v1.0.51: 批次1架构筑基 - 1)版本迁移(common/migrate.php+schema_versions+natsort迁移文件);2)登录安全(bcrypt平滑迁移login/user_add/user_update旧sha1命中自动重写+system_login_attempts限流+session加固httponly/samesite/secure);3)CSRF Token(服务端checkCsrf+auth/csrf.php登录页取token+前端common.js/login.js统一携带X-CSRF-Token);4)统一基座common/Api.php并存量强制迁移全部70个endpoint(Api::boot按public/super/module/permissions分流,写接口强制checkAjax+checkCsrf,全局异常处理);5)前端收敛(common.js新增esc转义别名);6)REV-4硬数据来源渠道可编辑(hard_update+补全弹窗下拉);7)prepared卫生(soft_update.php修复+analysis.php表名白名单REV-9)

Co-Authored-By: Claude Code <noreply@anthropic.com>

static/js/login.js

@@ -8,6 +8,14 @@ $(function () {
         $('#login-btn').prop('disabled', false);
     });
 
+    // 未登录场景：先从 auth/csrf.php 取会话绑定的 CSRF Token，写接口统一携带
+    window.CSRF_TOKEN = '';
+    $.getJSON(BASE_URL + 'auth/csrf.php').done(function (resp) {
+        if (resp && resp.code === 0 && resp.data && resp.data.csrf_token) {
+            window.CSRF_TOKEN = resp.data.csrf_token;
+        }
+    });
+
     // 回车提交
     $('#password').on('keydown', function (e) {
         if (e.keyCode === 13) doLogin();
@@ -15,6 +23,10 @@ $(function () {
 
     $('#login-btn').on('click', doLogin);
 
+    function csrfHeaders() {
+        return { 'X-Requested-With': 'XMLHttpRequest', 'X-CSRF-Token': window.CSRF_TOKEN || '' };
+    }
+
     function doLogin() {
         var username = $.trim($('#username').val());
         var password = $('#password').val();
@@ -27,7 +39,7 @@ $(function () {
             url: BASE_URL + 'auth/login.php',
             method: 'POST',
             dataType: 'json',
-            headers: { 'X-Requested-With': 'XMLHttpRequest' },
+            headers: csrfHeaders(),
             data: { username: username, password: password, slider_token: sliderToken }
         }).done(function (resp) {
             if (resp.code === 0) {
@@ -80,7 +92,7 @@ $(function () {
                     url: BASE_URL + 'auth/forgot.php',
                     method: 'POST',
                     dataType: 'json',
-                    headers: { 'X-Requested-With': 'XMLHttpRequest' },
+                    headers: csrfHeaders(),
                     data: { username: username, contact_email: email }
                 }).done(function (resp) {
                     var color = resp.code === 0 ? '#27ae60;background:#eafaf1;border:1px solid #a9dfbf' : '#c0392b;background:#fdecea;border:1px solid #f5c6cb';