weizhiqiang/superlink
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Browse Source 
Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
qianqiuwanzi
2026-09-17 14:48:17 +08:00
parent 69fd4246c2
commit c86f08c325
91 changed files with 1072 additions and 463 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/auth/forgot.php
+3 -6
View File
@@ -3,14 +3,11 @@
* 找回密码接口 POST /api/auth/forgot.php
* 入参：username / contact_email
* 说明：占位实现 —— 校验账号存在后返回成功（后续可接入 SMTP 发送重置邮件/短信验证码）。
* 批次1：经 Api::boot(['public' => true]) 免登录，但写请求仍校验 Ajax + CSRF。
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/Api.php';
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
Response::error('请求方式错误', 400);
}
Api::boot(['public' => true]);
$username = trim($_POST['username'] ?? '');
$contactEmail = trim($_POST['contact_email'] ?? '');