v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

api/channel/analysis.php

@@ -7,11 +7,9 @@
  * - year 为空 = 全部年份；否则按创建年份过滤
  * 返回：{ years, company: [{channel, count, percent, details:[{source,count}]}], person: [...] }
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/Api.php';
 
-checkPermission('channel');
+Api::boot(['module' => 'channel']);
 
 $year = trim($_REQUEST['year'] ?? '');
 if ($year !== '' && (!ctype_digit($year) || (int)$year < 2000 || (int)$year > 2100)) {
@@ -32,6 +30,10 @@ $years = $pdo->query(
 /** 单维度渠道分析 */
 function channelAnalysis($pdo, $table, $year)
 {
+    // REV-9：表名白名单，杜绝 SQL 插值
+    if (!in_array($table, ['companies', 'persons'], true)) {
+        Response::error('参数错误', 400);
+    }
     $where = 'is_active = 1 AND source_channel IS NOT NULL AND source_channel <> \'\'';
     $params = [];
     if ($year !== '') {