sync: 同步 v1.0.4 并脱敏配置与镜像

server/internal/router/router.go

@@ -1,23 +1,36 @@
 // package router
 // @Link  https://github.com/xiujiecn/xiu-admin
 // @Copyright  Copyright (c) 2025 LiXiujie
-// @Author  Lxj <li@xiujie.cn>
+// @Author  Lxj <xxx@example.com>
 // @License  https://github.com/xiujiecn/xiu-admin/blob/master/LICENSE
 package router
 
 import (
 	"context"
 	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/service"
+	"net/http"
 	"os"
+	"path"
 	"path/filepath"
+	"regexp"
 	"strings"
 
 	"github.com/gogf/gf/v2/frame/g"
 	"github.com/gogf/gf/v2/net/ghttp"
 )
 
+var legacyExportStaticPath = regexp.MustCompile(`(?i)^/(?:app/)?upload/(?:[^/]+/)?user/file/(?:[^/]+/)?export(?:/|$)`)
+
 // InitRouter 初始化路由
 func InitRouter(ctx context.Context, s *ghttp.Server) {
+	// Run before static serving as well as API routing; legacy export files must
+	// never bypass download-center authorization through the upload mount.
+	s.BindHookHandler("/*", ghttp.HookBeforeServe, func(r *ghttp.Request) {
+		if legacyExportStaticPath.MatchString(path.Clean(strings.ReplaceAll(r.URL.Path, `\`, "/"))) {
+			r.Response.WriteStatus(http.StatusNotFound)
+			r.ExitAll()
+		}
+	})
 	uploadPath := g.Cfg().MustGet(ctx, "system.upload.local.path").String()
 	if uploadPath != "" {
 		s.AddStaticPath("/upload", resolveUploadStaticPath(uploadPath))