weizhiqiang/superlink
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Browse Source 
Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
qianqiuwanzi
2026-09-17 14:48:17 +08:00
parent 69fd4246c2
commit c86f08c325
91 changed files with 1072 additions and 463 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/company/add.php
+2 -9
View File
@@ -3,16 +3,9 @@
* 企业新增接口 POST /api/company/add.php
* 必填：display_name；其余字段见 COMPANY_FIELDS 白名单
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/helpers.php';
require_once __DIR__ . '/../common/completeness.php';
require_once __DIR__ . '/../common/duplicate_check.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkAjax();
checkPermission('company');
$data = extractFields(COMPANY_FIELDS);
// 显示名称不再单独录入：取中文名称（数据库 display_name 为 NOT NULL）
api/company/cert_types.php
+2 -4
View File
@@ -4,11 +4,9 @@
* 返回启用中的认证类型（如：瞪羚企业、国家高新技术企业等），供编辑弹窗下拉使用
* 数据源：data_dict_certificate（原 certification_types，v1.0.16 改名，v1.0.18 再改名 data_dict_certificate）
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
$pdo = DB::getInstance()->getPdo();
$types = $pdo->query("SELECT id, name FROM data_dict_certificate WHERE is_active = 1 ORDER BY sort_order, id")->fetchAll();
api/company/delete.php
+2 -6
View File
@@ -3,13 +3,9 @@
* 企业删除接口（软删除） POST /api/company/delete.php
* 入参：id（或 ids 逗号分隔批量）
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkAjax();
checkPermission('company');
$id = (int)($_POST['id'] ?? 0);
$ids = trim($_POST['ids'] ?? '');
api/company/detail.php
+2 -4
View File
@@ -3,11 +3,9 @@
* 企业详情接口 GET /api/company/detail.php?id=1
* 返回企业主表信息 + 关联数据（产品品类/文档/财务/资质/联系方式）
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
$id = (int)($_REQUEST['id'] ?? 0);
if ($id <= 0) {
api/company/employees.php
+2 -4
View File
@@ -4,11 +4,9 @@
* 入参：company_id（必填）/ page / limit / keyword（姓名）/ job_level（职级）
* 数据源：persons JOIN person_work_experiences（按公司），联系方式取 social_accounts
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
$companyId = (int)($_REQUEST['company_id'] ?? 0);
if ($companyId <= 0) {
api/company/export.php
+2 -5
View File
@@ -3,12 +3,9 @@
* 企业导出接口（CSV） GET/POST /api/company/export.php
* 入参：ids（必填，勾选的企业ID，逗号分隔）——只导出勾选的企业
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
// 仅导出勾选的企业
$idsRaw = trim($_REQUEST['ids'] ?? '');
api/company/import.php
+2 -7
View File
@@ -6,14 +6,9 @@
* registered_capital,established_date,is_listed,stock_code
* 仅 display_name 为必填。
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/completeness.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkAjax();
checkPermission('company');
if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
Response::error('请选择要上传的CSV文件', 400);
api/company/list.php
+2 -4
View File
@@ -8,11 +8,9 @@
* 参数：page / limit / keyword / field / industry / company_type / is_active
* 返回：{ list, total, page, limit }
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
[$page, $limit] = pageParams();
$keyword = trim($_REQUEST['keyword'] ?? '');
api/company/official_media_add.php
+2 -9
View File
@@ -5,16 +5,9 @@
* 入参：company_id（必填）/ platform（平台）/ account_id（账号名称）/ profile_url（主页链接）/
* remark / is_active（1启用 0停用）/ is_defult（1常用）
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/helpers.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/completeness.php';
require_once __DIR__ . '/../common/duplicate_check.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkAjax();
checkPermission('company');
$companyId = (int)($_POST['company_id'] ?? 0);
$platform = trim($_POST['platform'] ?? '');
api/company/official_media_list.php
+2 -4
View File
@@ -5,11 +5,9 @@
* 字段：平台/账号名称/ID/主页链接/状态/更新日期
* 入参：company_id（必填）/ page / limit
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
$companyId = (int)($_REQUEST['company_id'] ?? 0);
if ($companyId <= 0) {
api/company/product_add.php
+2 -7
View File
@@ -5,14 +5,9 @@
* is_active（1在产 0停产）/ attrs（可选 JSON：[{attr_id, value}]，EAV 参数值）
* 说明：attr_id 来自 company_products_attr（按企业所属行业定义的参数属性）
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/helpers.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkAjax();
checkPermission('company');
$companyId = (int)($_POST['company_id'] ?? 0);
$categoryName = trim($_POST['category_name'] ?? '');
api/company/product_attrs.php
+2 -4
View File
@@ -3,11 +3,9 @@
* 产品参数属性定义接口 GET /api/company/product_attrs.php?industry=汽车制造
* 返回指定行业的参数属性定义（EAV），供新增产品弹窗动态生成参数输入项
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
$industry = trim($_REQUEST['industry'] ?? '');
if ($industry === '') {
api/company/products.php
+2 -4
View File
@@ -4,11 +4,9 @@
* v1.0.18：返回产品基础字段（产品品类/基本定位/包含系列/状态/更新日期）+ EAV 参数值（JSON）
* 入参：company_id（必填）/ page / limit
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkPermission('company');
$companyId = (int)($_REQUEST['company_id'] ?? 0);
if ($companyId <= 0) {
api/company/update.php
+2 -9
View File
@@ -3,16 +3,9 @@
* 企业编辑接口 POST /api/company/update.php
* 入参：id + 需要更新的白名单字段
*/
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/auth.php';
require_once __DIR__ . '/../common/logger.php';
require_once __DIR__ . '/../common/helpers.php';
require_once __DIR__ . '/../common/completeness.php';
require_once __DIR__ . '/../common/duplicate_check.php';
require_once __DIR__ . '/../common/Api.php';
$pdo = Api::boot(['module' => 'company']);
checkAjax();
checkPermission('company');
$id = (int)($_POST['id'] ?? 0);
if ($id <= 0) {