Merge commit 'ada88a1c02740846547eb2c3eaf37639006b3b57' into pro

app/Http/Controllers/Api/ProjectController.php

@@ -32,10 +32,11 @@
 use App\Models\WebSocketDialog;
 use App\Exceptions\ApiException;
 use App\Models\ProjectPermission;
-use App\Module\BillMultipleExport;
 use App\Models\WebSocketDialogMsg;
+use App\Module\BillMultipleExport;
 use Illuminate\Support\Facades\DB;
 use App\Models\ProjectTaskFlowChange;
+use App\Models\ProjectTaskVisibilityUser;
 
 /**
  * @apiDefine project
@@ -1032,15 +1033,20 @@ public function task__lists()
             $query->where('project_users.owner', 1);
             $query->where('project_users.userid', $userid);
         });
-        $builder->leftJoin('project_task_users as project_p_task_users', function ($query) use($userid) {
-            $query->on('project_p_task_users.task_pid', '=', 'project_tasks.parent_id');
-            $query->where('project_p_task_users.userid', $userid);
+        $builder->leftJoin('project_task_users as project_sub_task_users', function ($query) use($userid) {
+            $query->on('project_sub_task_users.task_pid', '=', 'project_tasks.parent_id');
+            $query->where('project_sub_task_users.userid', $userid);
+        });
+        $builder->leftJoin('project_task_visibility_users', function ($query) use($userid) {
+            $query->on('project_task_visibility_users.task_id', '=', 'project_tasks.id');
+            $query->where('project_task_visibility_users.userid', $userid);
         });
         $builder->where(function ($query) use ($userid) {
             $query->where("project_tasks.visibility", 1);
             $query->orWhere("project_users.userid", $userid);
             $query->orWhere("project_task_users.userid", $userid);
-            $query->orWhere("project_p_task_users.userid", $userid);
+            $query->orWhere("project_task_visibility_users.userid", $userid);
+            $query->orWhere("project_sub_task_users.userid", $userid);
         });
         // 优化子查询汇总
         $builder->leftJoinSub(function ($query) {
@@ -1352,6 +1358,7 @@ public function task__export()
                 $base64 = base64_encode(Base::array2string([
                     'file' => $zipFile,
                 ]));
+                $fileUrl = Base::fillUrl('api/project/task/down?key=' . urlencode($base64));
                 Session::put('task::export:userid', $user->userid);
                 $botUser = User::botGetOrCreate('system-msg');
                 if (empty($botUser)) {
@@ -1364,7 +1371,7 @@ public function task__export()
                     $text .= "\n";
                     $text .= "文件大小：".Base::twoFloat(filesize($zipPath) / 1024, true)."KB";
                     $text .= "\n";
-                    $text .= "下载地址：".Base::fillUrl('api/project/task/down?key=' . urlencode($base64));
+                    $text .= '<button class="ivu-btn" style="margin-top: 10px;"><a href="'.$fileUrl.'" target="_blank">立即下载</a></button>';
                     WebSocketDialogMsg::sendMsg(null, $dialog->id, 'text', ['text' => $text], $botUser->userid, false, false, true);
                 }
             }
@@ -1537,17 +1544,19 @@ public function task__one()
         // 项目可见性
         $project_userid = ProjectUser::whereProjectId($task->project_id)->whereOwner(1)->value('userid');     // 项目负责人
         if ($task->visibility != 1 && $user->userid != $project_userid) {
-            $visibleUserids = ProjectTaskUser::whereTaskId($task_id)->pluck('userid')->toArray();       // 是否任务负责人、协助人、可见人
-            $subVisibleUserids = ProjectTaskUser::whereTaskPid($task_id)->pluck('userid')->toArray();   // 是否子任务负责人、协助人
-            if (!in_array($user->userid, $visibleUserids) && !in_array($user->userid, $subVisibleUserids)) {
+            $taskUserids = ProjectTaskUser::whereTaskId($task_id)->pluck('userid')->toArray();                //任务负责人、协助人
+            $subTaskUserids = ProjectTaskUser::whereTaskPid($task_id)->pluck('userid')->toArray();            //子任务负责人、协助人
+            $visibleUserids = ProjectTaskVisibilityUser::whereTaskId($task_id)->pluck('userid')->toArray();   //可见人
+            $visibleUserids = array_merge($taskUserids, $subTaskUserids, $visibleUserids);
+            if (!in_array($user->userid, $visibleUserids)) {
                 return Base::retError('无任务权限');
             }
         }
         //
         $data = $task->toArray();
         $data['project_name'] = $task->project?->name;
         $data['column_name'] = $task->projectColumn?->name;
-        $data['visibility_appointor'] = $task->visibility == 1 ? [0] : ProjectTaskUser::whereTaskId($task_id)->whereOwner(2)->pluck('userid');
+        $data['visibility_appointor'] = $task->visibility == 1 ? [0] : ProjectTaskVisibilityUser::whereTaskId($task_id)->pluck('userid');
         return Base::retSuccess('success', $data);
     }
 
@@ -1909,15 +1918,16 @@ public function task__update()
         }
         //
         $taskUser = ProjectTaskUser::select(['userid', 'owner'])->whereTaskId($task_id)->get();
-        $owners = $taskUser->where('owner', 1)->pluck('userid')->toArray();         // 负责人
-        $assists = $taskUser->where('owner', 0)->pluck('userid')->toArray();         // 协助人
+        $owners = $taskUser->where('owner', 1)->pluck('userid')->toArray();
+        $assists = $taskUser->where('owner', 0)->pluck('userid')->toArray();
+        $visible = ProjectTaskVisibilityUser::whereTaskId($task->id)->pluck('userid')->toArray();
         // 更新任务
         $updateMarking = [];
         $task->updateTask($param, $updateMarking);
         //
         $data = ProjectTask::oneTask($task->id)->toArray();
         $data['update_marking'] = $updateMarking ?: json_decode('{}');
-        $data['visibility_appointor'] = $data['visibility'] == 1 ? [] : ProjectTaskUser::whereTaskId($task->id)->whereOwner(2)->pluck('userid');
+        $data['visibility_appointor'] = $data['visibility'] == 1 ? [] : ProjectTaskVisibilityUser::whereTaskId($task->id)->pluck('userid');
         $task->pushMsg('update', $data);
         // 可见性推送
         if ($task->parent_id == 0) {
@@ -1927,10 +1937,9 @@ public function task__update()
                     $task->pushMsgVisibleAdd($data);
                 }
                 if ($param['visibility_appointor']) {
-                    $oldVisibleUserIds = $taskUser->where('owner', 2)->pluck('userid')->toArray() ?? [];
                     $newVisibleUserIds = $param['visibility_appointor'] ?? [];
-                    $deleteUserIds = array_diff($oldVisibleUserIds, $newVisibleUserIds, $subUserids);
-                    $addUserIds = array_diff($newVisibleUserIds, $oldVisibleUserIds);
+                    $deleteUserIds = array_diff($visible, $newVisibleUserIds, $subUserids);
+                    $addUserIds = array_diff($newVisibleUserIds, $visible);
                     $task->pushMsgVisibleUpdate($data, $deleteUserIds, $addUserIds);
                 }
                 if ($data['visibility'] != 1 && empty($param['visibility_appointor'])) {

app/Http/Controllers/Api/ReportController.php

@@ -13,7 +13,6 @@
 use App\Tasks\PushTask;
 use Carbon\Carbon;
 use Hhxsv5\LaravelS\Swoole\Task\Task;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Validation\Rule;
 use Request;

app/Http/Controllers/IndexController.php

@@ -321,6 +321,10 @@ public function online__preview()
         $data = parse_url($key);
         $path = Arr::get($data, 'path');
         $file = public_path($path);
+        // 防止 ../ 穿越获取到系统文件
+        if (strpos(realpath($file), public_path()) !== 0) {
+            return abort(404);
+        }
         //
         if (file_exists($file)) {
             parse_str($data['query'], $query);

app/Models/FileLink.php

@@ -8,7 +8,7 @@
  * App\Models\FileLink
  *
  * @property int $id
- * @property int|null $file_id 文件ID
+ * @property int|null $file_id 项目ID
  * @property int|null $num 累计访问
  * @property string|null $code 链接码
  * @property int|null $userid 会员ID

app/Models/Project.php

@@ -24,7 +24,6 @@
  * @property int|null $dialog_id 聊天会话ID
  * @property string|null $archived_at 归档时间
  * @property int|null $archived_userid 归档会员
- * @property int|null $is_fixed 是否固定
  * @property \Illuminate\Support\Carbon|null $created_at
  * @property \Illuminate\Support\Carbon|null $updated_at
  * @property \Illuminate\Support\Carbon|null $deleted_at
@@ -48,7 +47,6 @@
  * @method static \Illuminate\Database\Eloquent\Builder|Project whereDesc($value)
  * @method static \Illuminate\Database\Eloquent\Builder|Project whereDialogId($value)
  * @method static \Illuminate\Database\Eloquent\Builder|Project whereId($value)
- * @method static \Illuminate\Database\Eloquent\Builder|Project whereIsFixed($value)
  * @method static \Illuminate\Database\Eloquent\Builder|Project whereName($value)
  * @method static \Illuminate\Database\Eloquent\Builder|Project wherePersonal($value)
  * @method static \Illuminate\Database\Eloquent\Builder|Project whereUpdatedAt($value)

app/Models/ProjectFlowItem.php

@@ -13,7 +13,7 @@
  * @property string|null $name 名称
  * @property string|null $status 状态
  * @property array $turns 可流转
- * @property array $userids 状态负责人ID
+ * @property array $userids 自动负责人ID
  * @property string|null $usertype 流转模式
  * @property int|null $userlimit 限制负责人
  * @property int|null $columnid 对应的项目列表

app/Models/ProjectLog.php

@@ -10,7 +10,7 @@
  * @property int $id
  * @property int|null $project_id 项目ID
  * @property int|null $column_id 列表ID
- * @property int|null $task_id 任务ID
+ * @property int|null $task_id 项目ID
  * @property int|null $userid 会员ID
  * @property string|null $detail 详细信息
  * @property array $record 记录数据

app/Models/ProjectPermission.php

@@ -10,10 +10,9 @@
  *
  * @property int $id
  * @property int|null $project_id 项目ID
- * @property string|null $permissions 权限
+ * @property string $permissions 权限
  * @property \Illuminate\Support\Carbon|null $created_at
  * @property \Illuminate\Support\Carbon|null $updated_at
- * @property-read \App\Models\Project|null $project
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectPermission newModelQuery()
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectPermission newQuery()
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectPermission query()

app/Models/ProjectTask.php

@@ -2,15 +2,16 @@
 
 namespace App\Models;
 
-use App\Exceptions\ApiException;
-use App\Module\Base;
-use App\Tasks\PushTask;
+use DB;
 use Arr;
+use Request;
 use Carbon\Carbon;
-use DB;
+use App\Module\Base;
+use App\Tasks\PushTask;
+use App\Exceptions\ApiException;
 use Hhxsv5\LaravelS\Swoole\Task\Task;
+use App\Models\ProjectTaskVisibilityUser;
 use Illuminate\Database\Eloquent\SoftDeletes;
-use Request;
 
 /**
  * App\Models\ProjectTask
@@ -33,7 +34,6 @@
  * @property string|null $complete_at 完成时间
  * @property int|null $userid 创建人
  * @property int|null $visibility 任务可见性：1-项目人员 2-任务人员 3-指定成员
- * @property int|null $is_default 是否默认任务
  * @property int|null $p_level 优先级
  * @property string|null $p_name 优先级名称
  * @property string|null $p_color 优先级颜色
@@ -82,7 +82,6 @@
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereFlowItemId($value)
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereFlowItemName($value)
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereId($value)
- * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereIsDefault($value)
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereLoop($value)
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereLoopAt($value)
  * @method static \Illuminate\Database\Eloquent\Builder|ProjectTask whereName($value)
@@ -496,13 +495,12 @@ public static function addTask($data)
                 ])->save();
             }
 
+            // 可见性
             foreach ($visibility_userids as $uid) {
-                ProjectTaskUser::createInstance([
+                ProjectTaskVisibilityUser::createInstance([
                     'project_id' => $task->project_id,
                     'task_id' => $task->id,
-                    'task_pid' => $task->parent_id ?: $task->id,
-                    'userid' => $uid,
-                    'owner' => 2,
+                    'userid' => $uid
                 ])->save();
             }
 
@@ -729,16 +727,14 @@ public function updateTask($data, &$updateMarking = [])
                     ProjectTask::whereId($data['task_id'])->update(['visibility' => $data["visibility"]]);
                     ProjectTask::whereParentId($data['task_id'])->update(['visibility' => $data["visibility"]]);
                 }
-                ProjectTaskUser::whereTaskId($data['task_id'])->whereOwner(2)->delete();
+                ProjectTaskVisibilityUser::whereTaskId($data['task_id'])->delete();
                 if (Arr::exists($data, 'visibility_appointor')) {
                     foreach ($data['visibility_appointor'] as $uid) {
                         if ($uid) {
-                            ProjectTaskUser::createInstance([
+                            ProjectTaskVisibilityUser::createInstance([
                                 'project_id' => $this->project_id,
                                 'task_id' => $this->id,
-                                'task_pid' => $this->parent_id ?: $this->id,
-                                'userid' => $uid,
-                                'owner' => 2,
+                                'userid' => $uid
                             ])->save();
                         }
                     }
@@ -1521,7 +1517,10 @@ public function pushMsgVisibleAdd($data = null, array $pushUserIds = [])
         if ($pushUserIds) {
             $userids = $pushUserIds;
         } elseif ($this->visibility != 1) {
-            $userids = ProjectTaskUser::select(['userid', 'owner'])->whereTaskId($this->id)->orWhere('task_pid', '=', $this->id)->pluck('userid')->toArray();
+            $userids = ProjectTaskUser::whereTaskId($this->id)->orWhere('task_pid', '=', $this->id)->pluck('userid')->toArray();
+            if ($this->visibility == 3) {
+                $userids = array_merge($userids, ProjectTaskVisibilityUser::whereTaskId($this->id)->pluck('userid')->toArray());
+            }
         } else {
             $userids = ProjectUser::whereProjectId($this->project_id)->pluck('userid')->toArray();  // 项目成员
         }

app/Models/ProjectTaskVisibilityUser.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Models;
+
+/**
+ * App\Models\ProjectTaskVisibilityUser
+ *
+ * @property int $id
+ * @property int|null $project_id 项目ID
+ * @property int|null $task_id 任务ID
+ * @property int|null $userid 成员ID
+ * @property \Illuminate\Support\Carbon|null $created_at
+ * @property \Illuminate\Support\Carbon|null $updated_at
+ * @property-read \App\Models\ProjectTask|null $projectTask
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser newModelQuery()
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser newQuery()
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser query()
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser whereCreatedAt($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser whereId($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser whereProjectId($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser whereTaskId($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser whereUpdatedAt($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|ProjectTaskVisibilityUser whereUserid($value)
+ * @mixin \Eloquent
+ */
+class ProjectTaskVisibilityUser extends AbstractModel
+{
+
+    /**
+     * @return \Illuminate\Database\Eloquent\Relations\HasOne
+     */
+    public function projectTask(): \Illuminate\Database\Eloquent\Relations\HasOne
+    {
+        return $this->hasOne(ProjectTask::class, 'id', 'task_id');
+    }
+
+}

app/Models/WebSocketDialog.php

@@ -23,6 +23,7 @@
  * @property string|null $last_at 最后消息时间
  * @property int|null $owner_id 群主用户ID
  * @property int|null $link_id 关联id
+ * @property int|null $top_msg_id 置顶的消息ID
  * @property \Illuminate\Support\Carbon|null $created_at
  * @property \Illuminate\Support\Carbon|null $updated_at
  * @property \Illuminate\Support\Carbon|null $deleted_at
@@ -41,6 +42,7 @@
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog whereLinkId($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog whereName($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog whereOwnerId($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog whereTopMsgId($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog whereType($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog whereUpdatedAt($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialog withTrashed()

app/Models/WebSocketDialogMsg.php

@@ -31,9 +31,13 @@
  * @property int|null $modify 是否编辑
  * @property int|null $reply_num 有多少条回复
  * @property int|null $reply_id 回复ID
+ * @property int|null $forward_id 转发ID
+ * @property int|null $forward_num 被转发多少次
+ * @property int|null $forward_show 是否显示转发的来源
  * @property \Illuminate\Support\Carbon|null $created_at
  * @property \Illuminate\Support\Carbon|null $updated_at
  * @property \Illuminate\Support\Carbon|null $deleted_at
+ * @property-read \App\Models\WebSocketDialogMsg|null $forward_data
  * @property-read int|mixed $percentage
  * @property-read \App\Models\WebSocketDialogMsg|null $reply_data
  * @property-read \App\Models\WebSocketDialog|null $webSocketDialog
@@ -46,6 +50,9 @@
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereDialogId($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereDialogType($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereEmoji($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereForwardId($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereForwardNum($value)
+ * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereForwardShow($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereId($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereKey($value)
  * @method static \Illuminate\Database\Eloquent\Builder|WebSocketDialogMsg whereLink($value)
@@ -536,6 +543,9 @@ public function previewMsg($preserveHtml = false, $data = null)
             case 'tag':
                 $action = $data['msg']['action'] === 'remove' ? '取消标注' : '标注';
                 return "[{$action}] {$this->previewMsg(false, $data['msg']['data'])}";
+            case 'top':
+                $action = $data['msg']['action'] === 'remove' ? '取消置顶' : '置顶';
+                return "[{$action}] {$this->previewMsg(false, $data['msg']['data'])}";
             case 'todo':
                 $action = $data['msg']['action'] === 'remove' ? '取消待办' : ($data['msg']['action'] === 'done' ? '完成' : '设待办');
                 return "[{$action}] {$this->previewMsg(false, $data['msg']['data'])}";

app/Models/WebSocketDialogUser.php

@@ -14,7 +14,7 @@
  * @property int|null $mark_unread 是否标记为未读：0否，1是
  * @property int|null $silence 是否免打扰：0否，1是
  * @property int|null $inviter 邀请人
- * @property int|null $important 是否不可移出（项目、任务、部门人员）
+ * @property int|null $important 是否不可移出（项目、任务人员）
  * @property string|null $color 颜色
  * @property \Illuminate\Support\Carbon|null $created_at
  * @property \Illuminate\Support\Carbon|null $updated_at