OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Domain/Setting/Controllers/EditBoxLabel.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace Leantime\Domain\Setting\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Setting\Permissions\SettingPermissions;
+use Leantime\Domain\Setting\Services\Setting as SettingService;
+
+class EditBoxLabel extends Controller
+{
+    private SettingService $settingsSvc;
+
+    /**
+     * init - initialize private variables
+     */
+    public function init(SettingService $settingsSvc): void
+    {
+        $this->settingsSvc = $settingsSvc;
+    }
+
+    /**
+     * get - handle get requests
+     */
+    #[RequiresPermission(SettingPermissions::PROJECT_LABELS)]
+    public function get($params)
+    {
+        $currentLabel = '';
+
+        if (isset($params['module']) && isset($params['label'])) {
+            $module = htmlspecialchars($params['module'], ENT_QUOTES, 'UTF-8');
+            $label = $this->sanitizeLabelKey($params['label']);
+
+            $currentLabel = $this->settingsSvc->getProjectLabel($module, $label, (int) session('currentProject'));
+        }
+
+        $this->tpl->assign('currentLabel', $currentLabel);
+
+        return $this->tpl->displayPartial('setting.editBoxDialog');
+    }
+
+    /**
+     * post - handle post requests
+     */
+    #[RequiresPermission(SettingPermissions::PROJECT_LABELS)]
+    public function post($params)
+    {
+        // If module and label are set its an update
+        $sanitizedString = '';
+        if (isset($_GET['module']) && isset($_GET['label'])) {
+            $module = htmlspecialchars($_GET['module'], ENT_QUOTES, 'UTF-8');
+            $labelKey = $this->sanitizeLabelKey($_GET['label']);
+            $sanitizedString = htmlspecialchars(strip_tags($params['newLabel'] ?? ''), ENT_QUOTES, 'UTF-8');
+
+            $this->settingsSvc->saveProjectLabel($module, $labelKey, $sanitizedString, (int) session('currentProject'));
+
+            $this->tpl->setNotification($this->language->__('notifications.label_changed_successfully'), 'success');
+        }
+
+        $this->tpl->assign('currentLabel', $sanitizedString);
+
+        return $this->tpl->displayPartial('setting.editBoxDialog');
+    }
+
+    /**
+     * Normalize a label key without destroying it.
+     *
+     * Ticket labels are keyed by integers, but idea labels are keyed by the canvasTypes
+     * strings ('idea', 'validation', …). The previous
+     * `(int) filter_var(..., FILTER_SANITIZE_NUMBER_INT)` turned every idea key into 0,
+     * which then got persisted and permanently 500'd the board (#3685). Numeric keys are
+     * returned as ints so ticket labels behave exactly as before; anything else is passed
+     * through as a trimmed string for the service to look up. An unknown key simply
+     * matches nothing, so this cannot be used to write an arbitrary label.
+     */
+    private function sanitizeLabelKey(mixed $label): int|string
+    {
+        if (! is_scalar($label)) {
+            return '';
+        }
+
+        $label = trim((string) $label);
+
+        return is_numeric($label) ? (int) $label : $label;
+    }
+
+    /**
+     * put - handle put requests
+     */
+    public function put($params) {}
+
+    /**
+     * delete - handle delete requests
+     */
+    public function delete($params) {}
+}

app/Domain/Setting/Controllers/EditCompanySettings.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Leantime\Domain\Setting\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller;
+use Leantime\Core\UI\Theme;
+use Leantime\Domain\Api\Services\Api as ApiService;
+use Leantime\Domain\Notifications\Models\Notification;
+use Leantime\Domain\Setting\Permissions\SettingPermissions;
+use Leantime\Domain\Setting\Services\Setting as SettingService;
+
+class EditCompanySettings extends Controller
+{
+    private ApiService $APIService;
+
+    private SettingService $settingsSvc;
+
+    private Theme $theme;
+
+    /**
+     * init - initialize private variables
+     */
+    public function init(
+        ApiService $APIService,
+        SettingService $settingsSvc,
+        Theme $theme,
+    ): void {
+        $this->APIService = $APIService;
+        $this->settingsSvc = $settingsSvc;
+        $this->theme = $theme;
+    }
+
+    /**
+     * get - handle get requests
+     */
+    #[RequiresPermission(SettingPermissions::COMPANY_VIEW, global: true)]
+    public function get($params)
+    {
+        if (isset($_GET['resetLogo'])) {
+            // Resetting the logo is a WRITE, so it must require edit — not the view that gates
+            // this GET handler. Matters once view/edit are split to different roles in the admin
+            // UI (the seeded matrix grants both to admin+owner, so this is defense-in-depth).
+            if (! can('company.settings.edit')) {
+                return $this->tpl->display('errors.error403', responseCode: 403);
+            }
+
+            $this->settingsSvc->resetLogo();
+
+            return Frontcontroller::redirect(BASE_URL.'/setting/editCompanySettings#look');
+        }
+
+        $companySettingsView = $this->settingsSvc->getCompanySettings($this->theme->getLogoUrl());
+
+        $apiKeys = $this->APIService->getAPIKeys();
+
+        $this->tpl->assign('apiKeys', $apiKeys);
+        $this->tpl->assign('languageList', $this->language->getLanguageList());
+        $this->tpl->assign('companySettings', $companySettingsView['companySettings']);
+        $this->tpl->assign('notificationCategories', Notification::NOTIFICATION_CATEGORIES);
+        $this->tpl->assign('defaultNotificationTypes', $companySettingsView['defaultNotificationTypes']);
+        $this->tpl->assign('defaultRelevance', $companySettingsView['defaultRelevance']);
+        $this->tpl->assign('relevanceLevels', [
+            Notification::RELEVANCE_ALL => 'label.notifications_all_activity',
+            Notification::RELEVANCE_MY_WORK => 'label.notifications_my_work',
+        ]);
+
+        return $this->tpl->display('setting.editCompanySettings');
+    }
+
+    /**
+     * post - handle post requests
+     */
+    #[RequiresPermission(SettingPermissions::COMPANY_EDIT, global: true)]
+    public function post($params)
+    {
+        // The telemetry opt-out path keys off the raw POST flag; mirror it into params.
+        $params['telemetryActive'] = isset($_POST['telemetryActive']);
+
+        $saved = $this->settingsSvc->saveCompanySettings($params);
+
+        if ($saved) {
+            $this->tpl->setNotification($this->language->__('notifications.company_settings_edited_successfully'), 'success');
+        }
+
+        return Frontcontroller::redirect(BASE_URL.'/setting/editCompanySettings');
+    }
+
+    /**
+     * put - handle put requests
+     */
+    public function put($params) {}
+
+    /**
+     * delete - handle delete requests
+     */
+    public function delete($params) {}
+}

app/Domain/Setting/Controllers/Logo.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Leantime\Domain\Setting\Controllers;
+
+use Leantime\Domain\Setting\Services\Setting as SettingService;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Handles the company logo upload.
+ *
+ * A native Laravel controller (constructor DI, route-bound action). Relocated from the
+ * retired Api\Controllers\Setting. Bound in Setting/routes.php at the canonical
+ * /setting/logo plus the backward-compatible /api/setting alias used by the company-settings
+ * logo cropper. The 501 GET/PATCH/DELETE stubs from the old controller are not carried over.
+ *
+ * The company logo is a global setting, so the upload requires company.settings.edit (admin+)
+ * — the legacy endpoint had no role check, letting any authenticated user overwrite it.
+ */
+class Logo
+{
+    public function __construct(private SettingService $settingService) {}
+
+    /**
+     * POST — store an uploaded company logo (multipart field "file").
+     */
+    public function post(): Response
+    {
+        if (! can('company.settings.edit')) {
+            return response()->json(['status' => 'unauthorized'], 403);
+        }
+
+        if (! isset($_FILES['file'])) {
+            return response()->json(['status' => 'failure'], 400);
+        }
+
+        $_FILES['file']['name'] = 'logo.png';
+
+        $this->settingService->setLogo($_FILES);
+
+        session(['msg' => 'PICTURE_CHANGED']);
+        session(['msgT' => 'success']);
+
+        return response()->json(['status' => 'ok']);
+    }
+}