v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

static/js/fragment.js

@@ -333,6 +333,7 @@ $(function () {
                 '<form id="cv-form" style="padding:16px 22px 4px;">' +
                 '<div class="form-grid">' +
                 '  <div class="form-item"><label>碎片类型<span class="req">*</span></label>' + typeSel + '</div>' +
+                '  <div class="form-item"><label>来源渠道</label><select name="source_channel" id="cv-source"><option value="">-</option></select></div>' +
                 '  <div class="form-item" id="cv-f-company_name"><label>公司名称</label><input type="text" name="company_name" value="' + escHtml(d.company_name || '') + '"></div>' +
                 '  <div class="form-item" id="cv-f-person_name"><label>联系人</label><input type="text" name="person_name" value="' + escHtml(d.person_name || '') + '"></div>' +
                 '  <div class="form-item"><label>联系电话</label><input type="text" name="contact_phone" value="' + escHtml(d.contact_phone || '') + '"></div>' +
@@ -363,6 +364,14 @@ $(function () {
                 btn: false
             });
             $('#cv-platform').val(d.platform || '');
+            // 来源渠道选项（与 source_channels 字典保持一致），并回显当前值
+            httpGet('common/dicts.php', { type: 'all' }).then(function (dd) {
+                var html = '<option value="">-</option>';
+                (dd.source_channels || []).forEach(function (c) {
+                    html += '<option value="' + escHtml(c.name) + '">' + escHtml(c.name) + '</option>';
+                });
+                $('#cv-source').html(html).val(d.source_channel || '');
+            }).catch(function () {});
 
             function syncFields() {
                 var t = $('#cv-type').val();