Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
144 Commits 1 Branch 0 Tags
8d6c3c4a8d24cba3a9921fb0243e4421a9e7a527
Commit Graph

59 Commits

Author SHA1 Message Date
canglan
8d6c3c4a8d fix: notifications page crash + email code dev-mode false error 
- notifications.js: EventOptions(current) referenced undefined 'Current'
  (case typo) -> ReferenceError crashed add/edit modal, page unusable
- auth.js send-verify-code: dev mode (SMTP down) deleted captcha row before
  returning code, so register always failed with '验证码无效或已过期'
  even with correct code. Keep row; it's deleted after successful verify.
 2026-08-17 04:50:10 +08:00
canglan
1d669fd1d0 feat: skin site UUID lookup - auto-fetch UUID from player name 
- GET /settings/uuid-lookup?site=&name= : proxy Yggdrasil API
  (POST {site}/api/yggdrasil/api/profiles/minecraft), SSRF guard,
  10s timeout, name regex, UUID formatting (with dashes)
- GET /settings/skin-site : public read of configured skin site
- settings page: 皮肤站地址 config
- bind identity modals (player dashboard + admin users): 获取UUID button,
  auto-fill site from settings, auto-fill UID from lookup
- verified live against littleskin.cn (Steve -> df273bda...)
- API docs updated
 2026-08-17 02:05:21 +08:00
canglan
25a766591e feat: admin user management supports multi-identity bind/unbind 
- users list: identity_count column (backend subquery)
- user detail: returns identities array
- POST /users/:id/identities, DELETE /users/:id/identities/:identityId
  (owner protection, dup checks, keep >=1, audit logs)
- users page: identity column in table + manage section in edit modal
- API docs updated
 2026-08-17 01:34:20 +08:00
canglan
4c221ad6f1 docs: full API documentation + data compat guard 
- docs/API.md: complete API reference (auth/identities/tickets/bans/users/
  settings/notifications/polls/features/export/captcha/uploads/external/
  install/health) with auth, rate limits, roles, data migration notes
- auth.js register: also check user_identities for duplicate game_name
  (multi-identity compat for old data backfilled into new table)
- README: link API docs, multi-identity section
 2026-08-17 01:20:39 +08:00
canglan
559970c5b7 feat: one account can bind both netease + skin identities 
- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
  (netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity
 2026-08-17 01:17:09 +08:00
canglan
42d4cafedd fix: async route rejection crashes process - global async error wrap + email dup check 
- users.js: check email uniqueness before insert (was ER_DUP_ENTRY uncaught crash)
- server.js: wrapAsyncRouter - Express 4 doesn't catch async handler rejections,
  route throws now go to error middleware (500 JSON) instead of uncaughtException
 2026-08-17 01:03:45 +08:00
canglan
6e9101a506 fix: deploy crash + multiple bug fixes + cleanup 
- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts
 2026-08-16 21:21:25 +08:00
canglan
12721d09ee fix: duplicate res.json crash + missing try/catch in bans POST 2026-07-18 01:45:00 +08:00
canglan
dce812aa2f feat: bans show account source + ban source (ticket/manual) 2026-07-18 01:35:30 +08:00
canglan
140ff3e3ae fix: remove duplicate closing brace in auth.js 2026-07-18 01:30:14 +08:00
canglan
ce51abc127 fix: add source field to bans + display in list 2026-07-18 01:26:37 +08:00
canglan
2a12e7b740 fix: ban duration >= not >, auto-prefill min duration 2026-07-18 01:11:41 +08:00
canglan
aa2c296971 feat: escalating ban duration - each ban must be longer than previous 2026-07-18 01:09:14 +08:00
canglan
5ed109ec0e feat: ban list with dashboard widget, owner add/edit bans 2026-07-18 00:52:33 +08:00
canglan
5497de9aac feat: batch ticket operations (close/delete/change status) 2026-07-17 21:55:15 +08:00
canglan
96e55d8715 feat: anonymous ticket reply via tracking cookie 2026-07-17 14:16:21 +08:00
canglan
9e5967d6ea fix: reuse tracking cookie for multiple anonymous submissions 2026-07-17 14:14:02 +08:00
canglan
926bcb626b feat: send-code before register, dup game_name check, skin hides uid 2026-07-17 00:42:19 +08:00
canglan
ead50beccd feat: 6-digit email verification code, fix missing script+route includes 2026-07-17 00:34:47 +08:00
canglan
bfc63a8194 fix: captcha uses dark high-contrast colors only 2026-07-17 00:30:18 +08:00
canglan
18bb8152ef feat: multi-channel notifications (Discord/email/generic Webhook) 2026-07-16 23:51:09 +08:00
canglan
09f0d8f2aa fix: 12 issues - admin permission scope, player sidebar nav, SMTP label, user create servers 2026-07-16 23:04:15 +08:00
canglan
8ecefdcb19 fix: remove stale admin_servers column reference from users UPDATE 2026-07-16 03:33:40 +08:00
canglan
a8309aa456 refactor: use user_servers junction table instead of JSON column 2026-07-15 04:55:57 +08:00
canglan
a34314ac9d feat: admin server assignment in user management 2026-07-15 04:53:27 +08:00
canglan
4fe1b30278 fix: include source in auth login response 2026-07-15 04:44:14 +08:00
canglan
efe6b084be sync: add source field to user list, create, edit, and external API 2026-07-15 04:43:30 +08:00
canglan
125b4f99fc fix: only two sources (netease/skin), plugin uses skin 2026-07-15 04:36:01 +08:00
canglan
c493c1204b feat: registration source selector (netease/skin/java) 2026-07-15 04:34:06 +08:00
canglan
0f64af42a1 feat: password reset + data-action delegation for all onclick 2026-07-15 02:45:33 +08:00
canglan
4d8bc848e1 feat: features as GitHub Issues style with comments/discussion, status filter 2026-07-14 03:25:50 +08:00
canglan
f277711082 docs: README + optimize auth getSecret, features id fix, token error msg 2026-07-14 03:19:36 +08:00
canglan
4913984391 feat: poll groups/servers, timed polls, features sort+filter by group 2026-07-14 03:17:13 +08:00
canglan
d61ad2109f refactor: remove polls+features, move to standalone mc-vote repo 2026-07-14 03:11:26 +08:00
canglan
3d7393817c fix: polls /active route order, features redundant auth check 2026-07-14 03:03:56 +08:00
canglan
ee2f33c61f feat: feature voting (PCL-style), poll owner edit/delete, blind polls for all 2026-07-14 01:17:56 +08:00
canglan
74974864cd fix: no revote, blind result after voting, admin 1.5 vote weight 2026-07-13 22:01:03 +08:00
canglan
116fe89ac8 feat: poll/voting system with live results and bar charts 2026-07-13 21:37:16 +08:00
canglan
bc16833a57 feat: SVG image captcha with noise and color distortion 2026-07-13 18:33:31 +08:00
canglan
befd51dbd5 fix: prevent username/email enumeration via registration error messages 2026-07-13 18:29:32 +08:00
canglan
b24f8cd74d fix: critical - external POST parameter count mismatch (11 vs 10) 2026-07-13 18:26:49 +08:00
canglan
8d9e154ce1 fix: restrict PUT /tickets to admin's own claims (enforce claim system) 2026-07-13 18:19:28 +08:00
canglan
532efb962f fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook 2026-07-13 03:49:02 +08:00
canglan
7c03fe7635 fix: external register verify token mismatch, add type validation 2026-07-13 03:36:53 +08:00
canglan
a51e841fc9 refactor: English subcommands, plugin login/track redesign, clean external API routes 2026-07-13 03:35:13 +08:00
canglan
2a5c25f41c refactor: unified /report command with login/register/track, external auth endpoints 2026-07-13 03:25:39 +08:00
canglan
de5a46f392 feat: Paper plugin + external API POST endpoint 2026-07-13 01:28:33 +08:00
canglan
ea3cd67e02 feat: external API for Java server integration with dedicated key 2026-07-13 01:24:03 +08:00
canglan
8ae02dd115 fix: add appealing to active_count, limit check, export processing count 2026-07-12 23:28:52 +08:00
canglan
6fa1a65843 fix: admin cant view admin_complaint/result_appeal via URL, appeal close also closes parent 2026-07-12 21:02:21 +08:00