fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook

backend/routes/external.js

@@ -1,7 +1,7 @@
 const express = require('express');
 const bcrypt = require('bcryptjs');
 const { v4: uuid } = require('uuid');
-const { query, getRow, getConfig } = require('../db');
+const { query, getRow, getConfig, getPool } = require('../db');
 const { generateToken, authenticate } = require('../middleware/auth');
 const { sendEmail } = require('../mailer');
 
@@ -47,7 +47,7 @@ router.post('/auth/login', async (req, res) => {
     const { username, password } = req.body;
     if (!username || !password) return res.status(400).json({ error: '请输入用户名和密码' });
     const user = await getRow('SELECT * FROM users WHERE username = ?', [username]);
-    if (!user || !bcrypt.compareSync(password, user.password)) return res.status(401).json({ error: '用户名或密码错误' });
+    if (!user || !(await bcrypt.compare(password, user.password))) return res.status(401).json({ error: '用户名或密码错误' });
     if (!user.active) return res.status(403).json({ error: '账号未激活' });
     const token = generateToken(user);
     res.json({ token, user: { id:user.id, username:user.username, game_name:user.game_name, game_uid:user.game_uid, role:user.role } });

backend/routes/tickets.js

@@ -185,6 +185,7 @@ router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res)
   const fields = {};
   if (req.body.status) fields.status = req.body.status;
   if (req.body.priority) fields.priority = req.body.priority;
+  if (req.body.priority && !['low','medium','high','urgent'].includes(req.body.priority)) return res.status(400).json({ error: '无效的优先级' });
   if (req.body.claim_note !== undefined) fields.claim_note = req.body.claim_note;
   if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
   const sets = Object.keys(fields).map(k => `${k} = ?`).join(', ');