v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

api/media/add.php

@@ -4,16 +4,9 @@
  * 必填：owner_type / owner_id / platform / account_id
  * 可选：profile_url / remark / is_primary + 商业属性（account_level/certification_type/follower_count 等）
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
-require_once __DIR__ . '/../common/helpers.php';
-require_once __DIR__ . '/../common/completeness.php';
-require_once __DIR__ . '/../common/duplicate_check.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkAjax();
-checkPermission('media');
 
 $data = extractFields(MEDIA_FIELDS);
 if (!in_array($data['owner_type'] ?? '', ['person', 'company'], true)) {

api/media/delete.php

@@ -3,13 +3,9 @@
  * 媒体数据删除接口（软删除） POST /api/media/delete.php
  * 入参：id（或 ids 逗号分隔批量）
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkAjax();
-checkPermission('media');
 
 $id  = (int)($_POST['id'] ?? 0);
 $ids = trim($_POST['ids'] ?? '');

api/media/detail.php

@@ -2,11 +2,9 @@
 /**
  * 媒体数据详情接口  GET /api/media/detail.php?id=1
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkPermission('media');
 
 $id = (int)($_REQUEST['id'] ?? 0);
 if ($id <= 0) {

api/media/export.php

@@ -3,12 +3,9 @@
  * 媒体数据导出接口（CSV） GET/POST /api/media/export.php
  * 参数同 list.php
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkPermission('media');
 
 // 仅导出勾选的媒体账号
 $idsRaw = trim($_REQUEST['ids'] ?? '');

api/media/import.php

@@ -5,14 +5,9 @@
  *           account_level,content_categories,follower_count,avg_read_count,certification_type
  * owner_type 为 person/company 时 owner_id 也可填对应名称（display_name/full_name），自动解析为ID。
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
-require_once __DIR__ . '/../common/completeness.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkAjax();
-checkPermission('media');
 
 if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
     Response::error('请选择要上传的CSV文件', 400);

api/media/list.php

@@ -4,11 +4,9 @@
  * 参数：page / limit / keyword / platform / certification_type / account_level / owner_type / is_active
  * 数据源：social_accounts JOIN media_commercial_attributes
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkPermission('media');
 
 [$page, $limit] = pageParams();
 $keyword = trim($_REQUEST['keyword'] ?? '');

api/media/update.php

@@ -3,16 +3,9 @@
  * 媒体数据编辑接口  POST /api/media/update.php
  * 入参：id + 白名单字段（含商业属性）
  */
-require_once __DIR__ . '/../common/db.php';
-require_once __DIR__ . '/../common/response.php';
-require_once __DIR__ . '/../common/auth.php';
-require_once __DIR__ . '/../common/logger.php';
-require_once __DIR__ . '/../common/helpers.php';
-require_once __DIR__ . '/../common/completeness.php';
-require_once __DIR__ . '/../common/duplicate_check.php';
+require_once __DIR__ . '/../common/Api.php';
+$pdo = Api::boot(['module' => 'media']);
 
-checkAjax();
-checkPermission('media');
 
 $id = (int)($_POST['id'] ?? 0);
 if ($id <= 0) {