From a6f763ffd888c8176a4a545b47e7bef5a48d7467 Mon Sep 17 00:00:00 2001 From: yangxiangyuan Date: Sat, 1 Aug 2026 21:50:05 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E9=87=8D=E6=9E=84=E8=AE=A4=E8=AF=81?= =?UTF-8?q?=E6=B5=81=E7=A8=8B=EF=BC=8C=E5=8D=87=E7=BA=A7=E5=B7=A5=E5=85=B7?= =?UTF-8?q?=E5=8A=9F=E8=83=BD=E5=B9=B6=E4=BC=98=E5=8C=96=E5=90=8E=E7=AB=AF?= =?UTF-8?q?=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 修复token泄露风险：改用X-Local-Creds-Token请求头传递token，从URL Hash读取set_token避免日志记录 - 重构全站认证逻辑：提取公用工具函数统一各服务的认证校验流程 - 升级投资账本工具：支持本地上传CSV和粘贴文本，移除硬编码路径，适配新参数格式 - 新增403/404/500标准错误响应文件，统一API错误返回格式 - 优化后端配置：关闭ETag，重构CORS中间件，新增全局错误捕获，限制敏感文件访问 - 优化web zen box的Service Worker，支持音频分片请求与断点续传 - 清理冗余前端代码，调整页面格式与权限控制 --- http_errors/403.json | 1 + http_errors/404.json | 1 + http_errors/500.json | 1 + public/common/common.js | 9 +- public/tools/ai-lib/ai-lib.js | 7 +- public/tools/cloud_notes/cloud_notes.js | 7 +- public/tools/cloud_sheets/cloud_sheets.js | 7 +- .../doc_cloud_keeper/doc_cloud_keeper.js | 7 +- public/tools/doc_cloud_keeper/index.html | 2 +- public/tools/investment_ledger/index.html | 6 +- .../investment_ledger/investment_ledger.js | 12 ++- .../language_behavior_lock.js | 14 ++- .../oss_file_cabinet/oss_file_cabinet.js | 19 +++- public/tools/private_clipboard/clipboard.js | 14 ++- public/tools/rational_lock/rational_lock.js | 14 ++- public/tools/web_zen_box/sw.js | 63 +++++++++++-- public/tools/weekly/weekly.js | 7 +- src/server/ai-lib.js | 11 ++- .../skills/email_sender/email.db-wal | Bin 1536792 -> 1668632 bytes src/server/index.js | 89 +++++++++++++++--- src/server/investment_ledger.js | 30 +++--- src/server/language_behavior_lock.js | 11 ++- src/server/oss_file_cabinet.js | 12 ++- src/server/private_clipboard.js | 10 +- src/server/rational_lock.js | 11 ++- src/server/weekly.js | 11 ++- 26 files changed, 304 insertions(+), 72 deletions(-) create mode 100644 http_errors/403.json create mode 100644 http_errors/404.json create mode 100644 http_errors/500.json diff --git a/http_errors/403.json b/http_errors/403.json new file mode 100644 index 0000000..213180c --- /dev/null +++ b/http_errors/403.json @@ -0,0 +1 @@ +{"ok":false,"error":"forbidden"} diff --git a/http_errors/404.json b/http_errors/404.json new file mode 100644 index 0000000..7e686f6 --- /dev/null +++ b/http_errors/404.json @@ -0,0 +1 @@ +{"ok":false,"error":"not_found"} diff --git a/http_errors/500.json b/http_errors/500.json new file mode 100644 index 0000000..6dac872 --- /dev/null +++ b/http_errors/500.json @@ -0,0 +1 @@ +{"ok":false,"error":"internal_error"} diff --git a/public/common/common.js b/public/common/common.js index f7009ec..55bc370 100644 --- a/public/common/common.js +++ b/public/common/common.js @@ -51,10 +51,15 @@ window.cnDateStr = cnDateStr ;(function handleSetToken() { try { const u = new URL(window.location.href) - const token = u.searchParams.get('set_token') + const hashRaw = String(u.hash || '').replace(/^#/, '') + if (!/(^|[?&])set_token=/.test(hashRaw)) return + const hashParams = new URLSearchParams(hashRaw.startsWith('?') ? hashRaw.slice(1) : hashRaw) + const token = hashParams.get('set_token') if (token) { localStorage.setItem('toolbox_creds_token', token) - u.searchParams.delete('set_token') + hashParams.delete('set_token') + const nextHash = hashParams.toString() + u.hash = nextHash ? `#${nextHash}` : '' window.history.replaceState(null, '', u.toString()) } } catch {} diff --git a/public/tools/ai-lib/ai-lib.js b/public/tools/ai-lib/ai-lib.js index ad1b0c5..9d93493 100644 --- a/public/tools/ai-lib/ai-lib.js +++ b/public/tools/ai-lib/ai-lib.js @@ -1292,8 +1292,11 @@ ;(async function tryAutoFill() { try { const token = localStorage.getItem('toolbox_creds_token') || '' - const url = '/api/ai-lib/auth/local_creds' + (token ? '?token=' + encodeURIComponent(token) : '') - const r = await fetch(url, { credentials: 'same-origin', cache: 'no-store' }) + const r = await fetch('/api/ai-lib/auth/local_creds', { + headers: token ? { 'X-Local-Creds-Token': token } : {}, + credentials: 'same-origin', + cache: 'no-store' + }) const d = await r.json().catch(() => null) if (d && d.ok && d.creds) { if (d.creds.username) el('login-user').value = d.creds.username diff --git a/public/tools/cloud_notes/cloud_notes.js b/public/tools/cloud_notes/cloud_notes.js index b5d50a6..682a6cd 100644 --- a/public/tools/cloud_notes/cloud_notes.js +++ b/public/tools/cloud_notes/cloud_notes.js @@ -2095,8 +2095,11 @@ const cn = (() => { ;(async function tryAutoFill() { try { const token = localStorage.getItem('toolbox_creds_token') || '' - const url = '/api/cloud_notes/auth/local_creds' + (token ? '?token=' + encodeURIComponent(token) : '') - const r = await fetch(url, { credentials: 'same-origin', cache: 'no-store' }) + const r = await fetch('/api/cloud_notes/auth/local_creds', { + headers: token ? { 'X-Local-Creds-Token': token } : {}, + credentials: 'same-origin', + cache: 'no-store' + }) const d = await r.json().catch(() => null) if (d && d.ok && d.creds) { if (d.creds.username) el('cn-username').value = d.creds.username diff --git a/public/tools/cloud_sheets/cloud_sheets.js b/public/tools/cloud_sheets/cloud_sheets.js index 1588676..a0a1124 100644 --- a/public/tools/cloud_sheets/cloud_sheets.js +++ b/public/tools/cloud_sheets/cloud_sheets.js @@ -1064,8 +1064,11 @@ const cs = (() => { ;(async function tryAutoFill() { try { const token = localStorage.getItem('toolbox_creds_token') || '' - const url = '/api/cloud_sheets/auth/local_creds' + (token ? '?token=' + encodeURIComponent(token) : '') - const r = await fetch(url, { credentials: 'same-origin', cache: 'no-store' }) + const r = await fetch('/api/cloud_sheets/auth/local_creds', { + headers: token ? { 'X-Local-Creds-Token': token } : {}, + credentials: 'same-origin', + cache: 'no-store' + }) const d = await r.json().catch(() => null) if (d && d.ok && d.creds) { if (d.creds.username) el('cs-username').value = d.creds.username diff --git a/public/tools/doc_cloud_keeper/doc_cloud_keeper.js b/public/tools/doc_cloud_keeper/doc_cloud_keeper.js index ccbf351..c2b4752 100644 --- a/public/tools/doc_cloud_keeper/doc_cloud_keeper.js +++ b/public/tools/doc_cloud_keeper/doc_cloud_keeper.js @@ -1630,8 +1630,11 @@ SHA256: ${esc(result.sha256 || '-')} ;(async function tryAutoFill() { try { const token = localStorage.getItem('toolbox_creds_token') || '' - const url = '/api/doc_cloud_keeper/auth/local_creds' + (token ? '?token=' + encodeURIComponent(token) : '') - const r = await fetch(url, { credentials: 'same-origin', cache: 'no-store' }) + const r = await fetch('/api/doc_cloud_keeper/auth/local_creds', { + headers: token ? { 'X-Local-Creds-Token': token } : {}, + credentials: 'same-origin', + cache: 'no-store' + }) const d = await r.json().catch(() => null) if (d && d.ok && d.creds) { if (d.creds.username) el('dck-username').value = d.creds.username diff --git a/public/tools/doc_cloud_keeper/index.html b/public/tools/doc_cloud_keeper/index.html index 7ec4d91..c2a2ffd 100644 --- a/public/tools/doc_cloud_keeper/index.html +++ b/public/tools/doc_cloud_keeper/index.html @@ -16,7 +16,7 @@
文件数: 0 占用: 0 B - 回收站: 0⚒ + 回收站: 0