1d669fd1d0
feat: skin site UUID lookup - auto-fetch UUID from player name
...
- GET /settings/uuid-lookup?site=&name= : proxy Yggdrasil API
(POST {site}/api/yggdrasil/api/profiles/minecraft), SSRF guard,
10s timeout, name regex, UUID formatting (with dashes)
- GET /settings/skin-site : public read of configured skin site
- settings page: 皮肤站地址 config
- bind identity modals (player dashboard + admin users): 获取UUID button,
auto-fill site from settings, auto-fill UID from lookup
- verified live against littleskin.cn (Steve -> df273bda...)
- API docs updated
2026-08-17 02:05:21 +08:00
25a766591e
feat: admin user management supports multi-identity bind/unbind
...
- users list: identity_count column (backend subquery)
- user detail: returns identities array
- POST /users/:id/identities, DELETE /users/:id/identities/:identityId
(owner protection, dup checks, keep >=1, audit logs)
- users page: identity column in table + manage section in edit modal
- API docs updated
2026-08-17 01:34:20 +08:00
4c221ad6f1
docs: full API documentation + data compat guard
...
- docs/API.md: complete API reference (auth/identities/tickets/bans/users/
settings/notifications/polls/features/export/captcha/uploads/external/
install/health) with auth, rate limits, roles, data migration notes
- auth.js register: also check user_identities for duplicate game_name
(multi-identity compat for old data backfilled into new table)
- README: link API docs, multi-identity section
2026-08-17 01:20:39 +08:00
559970c5b7
feat: one account can bind both netease + skin identities
...
- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
(netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity
2026-08-17 01:17:09 +08:00
42d4cafedd
fix: async route rejection crashes process - global async error wrap + email dup check
...
- users.js: check email uniqueness before insert (was ER_DUP_ENTRY uncaught crash)
- server.js: wrapAsyncRouter - Express 4 doesn't catch async handler rejections,
route throws now go to error middleware (500 JSON) instead of uncaughtException
2026-08-17 01:03:45 +08:00
7e203d9a27
fix: 404 interface not found after login - business routes on dedicated router so dynamic loading precedes catch-all
2026-08-17 00:01:36 +08:00
cc02041b61
fix: api key cache invalidated by config mtime - server picks up new key after reinstall
2026-08-16 23:03:03 +08:00
6e9101a506
fix: deploy crash + multiple bug fixes + cleanup
...
- server.js: fix getSiteName() returning string when not installed causing
'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
(forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts
2026-08-16 21:21:25 +08:00
12721d09ee
fix: duplicate res.json crash + missing try/catch in bans POST
2026-07-18 01:45:00 +08:00
dce812aa2f
feat: bans show account source + ban source (ticket/manual)
2026-07-18 01:35:30 +08:00
140ff3e3ae
fix: remove duplicate closing brace in auth.js
2026-07-18 01:30:14 +08:00
ce51abc127
fix: add source field to bans + display in list
2026-07-18 01:26:37 +08:00
2a12e7b740
fix: ban duration >= not >, auto-prefill min duration
2026-07-18 01:11:41 +08:00
aa2c296971
feat: escalating ban duration - each ban must be longer than previous
2026-07-18 01:09:14 +08:00
5ed109ec0e
feat: ban list with dashboard widget, owner add/edit bans
2026-07-18 00:52:33 +08:00
5497de9aac
feat: batch ticket operations (close/delete/change status)
2026-07-17 21:55:15 +08:00
ed6fe9dcf1
fix: admin/owner skip rate limiting, anon 10/min
2026-07-17 21:51:32 +08:00
96e55d8715
feat: anonymous ticket reply via tracking cookie
2026-07-17 14:16:21 +08:00
9e5967d6ea
fix: reuse tracking cookie for multiple anonymous submissions
2026-07-17 14:14:02 +08:00
926bcb626b
feat: send-code before register, dup game_name check, skin hides uid
2026-07-17 00:42:19 +08:00
ead50beccd
feat: 6-digit email verification code, fix missing script+route includes
2026-07-17 00:34:47 +08:00
bfc63a8194
fix: captcha uses dark high-contrast colors only
2026-07-17 00:30:18 +08:00
18bb8152ef
feat: multi-channel notifications (Discord/email/generic Webhook)
2026-07-16 23:51:09 +08:00
09f0d8f2aa
fix: 12 issues - admin permission scope, player sidebar nav, SMTP label, user create servers
2026-07-16 23:04:15 +08:00
4d2dade44e
fix: site name hot-reloads from DB on every page load, no restart needed
2026-07-16 05:49:22 +08:00
f423e1f791
fix: dynamic site name from DB, displayed in header/title/sidebar
2026-07-16 04:02:19 +08:00
8ecefdcb19
fix: remove stale admin_servers column reference from users UPDATE
2026-07-16 03:33:40 +08:00
a8309aa456
refactor: use user_servers junction table instead of JSON column
2026-07-15 04:55:57 +08:00
a34314ac9d
feat: admin server assignment in user management
2026-07-15 04:53:27 +08:00
4fe1b30278
fix: include source in auth login response
2026-07-15 04:44:14 +08:00
efe6b084be
sync: add source field to user list, create, edit, and external API
2026-07-15 04:43:30 +08:00
880e3905dc
fix: CSP scriptSrcAttr explicitly allow unsafe-inline
2026-07-15 04:39:23 +08:00
125b4f99fc
fix: only two sources (netease/skin), plugin uses skin
2026-07-15 04:36:01 +08:00
c493c1204b
feat: registration source selector (netease/skin/java)
2026-07-15 04:34:06 +08:00
c892b18d33
fix: CSP script-src-attr:none blocked all onclick handlers since day 1
2026-07-15 03:58:16 +08:00
0f64af42a1
feat: password reset + data-action delegation for all onclick
2026-07-15 02:45:33 +08:00
0d26653c85
fix: migrate new tables on every startup, not just fresh install
2026-07-14 04:00:49 +08:00
4d8bc848e1
feat: features as GitHub Issues style with comments/discussion, status filter
2026-07-14 03:25:50 +08:00
f277711082
docs: README + optimize auth getSecret, features id fix, token error msg
2026-07-14 03:19:36 +08:00
4913984391
feat: poll groups/servers, timed polls, features sort+filter by group
2026-07-14 03:17:13 +08:00
d61ad2109f
refactor: remove polls+features, move to standalone mc-vote repo
2026-07-14 03:11:26 +08:00
3d7393817c
fix: polls /active route order, features redundant auth check
2026-07-14 03:03:56 +08:00
ee2f33c61f
feat: feature voting (PCL-style), poll owner edit/delete, blind polls for all
2026-07-14 01:17:56 +08:00
74974864cd
fix: no revote, blind result after voting, admin 1.5 vote weight
2026-07-13 22:01:03 +08:00
116fe89ac8
feat: poll/voting system with live results and bar charts
2026-07-13 21:37:16 +08:00
eed4591059
security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy
2026-07-13 19:49:44 +08:00
bc16833a57
feat: SVG image captcha with noise and color distortion
2026-07-13 18:33:31 +08:00
befd51dbd5
fix: prevent username/email enumeration via registration error messages
2026-07-13 18:29:32 +08:00
b24f8cd74d
fix: critical - external POST parameter count mismatch (11 vs 10)
2026-07-13 18:26:49 +08:00
8d9e154ce1
fix: restrict PUT /tickets to admin's own claims (enforce claim system)
2026-07-13 18:19:28 +08:00
