effc262382
fix: site name in top logo + server-list public + external API docs page
...
- app.js: set #logo-text (top bar) from window.__SITE_NAME__ - the
top-right site name stayed default because only #site-title and
#sidebar-title were set
- security.js: apiKeyGuard whitelist /api/polls/server-list so the
ticket create page can load sub-servers (was 401 without api key)
- external-api.js: management page now only creates/manages clients,
removed inline endpoint table
- new external-api-docs.js: full API doc page (auth flow, all 11
endpoints, request/response examples, Node sample) at
#/external-api-docs, linked from the management page
- index.html: load external-api-docs.js
2026-08-22 02:18:29 +08:00
8c5ce78fd0
chore: add AGPLv3 copyright header to all source files
...
- 52 JS files (backend + public/js): header with
Copyright (C) 2026 Sea Network Technology Studio
Author: CangLan <admin@sea-studio.top >
+ AGPLv3 notice
- idempotent (skips if header present), all syntax-checked
2026-08-19 20:27:05 +08:00
cc02041b61
fix: api key cache invalidated by config mtime - server picks up new key after reinstall
2026-08-16 23:03:03 +08:00
6e9101a506
fix: deploy crash + multiple bug fixes + cleanup
...
- server.js: fix getSiteName() returning string when not installed causing
'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
(forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts
2026-08-16 21:21:25 +08:00
ed6fe9dcf1
fix: admin/owner skip rate limiting, anon 10/min
2026-07-17 21:51:32 +08:00
eed4591059
security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy
2026-07-13 19:49:44 +08:00
532efb962f
fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook
2026-07-13 03:49:02 +08:00
247a4e851d
feat: MC Report System - MySQL + Express + Vanilla JS SPA
2026-07-12 01:23:19 +08:00
