v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

api/fragment/hard_update.php

@@ -4,22 +4,14 @@
  * 仅更新硬碎片字段（企业名/联系人/手机/邮箱/身份证/社媒账号/主页链接），不执行转换。
  * 转换请走 hard_convert.php（前端「转软碎片」按钮）。
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
-require_once __DIR__ . '/../common/validate.php';
-require_once __DIR__ . '/../common/duplicate_check.php';
+require_once __DIR__ . '/../common/Api.php';
 
-checkAjax();
-checkPermission('preliminary');
+$pdo = Api::boot(['module' => 'preliminary']);
 
 $id = (int)($_POST['id'] ?? 0);
 if ($id <= 0) {
     Response::error('参数错误', 400);
 }
-
-$pdo = DB::getInstance()->getPdo();
 $stmt = $pdo->prepare("SELECT * FROM preliminary_data WHERE id = ? AND is_active = 1");
 $stmt->execute([$id]);
 $frag = $stmt->fetch();
@@ -45,6 +37,7 @@ $idNumber    = trim($_POST['id_number'] ?? '');
 $platform    = trim($_POST['platform'] ?? '');
 $accountId   = trim($_POST['account_id'] ?? '');
 $profileUrl  = trim($_POST['profile_url'] ?? '');
+$sourceChannel = trim($_POST['source_channel'] ?? ($frag['source_channel'] ?? '')); // REV-4 来源渠道可编辑
 if (!in_array($sourceType, ['company', 'person', 'product', 'need', 'mixed'], true)) {
     Response::error('碎片类型不合法', 400);
 }
@@ -89,7 +82,8 @@ if (!empty($dups)) Response::duplicates($dups);
 $pdo->prepare(
     "UPDATE preliminary_data
      SET source_type = ?, company_name = ?, industry = ?, registration_number = ?, business_role = ?, country = ?, address = ?,
-         person_name = ?, contact_phone = ?, contact_email = ?, work_location = ?, id_number = ?, platform = ?, account_id = ?, profile_url = ?
+         person_name = ?, contact_phone = ?, contact_email = ?, work_location = ?, id_number = ?, platform = ?, account_id = ?, profile_url = ?,
+         source_channel = ?
      WHERE id = ?"
 )->execute([
     $sourceType,
@@ -107,6 +101,7 @@ $pdo->prepare(
     $platform !== '' ? $platform : null,
     $accountId !== '' ? $accountId : null,
     $profileUrl !== '' ? $profileUrl : null,
+    $sourceChannel !== '' ? $sourceChannel : null,
     $id,
 ]);
 
@@ -117,6 +112,7 @@ logCurrent('update', 'fragment', 'preliminary_data', $id, [
     'phone' => $phone,
     'email' => $email,
     'id_number' => $idNumber,
+    'source_channel' => $sourceChannel,
 ]);
 
 Response::success(null, '已保存，点击「转软碎片」完成转换');