geng

server/app/adminapi/logic/doctor/DoctorNoteLogic.php

@@ -25,8 +25,8 @@ class DoctorNoteLogic extends BaseLogic
                 ->find();
 
             $newContent = trim($params['content'] ?? '');
-            $newImages  = array_map([self::class, 'toRelativePath'], self::parseJsonArray($params['tongue_images'] ?? []));
-            $newReports = array_map([self::class, 'toRelativePath'], self::parseJsonArray($params['report_files'] ?? []));
+            $newImages  = self::normalizeNewAttachmentPaths($params['tongue_images'] ?? []);
+            $newReports = self::normalizeNewAttachmentPaths($params['report_files'] ?? []);
 
             if ($existing) {
                 $data = [];
@@ -169,15 +169,51 @@ class DoctorNoteLogic extends BaseLogic
      */
     private static function toRelativePath(string $url): string
     {
-        if (empty($url)) return $url;
-        if (stripos($url, 'http://') !== 0 && stripos($url, 'https://') !== 0) {
+        $url = trim($url);
+        if ($url === '') return $url;
+
+        $urlParts = parse_url($url);
+        if (!is_array($urlParts) || empty($urlParts['scheme'])) {
             return $url;
         }
+
+        $scheme = strtolower((string) $urlParts['scheme']);
+        if (!in_array($scheme, ['http', 'https'], true)) {
+            return $url;
+        }
+
         // 获取当前存储域名
-        $domain = self::getStorageDomain();
-        if ($domain && stripos($url, rtrim($domain, '/')) === 0) {
-            $relative = substr($url, strlen(rtrim($domain, '/')));
-            return ltrim($relative, '/');
+        $domain = rtrim(self::getStorageDomain(), '/');
+        $domainParts = $domain !== '' ? parse_url($domain) : false;
+        if (is_array($domainParts)) {
+            $domainScheme = strtolower((string) ($domainParts['scheme'] ?? ''));
+            $urlHost = strtolower(rtrim((string) ($urlParts['host'] ?? ''), '.'));
+            $domainHost = strtolower(rtrim((string) ($domainParts['host'] ?? ''), '.'));
+            $urlPort = (int) ($urlParts['port'] ?? ($scheme === 'https' ? 443 : 80));
+            $domainPort = (int) (
+                $domainParts['port'] ?? ($domainScheme === 'https' ? 443 : 80)
+            );
+            $urlPath = (string) ($urlParts['path'] ?? '');
+            $domainPath = rtrim((string) ($domainParts['path'] ?? ''), '/');
+            $pathInsideDomain = $domainPath === ''
+                || $urlPath === $domainPath
+                || str_starts_with($urlPath, $domainPath . '/');
+
+            if (
+                $domainScheme === $scheme
+                && $domainHost !== ''
+                && $domainHost === $urlHost
+                && $domainPort === $urlPort
+                && $pathInsideDomain
+            ) {
+                $relative = $domainPath === ''
+                    ? $urlPath
+                    : substr($urlPath, strlen($domainPath));
+                if (isset($urlParts['query']) && $urlParts['query'] !== '') {
+                    $relative .= '?' . $urlParts['query'];
+                }
+                return ltrim($relative, '/');
+            }
         }
         // 非当前存储域名，保留完整 URL
         return $url;
@@ -193,6 +229,36 @@ class DoctorNoteLogic extends BaseLogic
         return $storage ? ($storage['domain'] ?? '') : '';
     }
 
+    /**
+     * 备注附件只接受站内相对路径或当前存储域已上传的 URL。
+     * 存储域 URL 先转为相对路径，避免将任意外部 URL 持久化到病例页。
+     *
+     * @param mixed $value
+     * @return array<int, string>
+     */
+    private static function normalizeNewAttachmentPaths($value): array
+    {
+        $paths = [];
+        foreach (self::parseJsonArray($value) as $rawPath) {
+            $path = trim((string) $rawPath);
+            if ($path === '') {
+                continue;
+            }
+            $path = self::toRelativePath($path);
+            $scheme = parse_url($path, PHP_URL_SCHEME);
+            if (
+                (is_string($scheme) && $scheme !== '')
+                || str_starts_with($path, '//')
+                || str_contains($path, "\0")
+            ) {
+                throw new \InvalidArgumentException('备注附件必须来自当前文件存储域');
+            }
+            $paths[] = $path;
+        }
+
+        return array_values(array_unique($paths));
+    }
+
     private static function parseJsonArray($value): array
     {
         if (is_array($value)) return $value;