|
|
e1cdff2b4a
|
security: backend validation for all inputs
- router.param('id'): all :id path params must be positive ints
(tickets/features/polls/auth/users; external/bans/notifications already
had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
page/limit floor protection, ticket field length caps, clients active
boolean + id validation
- verified: 28 checks (syntax + validation coverage)
|
2026-08-21 20:10:05 +08:00 |
|
|
|
8c5ce78fd0
|
chore: add AGPLv3 copyright header to all source files
- 52 JS files (backend + public/js): header with
Copyright (C) 2026 Sea Network Technology Studio
Author: CangLan <admin@sea-studio.top>
+ AGPLv3 notice
- idempotent (skips if header present), all syntax-checked
|
2026-08-19 20:27:05 +08:00 |
|
|
|
a11df22600
|
feat: system logs - email log + system log with admin UI
- db: email_logs (sent/failed) + system_logs (info/warn/error) tables,
auto-migrated for existing installs
- backend/logger.js: logEmail/logSystem with try/catch (never breaks flow)
- mailer: log send result (SMTP unconfigured/sent/failed + error msg)
- webhook: log blocked-internal, non-2xx response, send failure
- server: error middleware records 500 errors to system_logs
- routes/logs.js: GET /logs/emails + /logs/system (admin/owner, filters)
- UI: 系统日志 page (owner/admin) with system/email tabs + filters
- API docs updated
|
2026-08-17 05:14:41 +08:00 |
|
|
|
eed4591059
|
security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy
|
2026-07-13 19:49:44 +08:00 |
|
|
|
532efb962f
|
fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook
|
2026-07-13 03:49:02 +08:00 |
|
|
|
247a4e851d
|
feat: MC Report System - MySQL + Express + Vanilla JS SPA
|
2026-07-12 01:23:19 +08:00 |
|
