From befd51dbd5911aff7b03cf9b7c59495c197ce5d4 Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Mon, 13 Jul 2026 18:29:32 +0800
Subject: [PATCH] fix: prevent username/email enumeration via registration
 error messages

---
 backend/routes/auth.js     | 7 ++-----
 backend/routes/external.js | 4 ++--
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/backend/routes/auth.js b/backend/routes/auth.js
index 2423344..4259e71 100644
--- a/backend/routes/auth.js
+++ b/backend/routes/auth.js
@@ -41,12 +41,9 @@ router.post('/register', validateLengths({
     }
 
     const existingUser = await getRow('SELECT id FROM users WHERE username = ?', [username]);
-    if (existingUser) {
-      return res.status(400).json({ error: '用户名已存在' });
-    }
     const existingEmail = await getRow('SELECT id FROM users WHERE email = ?', [email]);
-    if (existingEmail) {
-      return res.status(400).json({ error: '邮箱已被注册' });
+    if (existingUser || existingEmail) {
+      return res.status(400).json({ error: '用户名或邮箱已被使用' });
     }
 
     const hashed = await bcrypt.hash(password, 10);
diff --git a/backend/routes/external.js b/backend/routes/external.js
index dd0122e..dc0b45c 100644
--- a/backend/routes/external.js
+++ b/backend/routes/external.js
@@ -24,8 +24,8 @@ router.post('/auth/register', async (req, res) => {
     const { username, password, email, game_name, game_uid } = req.body;
     if (!username || !password || !email || !game_name || !game_uid) return res.status(400).json({ error: '所有字段必填' });
     if (password.length < 6) return res.status(400).json({ error: '密码至少6位' });
-    if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '用户名已存在' });
-    if (await getRow('SELECT id FROM users WHERE email = ?', [email])) return res.status(400).json({ error: '邮箱已注册' });
+    if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '注册失败，请检查输入信息' });
+    if (await getRow('SELECT id FROM users WHERE email = ?', [email])) return res.status(400).json({ error: '注册失败，请检查输入信息' });
 
     const hashed = bcrypt.hashSync(password, 10);
     const verifyToken = uuid();