2 Commits

Include renames

Author	SHA1	Message	Date
kevin	38cd09f723	fix: 安全加固，修复 P0/P1 安全漏洞 ... P0（高危）: - 新增全局 CSRF 中间件（同步器令牌），覆盖全部 30 个表单与 AJAX 请求 - 修复附件上传/列表/删除越权（IDOR），增加 admin/上传者/文章作者所有权校验 - 登录/注册成功后会话轮换，修复会话固定 - 会话密钥改用 crypto/rand 生成，配置缺失 secret 时拒绝启动 P1（中危）: - session 与 comment_uid cookie 增加 Secure/SameSite 标志 - 新增安全响应头：CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等 - 新增 web.trusted_proxies 配置，修复 X-Forwarded-For 伪造 - 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争 补充 17 个安全回归测试（middleware/handlers），go test -race 全绿	2026-08-19 12:33:09 +08:00
kevinandClaude Fable 5	d64c839b10	feat: add role-based access control and user article management ... - Add AdminRequired middleware to all /admin routes for proper authorization - Restrict admin panel, comments, users, settings to admin role only - Create separate /my/articles routes for regular users to manage their own articles - Add MyArticlesPage handler for users to view/edit/delete their own content - Update navigation menus with role-based visibility - Admin dropdown shows only 'Admin Panel' link, other features in dashboard - Regular users see 'My Articles' link in profile dropdown - Add i18n translations for 'my_articles' and 'comment_manage' keys - Fix permission boundary issues where author role could access admin settings Security improvements: - Platform settings now require admin role - Comment moderation requires admin role - User management requires admin role - Regular users can only manage their own articles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-22 18:49:33 +08:00