-oss-wordpress
-Description: 使用阿里云对象存储 OSS 作为附件存储空间。（This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.）
-Version: 1.4.7
+Description: 使用阿里云对象存储 OSS 作为附件存储空间。(This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.)
+Version: 1.5.1
 Author: 沈唁
 Author URI: https://qq52o.me
 License: Apache2.0
@@ -18,12 +18,17 @@ use OSS\OssClient;
 use OSS\Credentials\CredentialsProvider;
 use AlibabaCloud\Credentials\Credential;
 use OSS\Credentials\StaticCredentialsProvider;
+use OSS\Core\OssException;
 
-define('OSS_VERSION', '1.4.7');
+define('OSS_VERSION', '1.5.1');
 define('OSS_BASEFOLDER', plugin_basename(dirname(__FILE__)));
 
 if (!function_exists('get_home_path')) {
-    require_once(ABSPATH . 'wp-admin/includes/file.php');
+    require_once ABSPATH . 'wp-admin/includes/file.php';
+}
+
+if (defined('WP_CLI') && WP_CLI) {
+    require_once plugin_dir_path(__FILE__) . 'oss-commands.php';
 }
 
 class OSSCredentialsWrapper implements CredentialsProvider
@@ -49,12 +54,12 @@ class OSSCredentialsWrapper implements CredentialsProvider
 
 // 初始化选项
 register_activation_hook(__FILE__, 'oss_set_options');
-// 初始化选项
-function oss_set_options()
+function oss_get_default_options()
 {
-    $options = [
+    return [
         'bucket' => '',
         'regional' => 'oss-cn-shanghai',
+        'origin_region' => '',
         'accessKeyId' => '',
         'accessKeySecret' => '',
         'is_internal' => 'false',
@@ -63,56 +68,102 @@ function oss_set_options()
         'upload_url_path' => '', // URL前缀
         'style' => '', // 图片处理
         'update_file_name' => 'false', // 是否重命名文件名
-        'role_name' => '' // 角色名称
+        'role_name' => '', // 角色名称
+        'origin_protect' => 'off',
     ];
-    add_option('oss_options', $options, '', 'yes');
+}
+
+// 初始化选项
+function oss_set_options()
+{
+    add_option('oss_options', oss_get_default_options(), '', 'yes');
 }
 
 function oss_get_client()
 {
-    $oss_opt = get_option('oss_options', true);
-    $roleName = esc_attr($oss_opt['role_name'] ?? '');
-    $endpoint = oss_get_bucket_endpoint($oss_opt);
+    $oss_options = get_option('oss_options', oss_get_default_options());
+    $role_name = esc_attr($oss_options['role_name'] ?? '');
+    $endpoint = oss_get_bucket_endpoint($oss_options);
 
-    if (!empty($roleName)) {
+    if (!empty($role_name)) {
         $ecsRamRole = new Credential([
             // 填写Credential类型，固定值为ecs_ram_role。
             'type' => 'ecs_ram_role',
             // 填写角色名称。
-            'role_name' => $roleName,
+            'role_name' => $role_name,
         ]);
         $providerWrapper = new OSSCredentialsWrapper($ecsRamRole);
         $provider = $providerWrapper->getCredentials();
-        $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? 'https://' : 'http://';
-        $config = ['provider' => $provider, 'endpoint'=> $protocol . $endpoint];
-        return new OssClient($config);
+    } else {
+        $provider = new StaticCredentialsProvider(esc_attr($oss_options['accessKeyId']), esc_attr($oss_options['accessKeySecret']));
     }
 
-    $accessKeyId = esc_attr($oss_opt['accessKeyId']);
-    $accessKeySecret = esc_attr($oss_opt['accessKeySecret']);
-    return new OssClient($accessKeyId, $accessKeySecret, $endpoint);
+    $region = !empty($oss_options['origin_region']) ? esc_attr($oss_options['origin_region']) : esc_attr($oss_options['regional']);
+    if (in_array($region, ['oss-accelerate', 'oss-accelerate-overseas']) && empty($oss_options['origin_region'])) {
+        try {
+            $config = [
+                'provider'         => $provider,
+                'endpoint'         => $region == 'oss-accelerate' ? 'https://oss-cn-hangzhou.aliyuncs.com' : 'https://oss-cn-hongkong.aliyuncs.com',
+                'signatureVersion' => OssClient::OSS_SIGNATURE_VERSION_V4,
+                'region'           => $region == 'oss-accelerate' ? 'cn-hangzhou' : 'cn-hongkong',
+            ];
+            $region = (new OssClient($config))->getBucketInfo(esc_attr($oss_options['bucket']))->getLocation();
+            $oss_options['origin_region'] = sanitize_text_field($region);
+            update_option('oss_options', $oss_options);
+        } catch (OssException $e) {
+            error_log("get bucket location failed: {$e->getMessage()}");
+        }
+    }
+
+    $region = str_replace('oss-', '', $region);
+
+    $config = [
+        'provider'         => $provider,
+        'endpoint'         => $endpoint,
+        'signatureVersion' => OssClient::OSS_SIGNATURE_VERSION_V4,
+        'region'           => $region,
+    ];
+    return new OssClient($config);
 }
 
-function oss_get_bucket_endpoint($oss_option)
+function oss_get_bucket_endpoint($oss_options)
 {
-    $oss_regional = esc_attr($oss_option['regional']);
-    if ($oss_option['is_internal'] == 'true') {
-        return "{$oss_regional}-internal.aliyuncs.com";
+    $regional = esc_attr($oss_options['regional']);
+    $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || (!empty($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ? 'https' : 'http';
+    if ($oss_options['is_internal'] == 'true') {
+        return "{$protocol}://{$regional}-internal.aliyuncs.com";
     }
 
-    return "{$oss_regional}.aliyuncs.com";
+    return "{$protocol}://{$regional}.aliyuncs.com";
 }
 
 function oss_get_bucket_name()
 {
-    $oss_opt = get_option('oss_options', true);
-    return $oss_opt['bucket'];
+    $oss_options = get_option('oss_options', oss_get_default_options());
+    return esc_attr($oss_options['bucket']);
+}
+
+/**
+ * @param string $object
+ * @return array
+ */
+function oss_get_file_meta($object)
+{
+    try {
+        $ossClient = oss_get_client();
+        $bucket = oss_get_bucket_name();
+        return $ossClient->getObjectMeta($bucket, $object);
+    } catch (\Throwable $e) {
+        error_log($e->getMessage());
+        return ['content-length' => 0];
+    }
 }
 
 /**
  * @param string $object
  * @param string $file
  * @param bool $no_local_file
+ * @return bool
  */
 function oss_file_upload($object, $file, $no_local_file = false)
 {
@@ -124,13 +175,14 @@ function oss_file_upload($object, $file, $no_local_file = false)
     $ossClient = oss_get_client();
     try {
         $ossClient->uploadFile($bucket, ltrim($object, '/'), $file);
-    } catch (Throwable $e) {
-        if (WP_DEBUG) {
-            echo 'Error Message: ', $e->getMessage(), PHP_EOL, 'Error Code: ', $e->getCode();
+        if ($no_local_file) {
+            oss_delete_local_file($file);
         }
-    }
-    if ($no_local_file) {
-        oss_delete_local_file($file);
+
+        return true;
+    } catch (\Throwable $e) {
+        error_log($e->getMessage());
+        return false;
     }
 }
 
@@ -141,14 +193,14 @@ function oss_file_upload($object, $file, $no_local_file = false)
  */
 function oss_is_delete_local_file()
 {
-    $oss_options = get_option('oss_options', true);
+    $oss_options = get_option('oss_options', oss_get_default_options());
     return esc_attr($oss_options['nolocalsaving']) == 'true';
 }
 
 /**
  * 删除本地文件
  *
- * @param $file
+ * @param string $file
  * @return bool
  */
 function oss_delete_local_file($file)
@@ -182,9 +234,7 @@ function oss_delete_oss_file($file)
         $ossClient = oss_get_client();
         $ossClient->deleteObject($bucket, $file);
     } catch (\Throwable $e) {
-        if (WP_DEBUG) {
-            echo 'Error Message: ', $e->getMessage(), PHP_EOL, 'Error Code: ', $e->getCode();
-        }
+        error_log($e->getMessage());
     }
 }
 
@@ -204,9 +254,7 @@ function oss_delete_oss_files(array $files)
         $ossClient = oss_get_client();
         $ossClient->deleteObjects($bucket, $deleteObjects);
     } catch (\Throwable $e) {
-        if (WP_DEBUG) {
-            echo 'Error Message: ', $e->getMessage(), PHP_EOL, 'Error Code: ', $e->getCode();
-        }
+        error_log($e->getMessage());
     }
 }
 
@@ -218,7 +266,7 @@ function oss_delete_oss_files(array $files)
  */
 function oss_upload_attachments($metadata)
 {
-    $mime_types = get_allowed_mime_types();
+    $mime_types = wp_get_mime_types();
     $image_mime_types = [
         $mime_types['jpg|jpeg|jpe'],
         $mime_types['gif'],
@@ -227,7 +275,6 @@ function oss_upload_attachments($metadata)
         $mime_types['tiff|tif'],
         $mime_types['webp'],
         $mime_types['ico'],
-        $mime_types['heic'],
     ];
     // 例如mp4等格式 上传后根据配置选择是否删除 删除后媒体库会显示默认图片 点开内容是正常的
     // 图片在缩略图处理
@@ -265,7 +312,7 @@ function oss_upload_thumbs($metadata)
     $upload_path = oss_get_option('upload_path');
 
     //获取oss插件的配置信息
-    $oss_options = get_option('oss_options', true);
+    $oss_options = get_option('oss_options', oss_get_default_options());
     $no_local_file = esc_attr($oss_options['nolocalsaving']) == 'true';
     $no_thumb = esc_attr($oss_options['nothumb']) == 'true';
 
@@ -348,12 +395,11 @@ if (substr_count($_SERVER['REQUEST_URI'], '/update.php') <= 0) {
  */
 function oss_delete_remote_attachment($post_id)
 {
+    $wp_uploads = wp_upload_dir();
+    $basedir = $wp_uploads['basedir'];
+    $upload_path = str_replace(get_home_path(), '', $basedir);
     // 获取图片类附件的meta信息
     $meta = wp_get_attachment_metadata($post_id);
-    $upload_path = oss_get_option('upload_path');
-    if ($upload_path == '') {
-        $upload_path = 'wp-content/uploads';
-    }
 
     if (!empty($meta['file'])) {
         $deleteObjects = [];
@@ -376,6 +422,13 @@ function oss_delete_remote_attachment($post_id)
             }
         }
 
+        $backup_sizes = get_post_meta($post_id, '_wp_attachment_backup_sizes', true);
+        if (is_array($backup_sizes)) {
+            foreach ($backup_sizes as $size) {
+                $deleteObjects[] = $dirname . $size['file'];
+            }
+        }
+
         oss_delete_oss_files($deleteObjects);
     } else {
         // 获取链接删除
@@ -387,7 +440,7 @@ function oss_delete_remote_attachment($post_id)
                     oss_delete_oss_file($upload_path . end($file_info));
                 }
             } else {
-                $oss_options = get_option('oss_options', true);
+                $oss_options = get_option('oss_options', oss_get_default_options());
                 $oss_upload_url = esc_attr($oss_options['upload_url_path']);
                 $file_info = explode($oss_upload_url, $link);
                 if (count($file_info) >= 2) {
@@ -400,19 +453,19 @@ function oss_delete_remote_attachment($post_id)
 add_action('delete_attachment', 'oss_delete_remote_attachment');
 
 // 当upload_path为根目录时，需要移除URL中出现的“绝对路径”
-function oss_modefiy_img_url($url, $post_id)
+function oss_modify_img_url($url, $post_id)
 {
     // 移除 ./ 和 项目根路径
     return str_replace(['./', get_home_path()], '', $url);
 }
 
 if (oss_get_option('upload_path') == '.') {
-    add_filter('wp_get_attachment_url', 'oss_modefiy_img_url', 30, 2);
+    add_filter('wp_get_attachment_url', 'oss_modify_img_url', 30, 2);
 }
 
 function oss_sanitize_file_name($filename)
 {
-    $oss_options = get_option('oss_options');
+    $oss_options = get_option('oss_options', oss_get_default_options());
     switch ($oss_options['update_file_name']) {
         case 'md5':
             return md5($filename) . '.' . pathinfo($filename, PATHINFO_EXTENSION);
@@ -438,7 +491,7 @@ function oss_read_dir_queue($homePath, $uploadPath)
     $foundFiles = [];
 
     while (!$dirsToProcess->isEmpty()) {
-        list($currentDir, $relativeDir) = $dirsToProcess->dequeue();
+        [$currentDir, $relativeDir] = $dirsToProcess->dequeue();
 
         foreach (new DirectoryIterator($currentDir) as $fileInfo) {
             if ($fileInfo->isDot()) continue;
@@ -468,7 +521,7 @@ function oss_plugin_action_links($links, $file)
 {
     if ($file == plugin_basename(dirname(__FILE__) . '/aliyun-oss-wordpress.php')) {
         $links[] = '<a href="options-general.php?page=' . OSS_BASEFOLDER . '/aliyun-oss-wordpress.php">设置</a>';
-        $links[] = '<a href="https://qq52o.me/sponsor.html" target="_blank">赞赏</a>';
+        $links[] = '<a href="https://donate.qq52o.me" target="_blank">Donate</a>';
     }
     return $links;
 }
@@ -476,7 +529,7 @@ add_filter('plugin_action_links', 'oss_plugin_action_links', 10, 2);
 
 function oss_custom_image_srcset($sources, $size_array, $image_src, $image_meta, $attachment_id)
 {
-    $option = get_option('oss_options');
+    $option = get_option('oss_options', oss_get_default_options());
     $style = !empty($option['style']) ? esc_attr($option['style']) : '';
     $upload_url_path = esc_attr($option['upload_url_path']);
     if (empty($style)) {
@@ -484,6 +537,9 @@ function oss_custom_image_srcset($sources, $size_array, $image_src, $image_meta,
     }
 
     foreach ($sources as $index => $source) {
+        if (!isset($source['url']) || !oss_is_image_type($source['url'])) {
+            continue;
+        }
         if (strpos($source['url'], $upload_url_path) !== false && strpos($source['url'], $style) === false) {
             $sources[$index]['url'] .= $style;
         }
@@ -494,10 +550,27 @@ function oss_custom_image_srcset($sources, $size_array, $image_src, $image_meta,
 
 add_filter('wp_calculate_image_srcset', 'oss_custom_image_srcset', 10, 5);
 
+add_filter('wp_prepare_attachment_for_js', 'oss_wp_prepare_attachment_for_js', 10);
+function oss_wp_prepare_attachment_for_js($response)
+{
+    if (empty($response['filesizeInBytes']) || empty($response['filesizeHumanReadable'])) {
+        $upload_url_path = get_option('upload_url_path');
+        $upload_path = get_option('upload_path');
+        $object = str_replace($upload_url_path, $upload_path, $response['url']);
+        $meta = oss_get_file_meta($object);
+        if (!empty($meta['content-length'])) {
+            $response['filesizeInBytes'] = $meta['content-length'];
+            $response['filesizeHumanReadable'] = size_format($meta['content-length']);
+        }
+    }
+
+    return $response;
+}
+
 add_filter('the_content', 'oss_setting_content_style');
 function oss_setting_content_style($content)
 {
-    $option = get_option('oss_options');
+    $option = get_option('oss_options', oss_get_default_options());
     $upload_url_path = esc_attr($option['upload_url_path']);
     if (!empty($option['style'])) {
         $style = esc_attr($option['style']);
@@ -505,10 +578,15 @@ function oss_setting_content_style($content)
         if (!empty($images) && isset($images[1])) {
             $images[1] = array_unique($images[1]);
             foreach ($images[1] as $item) {
+                if (!oss_is_image_type($item)) {
+                    continue;
+                }
                 if (strpos($item, $upload_url_path) !== false && strpos($item, $style) === false) {
                     $content = str_replace($item, $item . $style, $content);
                 }
             }
+
+            $content = str_replace($style . $style, $style, $content);
         }
     }
     return $content;
@@ -517,7 +595,7 @@ function oss_setting_content_style($content)
 add_filter('post_thumbnail_html', 'oss_setting_post_thumbnail_style', 10, 3);
 function oss_setting_post_thumbnail_style($html, $post_id, $post_image_id)
 {
-    $option = get_option('oss_options');
+    $option = get_option('oss_options', oss_get_default_options());
     $upload_url_path = esc_attr($option['upload_url_path']);
     if (!empty($option['style']) && has_post_thumbnail()) {
         $style = esc_attr($option['style']);
@@ -525,15 +603,25 @@ function oss_setting_post_thumbnail_style($html, $post_id, $post_image_id)
         if (!empty($images) && isset($images[1])) {
             $images[1] = array_unique($images[1]);
             foreach ($images[1] as $item) {
+                if (!oss_is_image_type($item)) {
+                    continue;
+                }
                 if (strpos($item, $upload_url_path) !== false && strpos($item, $style) === false) {
                     $html = str_replace($item, $item . $style, $html);
                 }
             }
+
+            $html = str_replace($style . $style, $style, $html);
         }
     }
     return $html;
 }
 
+/**
+ * @link https://help.aliyun.com/zh/oss/user-guide/regions-and-endpoints
+ * @param string $regional
+ * @return void
+ */
 function oss_get_regional($regional)
 {
     $options = [
@@ -577,7 +665,7 @@ function oss_get_regional($regional)
 
     foreach ($options as $value => $text) {
         $selected = ($regional == $value) ? 'selected="selected"' : '';
-        echo "<option value=\"{$value}\" {$selected}>{$text}</option>";
+        echo "<option value='{$value}' {$selected}>{$text}</option>";
     }
 }
 
@@ -586,6 +674,91 @@ function oss_get_option($key)
     return esc_attr(get_option($key));
 }
 
+$oss_options = get_option('oss_options', oss_get_default_options());
+if (!empty($oss_options['origin_protect']) && esc_attr($oss_options['origin_protect']) === 'on' && !empty(esc_attr($oss_options['style']))) {
+    add_filter('wp_get_attachment_url', 'oss_add_suffix_to_attachment_url', 10, 2);
+    add_filter('wp_get_attachment_thumb_url', 'oss_add_suffix_to_attachment_url', 10, 2);
+    add_filter('wp_get_original_image_url', 'oss_add_suffix_to_attachment_url', 10, 2);
+    add_filter('wp_prepare_attachment_for_js', 'oss_add_suffix_to_attachment', 10, 2);
+    add_filter('image_get_intermediate_size', 'oss_add_suffix_for_media_send_to_editor');
+}
+
+/**
+ * @param string $url
+ * @param int $post_id
+ * @return string
+ */
+function oss_add_suffix_to_attachment_url($url, $post_id)
+{
+    if (oss_is_image_type($url)) {
+        $url .= oss_get_image_style();
+    }
+
+    return $url;
+}
+
+/**
+ * @param array $response
+ * @param array $attachment
+ * @return array
+ */
+function oss_add_suffix_to_attachment($response, $attachment)
+{
+    if ($response['type'] != 'image') {
+        return $response;
+    }
+
+    $style = oss_get_image_style();
+    if (!empty($response['sizes'])) {
+        foreach ($response['sizes'] as $size_key => $size_file) {
+            if (oss_is_image_type($size_file['url'])) {
+                $response['sizes'][$size_key]['url'] .= $style;
+            }
+        }
+    }
+
+    if(!empty($response['originalImageURL'])) {
+        if (oss_is_image_type($response['originalImageURL'])) {
+            $response['originalImageURL'] .= $style;
+        }
+    }
+
+    return $response;
+}
+
+/**
+ * @param array $data
+ * @return array
+ */
+function oss_add_suffix_for_media_send_to_editor($data)
+{
+    // https://github.com/WordPress/wordpress-develop/blob/43d2455dc68072fdd43c3c800cc8c32590f23cbe/src/wp-includes/media.php#L239
+    if (oss_is_image_type($data['file'])) {
+        $data['file'] .= oss_get_image_style();
+    }
+
+    return $data;
+}
+
+/**
+ * @param string $url
+ * @return bool
+ */
+function oss_is_image_type($url)
+{
+    return (bool) preg_match('/\.(jpg|jpeg|jpe|png|bmp|webp|heic|heif|svg)$/i', $url);
+}
+
+/**
+ * @return string
+ */
+function oss_get_image_style()
+{
+    $oss_options = get_option('oss_options', oss_get_default_options());
+
+    return esc_attr($oss_options['style']);
+}
+
 // 在导航栏“设置”中添加条目
 function oss_add_setting_page()
 {
@@ -600,8 +773,15 @@ function oss_setting_page()
     if (!current_user_can('manage_options')) {
         wp_die('Insufficient privileges!');
     }
+    if (!empty($_POST) && !empty($_POST['type'])) {
+        $nonce = $_POST["{$_POST['type']}-nonce"] ?? '';
+        if (empty($nonce) || !wp_verify_nonce($nonce, $_POST['type'])) {
+            wp_die('Illegal requests!');
+        }
+    }
+
     $options = [];
-    if (!empty($_POST) and $_POST['type'] == 'oss_set') {
+    if (!empty($_POST) && $_POST['type'] == 'aliyun_oss_set') {
         $options['bucket'] = isset($_POST['bucket']) ? sanitize_text_field($_POST['bucket']) : '';
         $options['regional'] = isset($_POST['regional']) ? sanitize_text_field($_POST['regional']) : '';
         $options['role_name'] = isset($_POST['role_name']) ? sanitize_text_field($_POST['role_name']) : '';
@@ -610,10 +790,12 @@ function oss_setting_page()
         $options['is_internal'] = isset($_POST['is_internal']) ? 'true' : 'false';
         $options['nothumb'] = isset($_POST['nothumb']) ? 'true' : 'false';
         $options['nolocalsaving'] = isset($_POST['nolocalsaving']) ? 'true' : 'false';
-        //仅用于插件卸载时比较使用
         $options['upload_url_path'] = isset($_POST['upload_url_path']) ? sanitize_text_field(stripslashes($_POST['upload_url_path'])) : '';
         $options['style'] = isset($_POST['style']) ? sanitize_text_field($_POST['style']) : '';
         $options['update_file_name'] = isset($_POST['update_file_name']) ? sanitize_text_field($_POST['update_file_name']) : 'false';
+        $options['origin_protect'] = isset($_POST['origin_protect']) ? sanitize_text_field($_POST['origin_protect']) : 'off';
+
+        $options['origin_region'] = in_array($options['regional'], ['oss-accelerate', 'oss-accelerate-overseas']) ? '' : $options['regional'];
 
         if ($options['regional'] === 'oss-rg-china-mainland' && $options['is_internal'] === 'true') {
             echo '<div class="error"><p><strong>无地域属性不支持内网，请重新填写配置！</strong></p></div>';
@@ -621,7 +803,7 @@ function oss_setting_page()
         }
     }
 
-    if (!empty($_POST) and $_POST['type'] == 'aliyun_oss_all') {
+    if (!empty($_POST) && $_POST['type'] == 'aliyun_oss_all') {
         $files = oss_read_dir_queue(get_home_path(), oss_get_option('upload_path'));
         foreach ($files as $file) {
             oss_file_upload($file['key'], $file['filepath']);
@@ -630,20 +812,24 @@ function oss_setting_page()
     }
 
     // 替换数据库链接
-    if(!empty($_POST) and $_POST['type'] == 'aliyun_oss_replace') {
+    if(!empty($_POST) && $_POST['type'] == 'aliyun_oss_replace') {
         $old_url = esc_url_raw($_POST['old_url']);
         $new_url = esc_url_raw($_POST['new_url']);
 
-        global $wpdb;
-        $posts_name = $wpdb->prefix . 'posts';
-        // 文章内容
-        $posts_result = $wpdb->query("UPDATE $posts_name SET post_content = REPLACE(post_content, '$old_url', '$new_url')");
+        if (!empty($old_url)) {
+            global $wpdb;
+            $posts_name = $wpdb->prefix . 'posts';
+            // 文章内容
+            $posts_result = $wpdb->query($wpdb->prepare("UPDATE $posts_name SET post_content = REPLACE(post_content, '%s', '%s')", [$old_url, $new_url]));
 
-        // 修改题图之类的
-        $postmeta_name = $wpdb->prefix . 'postmeta';
-        $postmeta_result = $wpdb->query("UPDATE $postmeta_name SET meta_value = REPLACE(meta_value, '$old_url', '$new_url')");
+            // 修改题图之类的
+            $postmeta_name = $wpdb->prefix . 'postmeta';
+            $postmeta_result = $wpdb->query($wpdb->prepare("UPDATE $postmeta_name SET meta_value = REPLACE(meta_value, '%s', '%s')", [$old_url, $new_url]));
 
-        echo '<div class="updated"><p><strong>替换成功！共替换文章内链'.$posts_result.'条、题图链接'.$postmeta_result.'条！</strong></p></div>';
+            echo '<div class="updated"><p><strong>替换成功！共替换文章内链'.$posts_result.'条、题图链接'.$postmeta_result.'条！</strong></p></div>';
+        } else {
+            echo '<div class="error"><p><strong>请填写资源链接URL地址！</strong></p></div>';
+        }
     }
 
     // 若$options不为空数组，则更新数据
@@ -659,19 +845,16 @@ function oss_setting_page()
         echo '<div class="updated"><p><strong>设置已保存！</strong></p></div>';
     }
 
-    $oss_options = get_option('oss_options', true);
+    $oss_options = get_option('oss_options', oss_get_default_options());
 
     $oss_regional = esc_attr($oss_options['regional']);
 
-    $oss_is_internal = esc_attr($oss_options['is_internal']);
-    $oss_is_internal = $oss_is_internal == 'true';
+    $oss_is_internal = esc_attr($oss_options['is_internal']) == 'true';
+    $oss_nothumb = esc_attr($oss_options['nothumb']) == 'true';
+    $oss_nolocalsaving = esc_attr($oss_options['nolocalsaving']) == 'true';
 
-    $oss_nothumb = esc_attr($oss_options['nothumb']);
-    $oss_nothumb = $oss_nothumb == 'true';
-
-    $oss_nolocalsaving = esc_attr($oss_options['nolocalsaving']);
-    $oss_nolocalsaving = $oss_nolocalsaving == 'true';
     $oss_update_file_name = esc_attr($oss_options['update_file_name']);
+    $oss_origin_protect = esc_attr($oss_options['origin_protect'] ?? 'off') !== 'off' ? 'checked="checked"' : '';
 
     $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? 'https://' : 'http://';
 ?>
@@ -679,14 +862,14 @@ function oss_setting_page()
         <h1>阿里云 OSS <span style="font-size: 13px;">当前版本：<?php echo OSS_VERSION; ?></span></h1>
         <p>如果觉得此插件对你有所帮助，不妨到 <a href="https://github.com/sy-records/aliyun-oss-wordpress" target="_blank">GitHub</a> 上点个<code>Star</code>，<code>Watch</code>关注更新；<a href="https://go.qq52o.me/qm/ccs" target="_blank">欢迎加入云存储插件交流群，QQ群号：887595381</a>；</p>
         <hr/>
-        <form name="form1" method="post">
+        <form method="post">
             <table class="form-table">
                 <tr>
                     <th>
                         <legend>Bucket名称</legend>
                     </th>
                     <td>
-                        <input type="text" name="bucket" value="<?php echo esc_attr($oss_options['bucket']); ?>" size="50" placeholder="请填写Bucket名称"/>
+                        <input type="text" name="bucket" required value="<?php echo esc_attr($oss_options['bucket']); ?>" size="50" placeholder="请填写Bucket名称"/>
 
                         <p>请先访问 <a href="https://oss.console.aliyun.com/bucket" target="_blank">阿里云控制台</a> 创建<code>Bucket</code>，再填写以上内容。</p>
                     </td>
@@ -715,14 +898,14 @@ function oss_setting_page()
                     <th>
                         <legend>AccessKeyId</legend>
                     </th>
-                    <td><input type="text" name="accessKeyId" value="<?php echo esc_attr($oss_options['accessKeyId']); ?>" size="50" placeholder="AccessKeyId"/></td>
+                    <td><input type="text" name="accessKeyId" required value="<?php echo esc_attr($oss_options['accessKeyId']); ?>" size="50" placeholder="AccessKeyId"/></td>
                 </tr>
                 <tr>
                     <th>
                         <legend>AccessKeySecret</legend>
                     </th>
                     <td>
-                        <input type="password" name="accessKeySecret" value="<?php echo esc_attr($oss_options['accessKeySecret']); ?>" size="50" placeholder="AccessKeySecret"/>
+                        <input type="password" name="accessKeySecret" required value="<?php echo esc_attr($oss_options['accessKeySecret']); ?>" size="50" placeholder="AccessKeySecret"/>
                     </td>
                 </tr>
                 <tr>
@@ -748,8 +931,7 @@ function oss_setting_page()
                         <legend>不在本地保留备份</legend>
                     </th>
                     <td>
-                        <input type="checkbox"
-                               name="nolocalsaving" <?php echo $oss_nolocalsaving ? 'checked="checked"' : ''; ?> />
+                        <input type="checkbox" name="nolocalsaving" <?php echo $oss_nolocalsaving ? 'checked="checked"' : ''; ?> />
                         <p>建议不勾选</p>
                     </td>
                 </tr>
@@ -770,7 +952,7 @@ function oss_setting_page()
                         <legend>本地文件夹</legend>
                     </th>
                     <td>
-                        <input type="text" name="upload_path" value="<?php echo oss_get_option('upload_path'); ?>" size="50" placeholder="请输入上传文件夹"/>
+                        <input type="text" name="upload_path" required value="<?php echo oss_get_option('upload_path'); ?>" size="50" placeholder="请输入上传文件夹"/>
                         <p>附件在服务器上的存储位置，例如： <code>wp-content/uploads</code> （注意不要以“/”开头和结尾），根目录请输入<code>.</code>。</p>
                     </td>
                 </tr>
@@ -779,7 +961,7 @@ function oss_setting_page()
                         <legend>URL前缀</legend>
                     </th>
                     <td>
-                        <input type="text" name="upload_url_path" value="<?php echo oss_get_option('upload_url_path'); ?>" size="50" placeholder="请输入URL前缀"/>
+                        <input type="text" name="upload_url_path" required value="<?php echo oss_get_option('upload_url_path'); ?>" size="50" placeholder="请输入URL前缀"/>
 
                         <p><b>注意：</b></p>
 
@@ -810,12 +992,25 @@ function oss_setting_page()
                         <p>则填写为 <code>!stylename</code></p>
                     </td>
                 </tr>
+                <tr>
+                  <th>
+                    <legend>原图保护</legend>
+                  </th>
+                  <td>
+                    <input type="checkbox" name="origin_protect" <?php echo $oss_origin_protect; ?> />
+
+                    <p>开启原图保护功能后，存储桶中的图片文件仅能以带样式的 URL 进行访问，能够阻止恶意用户对源文件的请求。</p>
+                    <p>使用时请先访问阿里云对象存储控制台<b>开启原图保护</b>并设置<b>图片处理样式</b>！</p>
+                    <p>注：此功能为实验性功能，如遇错误或不可用，请关闭后联系作者反馈。</p>
+                  </td>
+                </tr>
                 <tr>
                     <th><legend>保存/更新选项</legend></th>
                     <td><input type="submit" class="button button-primary" value="保存更改"/></td>
                 </tr>
             </table>
-            <input type="hidden" name="type" value="oss_set">
+            <input type="hidden" name="type" value="aliyun_oss_set">
+            <?php wp_nonce_field('aliyun_oss_set', 'aliyun_oss_set-nonce'); ?>
         </form>
         <form method="post">
             <table class="form-table">
@@ -824,9 +1019,10 @@ function oss_setting_page()
                         <legend>同步历史附件</legend>
                     </th>
                     <input type="hidden" name="type" value="aliyun_oss_all">
+                    <?php wp_nonce_field('aliyun_oss_all', 'aliyun_oss_all-nonce'); ?>
                     <td>
                         <input type="submit" class="button button-secondary" value="开始同步"/>
-                        <p><b>注意：如果是首次同步，执行时间将会十分十分长（根据你的历史附件数量），有可能会因执行时间过长，页面显示超时或者报错。<br> 所以，建议那些几千上万附件的大神们，考虑官方的 <a target="_blank" rel="nofollow" href="https://help.aliyun.com/knowledge_detail/39628.html">同步工具</a></b></p>
+                        <p><b>注意：如果是首次同步，执行时间将会非常长（根据你的历史附件数量），有可能会因为执行时间过长，导致页面显示超时或者报错。<br> 所以，建议附件数量过多的用户，考虑官方的<a target="_blank" rel="nofollow" href="https://help.aliyun.com/knowledge_detail/39628.html">同步工具</a>或下载 WP-CLI 使用插件内置的命令进行上传。</b></p>
                     </td>
                 </tr>
             </table>
@@ -839,7 +1035,7 @@ function oss_setting_page()
                         <legend>数据库原链接替换</legend>
                     </th>
                     <td>
-                        <input type="text" name="old_url" size="50" placeholder="请输入要替换的旧域名"/>
+                        <input type="text" name="old_url" required size="50" placeholder="请输入要替换的旧域名"/>
                     </td>
                 </tr>
                 <tr>
@@ -855,6 +1051,7 @@ function oss_setting_page()
                         <legend></legend>
                     </th>
                     <input type="hidden" name="type" value="aliyun_oss_replace">
+                    <?php wp_nonce_field('aliyun_oss_replace', 'aliyun_oss_replace-nonce'); ?>
                     <td>
                         <input type="submit" class="button button-secondary" value="开始替换"/>
                         <p><b>注意：如果是首次替换，请注意备份！此功能会替换文章以及设置的特色图片（题图）等使用的资源链接</b></p>

oss-commands.php

@@ -0,0 +1,123 @@
+<?php
+
+if (!class_exists('WP_CLI')) {
+    return;
+}
+
+class OSS_CLI_Commands
+{
+    /**
+     * 同步文件夹到 OSS
+     *
+     * ## OPTIONS
+     *
+     * <path>
+     * : 要同步的文件夹
+     *
+     * ## EXAMPLES
+     *
+     *     wp oss upload wp-content/uploads
+     *
+     * @when after_wp_load
+     */
+    public function upload($args, $assoc_args)
+    {
+        [$path] = $args;
+        $dir = ABSPATH . $path;
+        if (!is_dir($dir)) {
+            WP_CLI::error("Directory not found: [{$dir}]");
+        }
+
+        WP_CLI::line("Uploading files from [{$dir}] to OSS...");
+
+        $files = oss_read_dir_queue(ABSPATH, $path);
+        if (empty($files)) {
+            WP_CLI::success('No files to upload.');
+            return;
+        }
+
+        foreach ($files as $file) {
+            $status = oss_file_upload($file['key'], $file['filepath']);
+            if ($status) {
+                WP_CLI::line("Uploaded: {$file['key']}");
+            } else {
+                WP_CLI::line("Failed: {$file['key']}");
+            }
+        }
+
+        $total = count($files);
+        WP_CLI::success("Uploaded {$total} files.");
+    }
+
+    /**
+     * 同步文件到 OSS
+     *
+     * ## OPTIONS
+     *
+     * <path>
+     * : 要同步的文件
+     *
+     * [--delete]
+     * : 如果设置，上传后会删除本地文件
+     * [--key=<key>]
+     * : 指定上传到 OSS 的 key，默认和文件路径一致
+     *
+     * ## EXAMPLES
+     *
+     *     wp oss upload-file wp-content/uploads/2021/01/1.jpg
+     *     wp oss upload-file wp-content/uploads/2021/01/1.jpg --delete
+     *     wp oss upload-file wp-content/uploads/2021/01/1.jpg --key=2021/01/1.jpg
+     *
+     * @when after_wp_load
+     * @subcommand upload-file
+     */
+    public function upload_file($args, $assoc_args)
+    {
+        [$path] = $args;
+        $file = ABSPATH . $path;
+        if (!is_file($file)) {
+            WP_CLI::error("File not found: {$file}");
+        }
+
+        $delete = false;
+        if (isset($assoc_args['delete'])) {
+            $delete = true;
+        }
+
+        $key = isset($assoc_args['key']) ? $assoc_args['key'] : $path;
+
+        WP_CLI::line("Uploading file [{$file}] to OSS with key [$key]...");
+
+        $status = oss_file_upload("/{$key}", $file, $delete);
+        if ($status) {
+            WP_CLI::success("Uploaded: {$path}");
+        } else {
+            WP_CLI::error("Failed: {$path}");
+        }
+    }
+
+    /**
+     * 删除 OSS 中的文件
+     *
+     * ## OPTIONS
+     *
+     * <key>
+     * : 需要删除 OSS 中的文件 key
+     *
+     * ## EXAMPLES
+     *
+     *     wp oss delete-file 2021/01/1.jpg
+     *
+     * @when after_wp_load
+     * @subcommand delete-file
+     */
+    public function delete_file($args, $assoc_args)
+    {
+        [$key] = $args;
+        WP_CLI::line("Deleting file [{$key}] from OSS...");
+
+        oss_delete_oss_file($key);
+    }
+}
+
+WP_CLI::add_command('oss', 'OSS_CLI_Commands', ['shortdesc' => 'Commands used to operate OSS.']);

readme.txt

@@ -2,18 +2,18 @@
 Contributors: shenyanzhi
 Donate link: https://qq52o.me/sponsor.html
 Tags: oss, 阿里云, 对象存储, aliyun
-Requires at least: 4.2
-Tested up to: 6.4
-Requires PHP: 7.0
-Stable tag: 1.4.7
+Requires at least: 4.6
+Tested up to: 6.8
+Requires PHP: 7.1
+Stable tag: 1.5.1
 License: Apache2.0
 License URI: http://www.apache.org/licenses/LICENSE-2.0.html
 
-使用阿里云对象存储 OSS 作为附件存储空间。（This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.）
+使用阿里云对象存储 OSS 作为附件存储空间。(This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.)
 
 == Description ==
 
-使用阿里云对象存储 OSS 作为附件存储空间。（This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.）
+使用阿里云对象存储 OSS 作为附件存储空间。(This is a plugin that uses Aliyun Object Storage Service for attachments remote saving.)
 
 - 依赖阿里云 OSS 服务：https://www.aliyun.com/product/oss
 
@@ -27,8 +27,12 @@ License URI: http://www.apache.org/licenses/LICENSE-2.0.html
 6. 支持同步历史附件到阿里云对象存储 OSS
 7. 支持阿里云 OSS 图片处理
 8. 支持上传文件自动重命名
-9. 支持使用 RAM 操作
-10. 插件更多详细介绍和安装：[https://github.com/sy-records/aliyun-oss-wordpress](https://github.com/sy-records/aliyun-oss-wordpress)
+9. 支持使用 ECS 的 RAM 操作
+10. 支持原图保护
+11. 支持 `wp-cli` 命令上传/删除文件
+12. 支持多站点
+13. 支持图片裁剪编辑等操作后的上传
+14. 插件更多详细介绍和安装：[https://github.com/sy-records/aliyun-oss-wordpress](https://github.com/sy-records/aliyun-oss-wordpress)
 
 ## 其他插件
 
@@ -53,6 +57,7 @@ License URI: http://www.apache.org/licenses/LICENSE-2.0.html
 
 1. 设置页面
 2. 数据库同步
+3. 内置的 wp-cli 命令
 
 == Frequently Asked Questions ==
 
@@ -73,6 +78,75 @@ License URI: http://www.apache.org/licenses/LICENSE-2.0.html
 
 == Changelog ==
 
+= 1.5.1 =
+
+- Update nonce handling for form submissions
+
+= 1.5.0 =
+
+- Enhance region handling for OSS configuration
+
+= 1.4.21 =
+
+- Optimize uninstall code
+
+= 1.4.20 =
+
+- Fix origin_protect default value error
+
+= 1.4.19 =
+
+- Fix sub-site failure to delete remote images
+- Fix `get_option` default value error
+- Fix missing delete backup images
+
+= 1.4.18 =
+
+- Images processing ignore gif format
+
+= 1.4.17 =
+
+- Fix endpoint failed to use https
+
+= 1.4.16 =
+
+- 强制 endpoint 使用 https
+
+= 1.4.15 =
+
+- 将阿里云V1签名升级为V4签名
+
+= 1.4.14 =
+
+- 支持 `wp-cli` 命令删除文件
+- Use wp_get_mime_types instead of get_allowed_mime_types
+- 修复 heic 格式图片上传失败问题
+
+= 1.4.13 =
+
+- 支持 `wp-cli` 命令上传文件
+
+= 1.4.12 =
+
+- 支持原图保护
+
+= 1.4.11 =
+
+- 优化数据库数据替换语法
+
+= 1.4.10 =
+
+- 修复`不在本地保留备份`时获取不到非图片文件大小
+
+= 1.4.9 =
+
+- 升级 SDK
+- 增加 CSRF 验证
+
+= 1.4.8 =
+
+- 修复图片处理参数重复添加
+
 = 1.4.7 =
 
 - 修复 `upload_url_path` 设置为 `.` 时删除失败

sdk/composer.json

@@ -1,6 +1,6 @@
 {
     "require": {
-        "aliyuncs/oss-sdk-php": "^2.3",
+        "aliyuncs/oss-sdk-php": "^2.7",
         "alibabacloud/credentials": "^1.1"
     }
 }

uninstall.php

@@ -1,18 +1,8 @@
 <?php
 
-//防止有人恶意访问此文件，所以在没有 WP_UNINSTALL_PLUGIN 常量的情况下结束程序
 if (!defined('WP_UNINSTALL_PLUGIN')) {
-    exit();
+    exit;
 }
 
-$obs_options = get_option('oss_options', true);
-$upload_url_path = get_option('upload_url_path');
-$oss_upload_url_path = esc_attr($obs_options['upload_url_path']);
-
-//如果现在使用的是OSS的URL，则恢复原状
-if ($upload_url_path == $oss_upload_url_path) {
-    update_option('upload_url_path', '');
-}
-
-//移除配置
+update_option('upload_url_path', '');
 delete_option('oss_options');