2 Commits

Include renames

Author	SHA1	Message	Date
kevin	f7870e8557	fix: 修复 P0 复审漏洞 #18 #19（数据库泄露 + SQL 注入） ... - #18 /uploads 改为白名单子目录挂载（attachments/avatars/logos + 配置的 存储目录），存储根不再整体暴露，blog.db 不可被下载；禁用目录列表， 拒绝 .. 穿越与反斜杠 - #19 admin 用户管理三个 handler 的路由参数先解析为数值（uintFormID）， 非数值直接 302，消除 GORM First() 字符串条件 SQL 注入 - 新增回归测试 main_test.go（4 用例）与 TestAdminUserRoutesRejectNonNumericIDs （已变异验证：旧代码下注入用例失败） - SECURITY_TODO.md 勾选 #18/#19 并更新执行顺序	2026-08-27 17:08:22 +08:00
kevin	cefaeac618	feat: add admin user management with role-based access and self-protection ... - Add AdminRequired middleware for admin-role routes - Add login status check to reject disabled/locked accounts - Add CRUD handlers (list, create, edit, delete) for users - Add user_list and user_form templates with role/status badges - Add nav entry and dashboard button for user management - Add dynamic user count on admin dashboard - Fix userIDFromSession to handle all numeric session types - Self-protection: cannot delete/disable self or demote last admin - Add EN/ZH i18n keys for all user management strings	2026-06-22 18:11:39 +08:00