go_blog

61 Commits 12 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
kevin	efc30156b9	feat: 站点设置接口 JSON 化——/api/admin/settings/* - settings.go：5 组 save handler 改 JSON 绑定（siteSettingsRequest/ uploadSettingsRequest/downloadSettingsRequest/commentSettingsRequest/ navLinkSettingsRequest）；request struct 变更子函数签名（不再触碰 c.PostForm），upload/navlink/download 的 action 分发保留，未知 action 返回 400；enabled 用 *bool（nil 沿用旧默认启用语义） - favicon/logo 上传拆出：POST /api/admin/settings/site/favicon\|logo （multipart，图片类别校验 + 旧本地文件替换），SiteSettingsSave 只处理文本/URL/clear（存储路径校验保留 illegal_dir 400） - main.go：设置旧 POST 路由移除，新 /api/admin/settings 分组注册 - 模板：base.html 新增 blogSettingsForm 委托（data-api-url/data-action/ data-confirm → POST + redirect/alert）；settings_site 主表单 JSON + logo/favicon 选择即上传；navlinks/upload/download/comments 页全部小表单改委托（约 14 个） - blogForm：剔除 file 字段（文件走 multipart） - 测试：TestStorageDirTraversalRejected、TestAddUploadFileTypeRejectsDangerousExtensions 更新 JSON 断言；env 路由补 /api/admin/settings - main_test 冒烟补设置 API 断言；go build/vet/test 全绿	2026-08-27 19:52:07 +08:00
kevin	38cd09f723	fix: 安全加固，修复 P0/P1 安全漏洞 P0（高危）: - 新增全局 CSRF 中间件（同步器令牌），覆盖全部 30 个表单与 AJAX 请求 - 修复附件上传/列表/删除越权（IDOR），增加 admin/上传者/文章作者所有权校验 - 登录/注册成功后会话轮换，修复会话固定 - 会话密钥改用 crypto/rand 生成，配置缺失 secret 时拒绝启动 P1（中危）: - session 与 comment_uid cookie 增加 Secure/SameSite 标志 - 新增安全响应头：CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等 - 新增 web.trusted_proxies 配置，修复 X-Forwarded-For 伪造 - 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争补充 17 个安全回归测试（middleware/handlers），go test -race 全绿	2026-08-19 12:33:09 +08:00
kevinandClaude Fable 5	d9bb91af00	feat: add navigation links management and user registration Features: - Custom navigation links management in admin settings - Multi-language support for navigation links (Chinese/English) - Control link behavior (open in new window) - Sort order and enable/disable toggle for nav links - User registration system with validation - Admin can enable/disable user registration - Registration form with username, display name, email, password - Link to registration from login page Navigation Links: - Admin interface to add/edit/delete custom nav links - Support for both internal and external URLs - Display links in header navigation bar - Respects language preference User Registration: - Username validation (3-32 characters, alphanumeric + underscore/dash) - Password validation (minimum 6 characters) - Password confirmation matching - Optional display name and email fields - Can be toggled on/off by admin in site settings Templates: - Added navigation links settings page - Added user registration page - Updated login page with registration link - Updated base layout to render custom nav links Documentation: - NAV_LINKS_FEATURE.md - Navigation links feature documentation - REGISTRATION_FEATURE.md - User registration documentation - IMPLEMENTATION_SUMMARY.md - Overall implementation summary Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-22 21:01:38 +08:00

Author

SHA1

Message

Date

kevin

efc30156b9

feat: 站点设置接口 JSON 化——/api/admin/settings/*

- settings.go：5 组 save handler 改 JSON 绑定（siteSettingsRequest/
  uploadSettingsRequest/downloadSettingsRequest/commentSettingsRequest/
  navLinkSettingsRequest）；request struct 变更子函数签名（不再触碰
  c.PostForm），upload/navlink/download 的 action 分发保留，未知
  action 返回 400；enabled 用 *bool（nil 沿用旧默认启用语义）
- favicon/logo 上传拆出：POST /api/admin/settings/site/favicon|logo
  （multipart，图片类别校验 + 旧本地文件替换），SiteSettingsSave 只
  处理文本/URL/clear（存储路径校验保留 illegal_dir 400）
- main.go：设置旧 POST 路由移除，新 /api/admin/settings 分组注册
- 模板：base.html 新增 blogSettingsForm 委托（data-api-url/data-action/
  data-confirm → POST + redirect/alert）；settings_site 主表单 JSON +
  logo/favicon 选择即上传；navlinks/upload/download/comments 页全部
  小表单改委托（约 14 个）
- blogForm：剔除 file 字段（文件走 multipart）
- 测试：TestStorageDirTraversalRejected、TestAddUploadFileTypeRejectsDangerousExtensions
  更新 JSON 断言；env 路由补 /api/admin/settings
- main_test 冒烟补设置 API 断言；go build/vet/test 全绿

2026-08-27 19:52:07 +08:00

kevin

38cd09f723

fix: 安全加固，修复 P0/P1 安全漏洞

P0（高危）:
- 新增全局 CSRF 中间件（同步器令牌），覆盖全部 30 个表单与 AJAX 请求
- 修复附件上传/列表/删除越权（IDOR），增加 admin/上传者/文章作者所有权校验
- 登录/注册成功后会话轮换，修复会话固定
- 会话密钥改用 crypto/rand 生成，配置缺失 secret 时拒绝启动

P1（中危）:
- session 与 comment_uid cookie 增加 Secure/SameSite 标志
- 新增安全响应头：CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等
- 新增 web.trusted_proxies 配置，修复 X-Forwarded-For 伪造
- 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争

补充 17 个安全回归测试（middleware/handlers），go test -race 全绿

2026-08-19 12:33:09 +08:00

kevinandClaude Fable 5

d9bb91af00

feat: add navigation links management and user registration

Features:
- Custom navigation links management in admin settings
- Multi-language support for navigation links (Chinese/English)
- Control link behavior (open in new window)
- Sort order and enable/disable toggle for nav links
- User registration system with validation
- Admin can enable/disable user registration
- Registration form with username, display name, email, password
- Link to registration from login page

Navigation Links:
- Admin interface to add/edit/delete custom nav links
- Support for both internal and external URLs
- Display links in header navigation bar
- Respects language preference

User Registration:
- Username validation (3-32 characters, alphanumeric + underscore/dash)
- Password validation (minimum 6 characters)
- Password confirmation matching
- Optional display name and email fields
- Can be toggled on/off by admin in site settings

Templates:
- Added navigation links settings page
- Added user registration page
- Updated login page with registration link
- Updated base layout to render custom nav links

Documentation:
- NAV_LINKS_FEATURE.md - Navigation links feature documentation
- REGISTRATION_FEATURE.md - User registration documentation
- IMPLEMENTATION_SUMMARY.md - Overall implementation summary

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-22 21:01:38 +08:00