2 Commits

Include renames

Author	SHA1	Message	Date
kevin	c9f858b626	fix: 完成 P2 安全修复 #9-13 #22-25 ... - #9 CDN 本地化：marked/DOMPurify/highlight.js/cropperjs/easymde 入 static/vendor（go:embed），Tailwind 改静态构建（scripts/build_tailwind.sh），CSP 收紧为 default-src 'self' - #10 登录限速：IP+用户名维度 5 次失败锁 15 分钟，内存实现有界（handlers/login_ratelimit.go） - #25 计时侧信道：用户不存在时执行 dummy bcrypt 抹平时间差（随 #10 实施） - #11 配置文件权限 0640 - #12 首启随机一次性密码（弃用 admin/admin） - #13 unix socket 660 + 代理用户加组提示 - #22 storage_dir 路径穿越校验（单安全路径段） - #23 密码最小长度统一（改密/建号/重置），#24 邮箱格式统一校验 - 新增 13 个单元测试；go test ./... 含 -race 全绿	2026-08-27 18:10:22 +08:00
kevinandClaude Fable 5	b600eac21c	feat: add favicon settings to site configuration ... - Add Favicon field to SiteSetting model with FaviconIsURL() helper - Implement favicon upload and management in site settings page - Support both external URL and local file upload for favicon - Add favicon display in page header with automatic URL detection - Add i18n translations for favicon settings (EN/ZH) - Update middleware and helpers to pass favicon data to templates - Include migration script for existing databases Users can now customize their site's favicon from /admin/settings/site by either providing an external URL or uploading a local image file (recommended formats: .ico, .png, .svg, 16x16 or 32x32 pixels). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-22 20:09:05 +08:00