From db181482c6727c495a80765c3526a4f1eef2557f Mon Sep 17 00:00:00 2001
From: hajimi <phperbylyh@163.com>
Date: Sun, 2 Aug 2026 01:27:36 +0800
Subject: [PATCH] fix: protect paid post translations

---
 .../api/controller/CommunityController.php    | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/server/app/api/controller/CommunityController.php b/server/app/api/controller/CommunityController.php
index ab19971..e011469 100644
--- a/server/app/api/controller/CommunityController.php
+++ b/server/app/api/controller/CommunityController.php
@@ -57,17 +57,7 @@ class CommunityController extends BaseApiController
         $data['tags'] = $this->getPostTags($id);
 
         $isTrumpPost = $this->isTrumpPost($data['tags']);
-        if ($isTrumpPost && empty($ext['translated_content']) && !empty($data['content'])) {
-            $result = AiService::translateCommunityPost($data['content']);
-            if (!empty($result['success']) && !empty($result['content'])) {
-                $ext['translated_content'] = trim($result['content']);
-                CommunityPost::where('id', $id)->update([
-                    'ext' => json_encode($ext, JSON_UNESCAPED_UNICODE),
-                    'update_time' => time(),
-                ]);
-            }
-        }
-        $data['translated_content'] = $ext['translated_content'] ?? '';
+        $data['translated_content'] = '';
 
         // 付费帖权限控制
         $data['is_locked'] = false;
@@ -102,6 +92,21 @@ class CommunityController extends BaseApiController
             }
         }
 
+        // 锁定内容不生成或返回译文，避免通过翻译结果绕过付费权限
+        if (!$data['is_locked']) {
+            if ($isTrumpPost && empty($ext['translated_content']) && !empty($data['content'])) {
+                $result = AiService::translateCommunityPost($data['content']);
+                if (!empty($result['success']) && !empty($result['content'])) {
+                    $ext['translated_content'] = trim($result['content']);
+                    CommunityPost::where('id', $id)->update([
+                        'ext' => json_encode($ext, JSON_UNESCAPED_UNICODE),
+                        'update_time' => time(),
+                    ]);
+                }
+            }
+            $data['translated_content'] = $ext['translated_content'] ?? '';
+        }
+
         // 当前用户是否点赞
         $data['is_liked'] = false;
         $data['is_self'] = $this->userId && $this->userId == $data['user_id'];