fix(security): harden uploads and wecom binding

2026-07-28 12:18:45 +08:00
parent 29e4e4a804
commit 6b43b77c3b
14 changed files with 185 additions and 84 deletions
@@ -140,12 +140,13 @@ async function handleDialogPhotoUpload(event: Event) {
    try {
      // Compress before upload to reduce storage & transfer
      const compressed = await compressImage(file, { maxPixels: 1920, quality: 0.8 })
-      // Get presigned URL
-      const presignRes = await api.post('/upload/presigned-url', null, { params: { filename: compressed.name, content_type: compressed.type || 'image/jpeg' } })
-      // Upload directly to MinIO (not through our API)
-      const axios = (await import('axios')).default
-      await axios.put(presignRes.data.upload_url, compressed, { headers: { 'Content-Type': compressed.type || 'image/jpeg' } })
-      const key = presignRes.data.object_key
+      const data = new FormData()
+      data.append('file', compressed)
+      const uploadRes = await api.post('/upload/image', data, {
+        headers: { 'Content-Type': 'multipart/form-data' },
+        timeout: 60000,
+      })
+      const key = uploadRes.data.object_key
      if (!form.value.photos) form.value.photos = []
      form.value.photos.push(key)
      form.value.photos = [...form.value.photos]