v1.0.10

2026-08-03 00:07:01 +08:00
commit 71c6e8d9c1
112 changed files with 7815 additions and 0 deletions
@@ -0,0 +1,70 @@
+<?php
+/**
+ * 编辑用户接口（含角色分配） POST /api/system/user_update.php
+ * 入参：id / real_name / role_id / is_active / password（可选，留空不改密码）
+ */
+require_once __DIR__ . '/../common/db.php';
+require_once __DIR__ . '/../common/response.php';
+require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/logger.php';
+
+checkAjax();
+checkPermission('system');
+
+$id = (int)($_POST['id'] ?? 0);
+if ($id <= 0) {
+    Response::error('参数错误', 400);
+}
+
+$pdo = DB::getInstance()->getPdo();
+$check = $pdo->prepare("SELECT * FROM system_users WHERE id = ?");
+$check->execute([$id]);
+$old = $check->fetch();
+if (!$old) {
+    Response::error('用户不存在');
+}
+
+// 内置管理员保护：不允许禁用 id=1（admin）
+if ($id === 1 && isset($_POST['is_active']) && (int)$_POST['is_active'] === 0) {
+    Response::error('不允许禁用内置管理员账号', 400);
+}
+
+$sets = [];
+$params = [];
+
+if (isset($_POST['real_name'])) {
+    $sets[] = 'real_name = ?';
+    $params[] = trim($_POST['real_name']) !== '' ? trim($_POST['real_name']) : null;
+}
+if (isset($_POST['role_id'])) {
+    $roleId = (int)$_POST['role_id'];
+    $chkRole = $pdo->prepare("SELECT COUNT(*) FROM system_roles WHERE id = ?");
+    $chkRole->execute([$roleId]);
+    if ((int)$chkRole->fetchColumn() === 0) {
+        Response::error('角色不存在', 400);
+    }
+    $sets[] = 'role_id = ?';
+    $params[] = $roleId;
+}
+if (isset($_POST['is_active'])) {
+    $sets[] = 'is_active = ?';
+    $params[] = (int)$_POST['is_active'] ? 1 : 0;
+}
+$password = (string)($_POST['password'] ?? '');
+if ($password !== '') {
+    if (strlen($password) < 6) {
+        Response::error('密码长度不能少于6位', 400);
+    }
+    $sets[] = 'password = ?';
+    $params[] = sha1($password);
+}
+
+if (!$sets) {
+    Response::error('没有需要更新的字段', 400);
+}
+
+$params[] = $id;
+$pdo->prepare("UPDATE system_users SET " . implode(', ', $sets) . " WHERE id = ?")->execute($params);
+
+logCurrent('update', 'system', 'system_users', $id, ['before' => ['username' => $old['username'], 'role_id' => $old['role_id'], 'is_active' => $old['is_active']]]);
+Response::success(null, '更新成功');