v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

api/channel/analysis.php

@@ -7,11 +7,9 @@
  * - year 为空 = 全部年份；否则按创建年份过滤
  * 返回：{ years, company: [{channel, count, percent, details:[{source,count}]}], person: [...] }
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/Api.php';
 
-checkPermission('channel');
+Api::boot(['module' => 'channel']);
 
 $year = trim($_REQUEST['year'] ?? '');
 if ($year !== '' && (!ctype_digit($year) || (int)$year < 2000 || (int)$year > 2100)) {
@@ -32,6 +30,10 @@ $years = $pdo->query(
 /** 单维度渠道分析 */
 function channelAnalysis($pdo, $table, $year)
 {
+    // REV-9：表名白名单，杜绝 SQL 插值
+    if (!in_array($table, ['companies', 'persons'], true)) {
+        Response::error('参数错误', 400);
+    }
     $where = 'is_active = 1 AND source_channel IS NOT NULL AND source_channel <> \'\'';
     $params = [];
     if ($year !== '') {

api/channel/plan_delete.php

@@ -3,13 +3,9 @@
  * 渠道新增计划删除接口  POST /api/channel/plan_delete.php
  * 入参：id（必填）；软删除（is_active = 0）
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'channel']);
 
-checkAjax();
-checkPermission('channel');
 
 $id = (int)($_POST['id'] ?? 0);
 if ($id <= 0) {

api/channel/plan_list.php

@@ -5,11 +5,9 @@
  * 参数：page / limit / channel_type / status / keyword
  * 返回：{ list, total, page, limit }（list 含 remaining_days 剩余天数）
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'channel']);
 
-checkPermission('channel');
 
 [$page, $limit] = pageParams();
 $channelType = trim($_REQUEST['channel_type'] ?? '');

api/channel/plan_save.php

@@ -5,14 +5,9 @@
  *       source_detail / occurrence_address（发生地址）/ industry / start_date / end_date / remark / status（待启动|已执行|错过）/ cost（费用(元)）
  * 说明：编辑（传 id）时仅更新提交的字段，便于列表行内实时改状态/费用。
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/helpers.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'channel']);
 
-checkAjax();
-checkPermission('channel');
 
 $id = (int)($_POST['id'] ?? 0);