fix: harden match live validation

qa/backend/test_match_live_backend_static.php

@@ -4,11 +4,14 @@ $root = dirname(__DIR__, 2);
 $servicePath = $root . '/server/app/common/service/match/MatchLiveService.php';
 $apiControllerPath = $root . '/server/app/api/controller/MatchController.php';
 $adminLogicPath = $root . '/server/app/adminapi/logic/match/MatchLogic.php';
+$listsPath = $root . '/server/app/adminapi/lists/match/MatchLiveLists.php';
+$matchLiveLogicPath = $root . '/server/app/adminapi/logic/match/MatchLiveLogic.php';
+$validatePath = $root . '/server/app/adminapi/validate/match/MatchLiveValidate.php';
 $backendChecks = [
     $root . '/server/app/adminapi/controller/match/MatchLiveController.php',
-    $root . '/server/app/adminapi/lists/match/MatchLiveLists.php',
+    $listsPath,
-    $root . '/server/app/adminapi/logic/match/MatchLiveLogic.php',
+    $matchLiveLogicPath,
-    $root . '/server/app/adminapi/validate/match/MatchLiveValidate.php',
+    $validatePath,
 ];
 
 if (!is_file($servicePath)) {
@@ -78,6 +81,69 @@ if (strpos($adminLogic, "'live_url'") !== false) {
     exit(1);
 }
 
+if (!is_file($listsPath)) {
+    fwrite(STDERR, "missing match live lists file\n");
+    exit(1);
+}
+
+$lists = file_get_contents($listsPath);
+foreach ([
+    "\$matchId = (int) (\$this->params['match_id'] ?? 0);",
+    "if (\$matchId <= 0) {",
+    "\$query->where('match_id', 0);",
+] as $needle) {
+    if (strpos($lists, $needle) === false) {
+        fwrite(STDERR, "missing lists guard token: {$needle}\n");
+        exit(1);
+    }
+}
+
+if (!is_file($matchLiveLogicPath)) {
+    fwrite(STDERR, "missing match live logic file\n");
+    exit(1);
+}
+
+$matchLiveLogic = file_get_contents($matchLiveLogicPath);
+foreach ([
+    "'play_url_m3u8' => ''",
+    "'play_url_hd_m3u8' => ''",
+    "'play_url_flv' => ''",
+    "'play_url_hd_flv' => ''",
+    "'fetch_status' => 0",
+    "'fetch_error' => ''",
+    "'last_fetch_at' => 0",
+    "'next_fetch_at' => \$now",
+] as $needle) {
+    if (strpos($matchLiveLogic, $needle) === false) {
+        fwrite(STDERR, "missing match live logic reset token: {$needle}\n");
+        exit(1);
+    }
+}
+
+if (!is_file($validatePath)) {
+    fwrite(STDERR, "missing match live validate file\n");
+    exit(1);
+}
+
+$validate = file_get_contents($validatePath);
+foreach ([
+    'checkTrimmedTitle',
+    'checkTrimmedSourceUrl',
+    '$value = trim((string) $value);',
+] as $needle) {
+    if (strpos($validate, $needle) === false) {
+        fwrite(STDERR, "missing trimmed validation token: {$needle}\n");
+        exit(1);
+    }
+}
+
+$childLivePos = strpos($apiController, "!empty(\$data['live_list'][0]['source_url'])");
+$worldCupFallbackPos = strpos($apiController, "if (empty(\$data['live_url']) && \$this->isWorldCupMatch(\$data))");
+if ($childLivePos === false || $worldCupFallbackPos === false || $childLivePos >= $worldCupFallbackPos) {
+    fwrite(STDERR, "match detail live_url fallback order mismatch\n");
+    exit(1);
+}
+
 $orderedOptionSnippets = [
     "['label' => 'M3U8', 'field' => 'play_url_m3u8']",
     "['label' => 'HD M3U8', 'field' => 'play_url_hd_m3u8']",

server/app/adminapi/validate/match/MatchLiveValidate.php

@@ -11,8 +11,8 @@ class MatchLiveValidate extends BaseValidate
     protected $rule = [
         'id' => 'require|integer|gt:0|checkLive',
         'match_id' => 'require|integer|gt:0|checkMatch',
-        'title' => 'require|length:1,255',
+        'title' => 'require|checkTrimmedTitle',
-        'source_url' => 'require|max:500',
+        'source_url' => 'require|checkTrimmedSourceUrl',
     ];
 
     protected $message = [
@@ -66,4 +66,28 @@ class MatchLiveValidate extends BaseValidate
         }
         return true;
     }
+
+    public function checkTrimmedTitle($value)
+    {
+        $value = trim((string) $value);
+        if ($value === '') {
+            return '直播标题不能为空';
+        }
+        if (mb_strlen($value) > 255) {
+            return '直播标题长度须在1-255位字符';
+        }
+        return true;
+    }
+
+    public function checkTrimmedSourceUrl($value)
+    {
+        $value = trim((string) $value);
+        if ($value === '') {
+            return '源地址不能为空';
+        }
+        if (mb_strlen($value) > 500) {
+            return '源地址长度不能超过500位字符';
+        }
+        return true;
+    }
 }