v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

api/marketing/data_custom.php

@@ -3,16 +3,12 @@
  * 数据定制接口（占位） GET/POST /api/marketing/data_custom.php
  * 后续扩展：定制数据需求提交、报价、交付等。
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'marketing']);
 
-checkPermission('marketing');
 
 $action = $_REQUEST['action'] ?? 'info';
 if ($action === 'submit' && $_SERVER['REQUEST_METHOD'] === 'POST') {
-    checkAjax();
     $content = [
         'contact_name'  => trim($_POST['contact_name'] ?? ''),
         'contact_phone' => trim($_POST['contact_phone'] ?? ''),

api/marketing/edm.php

@@ -7,11 +7,9 @@
  *   filter               按 行业 + 区域 + 关键词 筛选邮箱列表（persons.email + companies 关联联系人邮箱）
  * 入参（filter）：industry / province / city / keyword / page / limit
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'marketing']);
 
-checkPermission('marketing');
 
 $action = $_REQUEST['action'] ?? 'filter';
 $pdo = DB::getInstance()->getPdo();

api/marketing/edm_export.php

@@ -3,12 +3,9 @@
  * EDM 邮箱列表导出接口（CSV） GET/POST /api/marketing/edm_export.php
  * 入参同 edm.php filter：industry / province / city / keyword
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'marketing']);
 
-checkPermission('marketing');
 
 // 仅导出勾选的邮箱（emails 逗号分隔）
 $emailsRaw = trim($_REQUEST['emails'] ?? '');

api/marketing/media_wholesale.php

@@ -3,16 +3,12 @@
  * 媒体批发接口（占位） GET/POST /api/marketing/media_wholesale.php
  * 后续扩展：媒体资源批量询价、下单等。
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'marketing']);
 
-checkPermission('marketing');
 
 $action = $_REQUEST['action'] ?? 'info';
 if ($action === 'inquiry' && $_SERVER['REQUEST_METHOD'] === 'POST') {
-    checkAjax();
     $content = [
         'media_ids' => trim($_POST['media_ids'] ?? ''),
         'remark'    => trim($_POST['remark'] ?? ''),