e1cdff2b4a
security: backend validation for all inputs
...
- router.param('id'): all :id path params must be positive ints
(tickets/features/polls/auth/users; external/bans/notifications already
had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
page/limit floor protection, ticket field length caps, clients active
boolean + id validation
- verified: 28 checks (syntax + validation coverage)
2026-08-21 20:10:05 +08:00
8c5ce78fd0
chore: add AGPLv3 copyright header to all source files
...
- 52 JS files (backend + public/js): header with
Copyright (C) 2026 Sea Network Technology Studio
Author: CangLan <admin@sea-studio.top >
+ AGPLv3 notice
- idempotent (skips if header present), all syntax-checked
2026-08-19 20:27:05 +08:00
65edbaf157
refactor: session-based external auth, dynamic sources, drop netease UID
...
Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients
Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
(register, dashboard identity, users admin, bans), labels dynamic
UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
dropped, frontend fields optional)
Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)
2026-08-19 20:08:06 +08:00
8d6c3c4a8d
fix: notifications page crash + email code dev-mode false error
...
- notifications.js: EventOptions(current) referenced undefined 'Current'
(case typo) -> ReferenceError crashed add/edit modal, page unusable
- auth.js send-verify-code: dev mode (SMTP down) deleted captcha row before
returning code, so register always failed with '验证码无效或已过期'
even with correct code. Keep row; it's deleted after successful verify.
2026-08-17 04:50:10 +08:00
4c221ad6f1
docs: full API documentation + data compat guard
...
- docs/API.md: complete API reference (auth/identities/tickets/bans/users/
settings/notifications/polls/features/export/captcha/uploads/external/
install/health) with auth, rate limits, roles, data migration notes
- auth.js register: also check user_identities for duplicate game_name
(multi-identity compat for old data backfilled into new table)
- README: link API docs, multi-identity section
2026-08-17 01:20:39 +08:00
559970c5b7
feat: one account can bind both netease + skin identities
...
- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
(netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity
2026-08-17 01:17:09 +08:00
6e9101a506
fix: deploy crash + multiple bug fixes + cleanup
...
- server.js: fix getSiteName() returning string when not installed causing
'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
(forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts
2026-08-16 21:21:25 +08:00
140ff3e3ae
fix: remove duplicate closing brace in auth.js
2026-07-18 01:30:14 +08:00
926bcb626b
feat: send-code before register, dup game_name check, skin hides uid
2026-07-17 00:42:19 +08:00
ead50beccd
feat: 6-digit email verification code, fix missing script+route includes
2026-07-17 00:34:47 +08:00
4fe1b30278
fix: include source in auth login response
2026-07-15 04:44:14 +08:00
c493c1204b
feat: registration source selector (netease/skin/java)
2026-07-15 04:34:06 +08:00
0f64af42a1
feat: password reset + data-action delegation for all onclick
2026-07-15 02:45:33 +08:00
befd51dbd5
fix: prevent username/email enumeration via registration error messages
2026-07-13 18:29:32 +08:00
5dd0db76be
fix: add UNIQUE on email, check dup email in profile update, generic error messages in auth route
2026-07-12 04:20:56 +08:00
247a4e851d
feat: MC Report System - MySQL + Express + Vanilla JS SPA
2026-07-12 01:23:19 +08:00
