|
|
ed6fe9dcf1
|
fix: admin/owner skip rate limiting, anon 10/min
|
2026-07-17 21:51:32 +08:00 |
|
|
|
96e55d8715
|
feat: anonymous ticket reply via tracking cookie
|
2026-07-17 14:16:21 +08:00 |
|
|
|
9e5967d6ea
|
fix: reuse tracking cookie for multiple anonymous submissions
|
2026-07-17 14:14:02 +08:00 |
|
|
|
926bcb626b
|
feat: send-code before register, dup game_name check, skin hides uid
|
2026-07-17 00:42:19 +08:00 |
|
|
|
ead50beccd
|
feat: 6-digit email verification code, fix missing script+route includes
|
2026-07-17 00:34:47 +08:00 |
|
|
|
bfc63a8194
|
fix: captcha uses dark high-contrast colors only
|
2026-07-17 00:30:18 +08:00 |
|
|
|
18bb8152ef
|
feat: multi-channel notifications (Discord/email/generic Webhook)
|
2026-07-16 23:51:09 +08:00 |
|
|
|
09f0d8f2aa
|
fix: 12 issues - admin permission scope, player sidebar nav, SMTP label, user create servers
|
2026-07-16 23:04:15 +08:00 |
|
|
|
4d2dade44e
|
fix: site name hot-reloads from DB on every page load, no restart needed
|
2026-07-16 05:49:22 +08:00 |
|
|
|
f423e1f791
|
fix: dynamic site name from DB, displayed in header/title/sidebar
|
2026-07-16 04:02:19 +08:00 |
|
|
|
8ecefdcb19
|
fix: remove stale admin_servers column reference from users UPDATE
|
2026-07-16 03:33:40 +08:00 |
|
|
|
a8309aa456
|
refactor: use user_servers junction table instead of JSON column
|
2026-07-15 04:55:57 +08:00 |
|
|
|
a34314ac9d
|
feat: admin server assignment in user management
|
2026-07-15 04:53:27 +08:00 |
|
|
|
4fe1b30278
|
fix: include source in auth login response
|
2026-07-15 04:44:14 +08:00 |
|
|
|
efe6b084be
|
sync: add source field to user list, create, edit, and external API
|
2026-07-15 04:43:30 +08:00 |
|
|
|
880e3905dc
|
fix: CSP scriptSrcAttr explicitly allow unsafe-inline
|
2026-07-15 04:39:23 +08:00 |
|
|
|
125b4f99fc
|
fix: only two sources (netease/skin), plugin uses skin
|
2026-07-15 04:36:01 +08:00 |
|
|
|
c493c1204b
|
feat: registration source selector (netease/skin/java)
|
2026-07-15 04:34:06 +08:00 |
|
|
|
c892b18d33
|
fix: CSP script-src-attr:none blocked all onclick handlers since day 1
|
2026-07-15 03:58:16 +08:00 |
|
|
|
0f64af42a1
|
feat: password reset + data-action delegation for all onclick
|
2026-07-15 02:45:33 +08:00 |
|
|
|
0d26653c85
|
fix: migrate new tables on every startup, not just fresh install
|
2026-07-14 04:00:49 +08:00 |
|
|
|
4d8bc848e1
|
feat: features as GitHub Issues style with comments/discussion, status filter
|
2026-07-14 03:25:50 +08:00 |
|
|
|
f277711082
|
docs: README + optimize auth getSecret, features id fix, token error msg
|
2026-07-14 03:19:36 +08:00 |
|
|
|
4913984391
|
feat: poll groups/servers, timed polls, features sort+filter by group
|
2026-07-14 03:17:13 +08:00 |
|
|
|
d61ad2109f
|
refactor: remove polls+features, move to standalone mc-vote repo
|
2026-07-14 03:11:26 +08:00 |
|
|
|
3d7393817c
|
fix: polls /active route order, features redundant auth check
|
2026-07-14 03:03:56 +08:00 |
|
|
|
ee2f33c61f
|
feat: feature voting (PCL-style), poll owner edit/delete, blind polls for all
|
2026-07-14 01:17:56 +08:00 |
|
|
|
74974864cd
|
fix: no revote, blind result after voting, admin 1.5 vote weight
|
2026-07-13 22:01:03 +08:00 |
|
|
|
116fe89ac8
|
feat: poll/voting system with live results and bar charts
|
2026-07-13 21:37:16 +08:00 |
|
|
|
eed4591059
|
security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy
|
2026-07-13 19:49:44 +08:00 |
|
|
|
bc16833a57
|
feat: SVG image captcha with noise and color distortion
|
2026-07-13 18:33:31 +08:00 |
|
|
|
befd51dbd5
|
fix: prevent username/email enumeration via registration error messages
|
2026-07-13 18:29:32 +08:00 |
|
|
|
b24f8cd74d
|
fix: critical - external POST parameter count mismatch (11 vs 10)
|
2026-07-13 18:26:49 +08:00 |
|
|
|
8d9e154ce1
|
fix: restrict PUT /tickets to admin's own claims (enforce claim system)
|
2026-07-13 18:19:28 +08:00 |
|
|
|
2a18b4b1a8
|
perf: cache config.json reads by mtime, reduce sync I/O
|
2026-07-13 04:18:52 +08:00 |
|
|
|
532efb962f
|
fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook
|
2026-07-13 03:49:02 +08:00 |
|
|
|
7c03fe7635
|
fix: external register verify token mismatch, add type validation
|
2026-07-13 03:36:53 +08:00 |
|
|
|
a51e841fc9
|
refactor: English subcommands, plugin login/track redesign, clean external API routes
|
2026-07-13 03:35:13 +08:00 |
|
|
|
2a5c25f41c
|
refactor: unified /report command with login/register/track, external auth endpoints
|
2026-07-13 03:25:39 +08:00 |
|
|
|
de5a46f392
|
feat: Paper plugin + external API POST endpoint
|
2026-07-13 01:28:33 +08:00 |
|
|
|
ea3cd67e02
|
feat: external API for Java server integration with dedicated key
|
2026-07-13 01:24:03 +08:00 |
|
|
|
8ae02dd115
|
fix: add appealing to active_count, limit check, export processing count
|
2026-07-12 23:28:52 +08:00 |
|
|
|
6fa1a65843
|
fix: admin cant view admin_complaint/result_appeal via URL, appeal close also closes parent
|
2026-07-12 21:02:21 +08:00 |
|
|
|
f87411b3b4
|
feat: auto-close resolved/rejected after 7 days, closed only owner can modify
|
2026-07-12 18:15:10 +08:00 |
|
|
|
33078855cb
|
feat: appealing status, auto-close parent on appeal resolved, closed=final
|
2026-07-12 17:42:42 +08:00 |
|
|
|
93382773e6
|
fix: add result_appeal badge CSS and export label
|
2026-07-12 17:34:58 +08:00 |
|
|
|
7bd23b6bcf
|
fix: result_appeal had wrong respContent label
|
2026-07-12 17:34:02 +08:00 |
|
|
|
10b6ff94ed
|
feat: admin complaint (owner only) + result appeal (one per ticket, owner only)
|
2026-07-12 15:19:09 +08:00 |
|
|
|
29356bd530
|
fix: prevent $ interpolation in renderTemplate replacement
|
2026-07-12 13:04:58 +08:00 |
|
|
|
5dd0db76be
|
fix: add UNIQUE on email, check dup email in profile update, generic error messages in auth route
|
2026-07-12 04:20:56 +08:00 |
|
