评论安全验证

app/common/service/PostCommentService.php

@@ -4,6 +4,7 @@ namespace app\common\service;
 
 use app\common\model\MessageNotice;
 use app\common\model\Post;
+use app\common\model\User;
 use app\common\validate\PostCommentValidate;
 use app\common\traits\crud\CrudServiceTrait;
 use app\common\model\PostComment;
@@ -114,6 +115,20 @@ class PostCommentService
             }
         }
 
+        //安全检查
+        $wechat = new WechatService();
+        $tokenData =  $wechat->getMiniAccessToken();
+        $access_token = $tokenData['access_token'];
+
+        $user = User::where('id', $request->user->uid)->first();
+
+        if(empty($user)){
+            throw new \Exception('用户不存在');
+        }
+
+        $tokenData =  $wechat->checkText($data['content'], $user['openid'], $access_token, 2);
+//        $tokenData =  $wechat->checkText($data['content'], 'o8W4t5cRtq2LuOJUxvBGWQA6HJKQ', $access_token, 2);
+
         return $data;
     }
 

app/common/service/WechatService.php

@@ -6,6 +6,8 @@ use app\common\model\User;
 
 use EasyWeChat\MiniApp\Application as xcxApplication;
 use EasyWeChat\OpenPlatform\Application;
+use Exception;
+use support\Log;
 use support\Redis;
 use GuzzleHttp\Client;
 use support\exception\BusinessException;
@@ -233,4 +235,155 @@ class WechatService
             throw new BusinessException($result['errmsg']);
         }
     }
+
+    /**
+     * 文本安全检测
+     * @param string $content 待检测文本内容
+     * @param string $openid 用户openid（可选）
+     * @param string $scene 场景值（1-资料，2-评论，3-论坛，4-社交日志）
+     * @throws Exception
+     */
+    public function checkText($content, $openid, $accessToken, $scene = 1)
+    {
+        // 1. 参数校验
+        if (empty($content)) {
+            throw new Exception('检测内容不能为空');
+        }
+
+        // 2. 长度限制检查（API限制为2500字节）
+        $contentLength = strlen($content);
+        if ($contentLength > 2500) {
+            throw new Exception('文本内容过长，最大支持2500字节');
+        }
+
+        // 3. 构建请求数据
+        $requestData = [
+            'content' => $content,
+            'version' => 2, // 使用v2接口
+            'scene' => intval($scene), // 场景值
+            'openid' => $openid ?: ''
+        ];
+
+        // 4. 调用微信API
+        $apiUrl = "https://api.weixin.qq.com/wxa/msg_sec_check?access_token={$accessToken}";
+        $result = $this->httpPost($apiUrl, json_encode($requestData, JSON_UNESCAPED_UNICODE));
+
+        // 5. 解析响应
+        $response = json_decode($result, true);
+
+        if (empty($response)) {
+            throw new Exception('API响应解析失败');
+        }
+        // 6. 处理结果
+        if($response['errcode'] == 0){
+            foreach ($response['detail'] as $detail) {
+                if (isset($detail['suggest'])&& ($detail['suggest'] == 'risky' || $detail['suggest'] == 'review')){
+                    throw new Exception('内容含有违法违规内容');
+                }
+            }
+            return true;
+        }elseif($response['errcode'] == 87014){
+            throw new Exception('内容含有违法违规内容');
+        }
+        Log::info('checkText',[$response]);
+        return false;
+    }
+
+    /**
+     * 解析API响应结果
+     * @param array $response API响应
+     * @return array
+     */
+    private function parseResult($response)
+    {
+        $result = [
+            'success' => false,
+            'safe' => false,
+            'message' => '',
+            'errCode' => $response['errcode'] ?? -1,
+            'data' => $response
+        ];
+
+        // 错误码处理
+        switch ($response['errcode']) {
+            case 0:
+                // 检测通过
+                return true;
+                break;
+
+            case 87014:
+                // 风险内容
+                throw new Exception('内容含有违法违规内容');
+                break;
+
+            case 40001:
+                $result['message'] = 'access_token无效或已过期';
+                break;
+
+            case 40003:
+                $result['message'] = 'openid无效';
+                break;
+
+            case 40097:
+                $result['message'] = '参数错误';
+                break;
+
+            case 48001:
+                $result['message'] = '接口功能未授权，请确认小程序已开通此接口权限';
+                break;
+
+            default:
+                $result['message'] = $response['errmsg'] ?? '未知错误';
+                break;
+        }
+
+        // 如果有详细结果，添加到返回数据中
+        if (isset($response['result'])) {
+            $result['detail'] = $response['result'];
+        }
+
+        return $result;
+    }
+
+    /**
+     * HTTP POST请求
+     * @param string $url 请求地址
+     * @param string $data POST数据
+     * @return string 响应内容
+     * @throws Exception
+     */
+    private function httpPost($url, $data)
+    {
+        $ch = curl_init();
+
+        curl_setopt_array($ch, [
+            CURLOPT_URL => $url,
+            CURLOPT_POST => true,
+            CURLOPT_POSTFIELDS => $data,
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT => 10,
+            CURLOPT_SSL_VERIFYPEER => false,
+            CURLOPT_SSL_VERIFYHOST => false,
+            CURLOPT_HTTPHEADER => [
+                'Content-Type: application/json',
+                'Content-Length: ' . strlen($data)
+            ]
+        ]);
+
+        $response = curl_exec($ch);
+        $error = curl_error($ch);
+        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+
+        curl_close($ch);
+
+        if ($error) {
+            throw new Exception("HTTP请求失败: {$error}");
+        }
+
+        if ($httpCode !== 200) {
+            throw new Exception("HTTP状态码异常: {$httpCode}");
+        }
+
+        return $response;
+    }
 }