09e33128a8
fix: serve /webfonts static dir - icons missing after FA localization
...
CSS at /css/fontawesome.min.css references url(../webfonts/...) which
resolves to /webfonts/*.woff2; server.js only mounted /css and /js,
so all font requests 404'd and every icon silently disappeared.
2026-08-22 20:46:01 +08:00
8c5ce78fd0
chore: add AGPLv3 copyright header to all source files
...
- 52 JS files (backend + public/js): header with
Copyright (C) 2026 Sea Network Technology Studio
Author: CangLan <admin@sea-studio.top >
+ AGPLv3 notice
- idempotent (skips if header present), all syntax-checked
2026-08-19 20:27:05 +08:00
65edbaf157
refactor: session-based external auth, dynamic sources, drop netease UID
...
Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients
Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
(register, dashboard identity, users admin, bans), labels dynamic
UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
dropped, frontend fields optional)
Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)
2026-08-19 20:08:06 +08:00
a11df22600
feat: system logs - email log + system log with admin UI
...
- db: email_logs (sent/failed) + system_logs (info/warn/error) tables,
auto-migrated for existing installs
- backend/logger.js: logEmail/logSystem with try/catch (never breaks flow)
- mailer: log send result (SMTP unconfigured/sent/failed + error msg)
- webhook: log blocked-internal, non-2xx response, send failure
- server: error middleware records 500 errors to system_logs
- routes/logs.js: GET /logs/emails + /logs/system (admin/owner, filters)
- UI: 系统日志 page (owner/admin) with system/email tabs + filters
- API docs updated
2026-08-17 05:14:41 +08:00
42d4cafedd
fix: async route rejection crashes process - global async error wrap + email dup check
...
- users.js: check email uniqueness before insert (was ER_DUP_ENTRY uncaught crash)
- server.js: wrapAsyncRouter - Express 4 doesn't catch async handler rejections,
route throws now go to error middleware (500 JSON) instead of uncaughtException
2026-08-17 01:03:45 +08:00
7e203d9a27
fix: 404 interface not found after login - business routes on dedicated router so dynamic loading precedes catch-all
2026-08-17 00:01:36 +08:00
6e9101a506
fix: deploy crash + multiple bug fixes + cleanup
...
- server.js: fix getSiteName() returning string when not installed causing
'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
(forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts
2026-08-16 21:21:25 +08:00
5ed109ec0e
feat: ban list with dashboard widget, owner add/edit bans
2026-07-18 00:52:33 +08:00
4d2dade44e
fix: site name hot-reloads from DB on every page load, no restart needed
2026-07-16 05:49:22 +08:00
f423e1f791
fix: dynamic site name from DB, displayed in header/title/sidebar
2026-07-16 04:02:19 +08:00
880e3905dc
fix: CSP scriptSrcAttr explicitly allow unsafe-inline
2026-07-15 04:39:23 +08:00
c892b18d33
fix: CSP script-src-attr:none blocked all onclick handlers since day 1
2026-07-15 03:58:16 +08:00
4913984391
feat: poll groups/servers, timed polls, features sort+filter by group
2026-07-14 03:17:13 +08:00
d61ad2109f
refactor: remove polls+features, move to standalone mc-vote repo
2026-07-14 03:11:26 +08:00
ee2f33c61f
feat: feature voting (PCL-style), poll owner edit/delete, blind polls for all
2026-07-14 01:17:56 +08:00
116fe89ac8
feat: poll/voting system with live results and bar charts
2026-07-13 21:37:16 +08:00
eed4591059
security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy
2026-07-13 19:49:44 +08:00
532efb962f
fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook
2026-07-13 03:49:02 +08:00
ea3cd67e02
feat: external API for Java server integration with dedicated key
2026-07-13 01:24:03 +08:00
aa9ee24118
fix: disable all static file caching to prevent stale assets
2026-07-12 02:08:18 +08:00
247a4e851d
feat: MC Report System - MySQL + Express + Vanilla JS SPA
2026-07-12 01:23:19 +08:00
