security: backend validation for all inputs

- router.param('id'): all :id path params must be positive ints
  (tickets/features/polls/auth/users; external/bans/notifications already
  had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
  exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
  page/limit floor protection, ticket field length caps, clients active
  boolean + id validation
- verified: 28 checks (syntax + validation coverage)

backend/routes/external.js

@@ -112,9 +112,12 @@ router.get('/clients', authenticate, async (req, res) => {
 router.put('/clients/:id', authenticate, async (req, res) => {
   try {
     if (!['owner','admin'].includes(req.user.role)) return res.status(403).json({ error: '无权限' });
+    const id = parseInt(req.params.id);
+    if (!id) return res.status(400).json({ error: '无效的ID' });
     const { active } = req.body;
-    await query('UPDATE api_clients SET active = ? WHERE id = ?', [active ? 1 : 0, req.params.id]);
-    await logSystem('info', 'api', `更新外部API客户端 #${req.params.id}`, { active: !!active });
+    if (active === undefined || (typeof active !== 'boolean' && ![0,1,'0','1'].includes(active))) return res.status(400).json({ error: 'active 必须为布尔值' });
+    await query('UPDATE api_clients SET active = ? WHERE id = ?', [active ? 1 : 0, id]);
+    await logSystem('info', 'api', `更新外部API客户端 #${id}`, { active: !!active });
     res.json({ message: '已更新' });
   } catch (e) { res.status(500).json({ error: e.message }); }
 });
@@ -122,8 +125,10 @@ router.put('/clients/:id', authenticate, async (req, res) => {
 router.delete('/clients/:id', authenticate, async (req, res) => {
   try {
     if (!['owner','admin'].includes(req.user.role)) return res.status(403).json({ error: '无权限' });
-    await query('DELETE FROM api_clients WHERE id = ?', [req.params.id]);
-    await logSystem('info', 'api', `删除外部API客户端 #${req.params.id}`);
+    const id = parseInt(req.params.id);
+    if (!id) return res.status(400).json({ error: '无效的ID' });
+    await query('DELETE FROM api_clients WHERE id = ?', [id]);
+    await logSystem('info', 'api', `删除外部API客户端 #${id}`);
     res.json({ message: '已删除' });
   } catch (e) { res.status(500).json({ error: e.message }); }
 });
@@ -185,6 +190,10 @@ router.post('/tickets', async (req, res) => {
     const { type, title, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, is_admin_complaint, server } = req.body;
     if (!type || !['report','suggestion','appeal'].includes(type)) return res.status(400).json({ error: '类型不正确' });
     if (!title || !reporter_game_name) return res.status(400).json({ error: '必填字段不完整' });
+    if (String(title).length > 100) return res.status(400).json({ error: '标题过长(≤100)' });
+    if (String(reporter_game_name).length > 50) return res.status(400).json({ error: '游戏名过长' });
+    if (reason && String(reason).length > 500) return res.status(400).json({ error: '原因过长(≤500)' });
+    if (description && String(description).length > 5000) return res.status(400).json({ error: '内容过长(≤5000)' });
     if (type === 'report' && !reason) return res.status(400).json({ error: '请填写举报原因' });
     if (type === 'suggestion' && !description) return res.status(400).json({ error: '建议内容不能为空' });
     if (type === 'appeal' && (!reason || !description)) return res.status(400).json({ error: '请填写完整申诉信息' });
@@ -216,8 +225,14 @@ router.get('/tickets/track', async (req, res) => {
 });
 
 // ============ 工单列表(带 server 过滤) ============
+const TICKET_TYPES = ['report', 'suggestion', 'appeal', 'result_appeal'];
+const TICKET_STATUSES = ['pending', 'processing', 'awaiting_info', 'appealing', 'resolved', 'rejected', 'closed'];
+const BAN_STATUSES = ['active', 'expired', 'appealed', 'lifted'];
+
 router.get('/all-tickets', async (req, res) => {
   const { type, status, server, page, limit } = req.query;
+  if (type && !TICKET_TYPES.includes(type)) return res.status(400).json({ error: '无效的 type' });
+  if (status && !TICKET_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' });
   let q = `SELECT id, type, title, status, priority, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, assigned_to, claim_note, server_name, created_at, updated_at FROM tickets WHERE 1=1`;
   const p = [];
   if (type) { q += ' AND type = ?'; p.push(type); }
@@ -226,17 +241,19 @@ router.get('/all-tickets', async (req, res) => {
     const sv = await resolveServer(server);
     q += ' AND server_name = ?'; p.push(sv.server_name);
   }
-  const pg = parseInt(page) || 1;
-  const lm = Math.min(parseInt(limit) || 50, 200);
+  const pg = Math.max(parseInt(page) || 1, 1);
+  const lm = Math.min(Math.max(parseInt(limit) || 50, 1), 200);
   q += ` ORDER BY updated_at DESC LIMIT ${(pg-1)*lm}, ${lm}`;
   res.json(await query(q, p));
 });
 
 router.get('/all-tickets/:id', async (req, res) => {
-  const t = await getRow('SELECT * FROM tickets WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  const t = await getRow('SELECT * FROM tickets WHERE id = ?', [id]);
   if (!t) return res.status(404).json({ error: 'Not found' });
-  t.responses = await query('SELECT content, is_staff, created_at FROM responses WHERE ticket_id = ? ORDER BY created_at ASC', [req.params.id]);
-  t.attachments = await query('SELECT id, original_name, mime_type, size FROM attachments WHERE ticket_id = ?', [req.params.id]);
+  t.responses = await query('SELECT content, is_staff, created_at FROM responses WHERE ticket_id = ? ORDER BY created_at ASC', [id]);
+  t.attachments = await query('SELECT id, original_name, mime_type, size FROM attachments WHERE ticket_id = ?', [id]);
   res.json(t);
 });
 
@@ -244,6 +261,7 @@ router.get('/all-tickets/:id', async (req, res) => {
 // 拉取封禁: ?server=alias|server_name|分组/服务器&status=active|expired|appealed|lifted&player=&limit=
 router.get('/bans', async (req, res) => {
   const { server, status, player, page, limit } = req.query;
+  if (status && !BAN_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' });
   let q = 'SELECT id, player_name, player_uid, source, reason, type, duration, server_name, status, created_at, expires_at FROM bans WHERE 1=1';
   const p = [];
   if (server) {
@@ -252,8 +270,8 @@ router.get('/bans', async (req, res) => {
   }
   if (status) { q += ' AND status = ?'; p.push(status); }
   if (player) { q += ' AND (player_name = ? OR player_uid = ?)'; p.push(player, player); }
-  const pg = parseInt(page) || 1;
-  const lm = Math.min(parseInt(limit) || 100, 500);
+  const pg = Math.max(parseInt(page) || 1, 1);
+  const lm = Math.min(Math.max(parseInt(limit) || 100, 1), 500);
   q += ` ORDER BY created_at DESC LIMIT ${(pg-1)*lm}, ${lm}`;
   res.json(await query(q, p));
 });
@@ -263,6 +281,9 @@ router.post('/bans', async (req, res) => {
   try {
     const { player_name, player_uid, source, reason, type, duration, expires_at, server, status } = req.body;
     if (!player_name) return res.status(400).json({ error: 'player_name 必填' });
+    if (player_name.length > 50) return res.status(400).json({ error: 'player_name 过长' });
+    if (type && !['ban','mute','warn','other'].includes(type)) return res.status(400).json({ error: '无效的 type' });
+    if (status && !BAN_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' });
     const sv = await resolveServer(server);
     const r = await query(`INSERT INTO bans(player_name, player_uid, source, reason, type, duration, server_name, status, expires_at) VALUES (?,?,?,?,?,?,?,?,?)`,
       [player_name, player_uid||'', source||'', reason||'', ['ban','mute','warn','other'].includes(type)?type:'ban', duration||'', sv.server_name, ['active','expired','appealed','lifted'].includes(status)?status:'active', expires_at||null]);