8 Commits

Include renames

Author	SHA1	Message	Date
kevin	38cd09f723	fix: 安全加固，修复 P0/P1 安全漏洞 ... P0（高危）: - 新增全局 CSRF 中间件（同步器令牌），覆盖全部 30 个表单与 AJAX 请求 - 修复附件上传/列表/删除越权（IDOR），增加 admin/上传者/文章作者所有权校验 - 登录/注册成功后会话轮换，修复会话固定 - 会话密钥改用 crypto/rand 生成，配置缺失 secret 时拒绝启动 P1（中危）: - session 与 comment_uid cookie 增加 Secure/SameSite 标志 - 新增安全响应头：CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等 - 新增 web.trusted_proxies 配置，修复 X-Forwarded-For 伪造 - 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争 补充 17 个安全回归测试（middleware/handlers），go test -race 全绿	2026-08-19 12:33:09 +08:00
kevin	2875918289	修改运行路径	2026-06-24 11:32:45 +08:00
kevin	fe69a2e38b	up	2026-06-23 15:16:50 +08:00
kevin	d8779ed5bf	修复安装问题	2026-06-23 14:57:36 +08:00
kevin	a316932d3f	up	2026-06-23 11:23:33 +08:00
kevin	4f6c24cc49	up	2026-06-21 18:35:12 +08:00
kevin	126e1d9234	增加mysql配置	2026-06-21 01:54:43 +08:00
kevinandClaude Opus 4.8	c82d4482d4	feat: initial blog engine with multi-language, profile, and role system ... - Gin + GORM + Tailwind CSS blog engine - OS-aware config (Linux /etc/blog_go/, Windows ./win/etc/blog_go/) - SQLite by default, MySQL support via config - Auto-migrate database + seed admin user on first run - Session-based auth (login/logout) - i18n: Chinese/English with auto-detect + manual switch - Avatar dropdown nav with click-to-toggle menu - Profile page: avatar upload, edit info, change password - Role system: admin (full access) and author (profile only) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 01:49:04 +08:00