修复工单系统竞态与接口安全问题

frontend/src/pages/TicketCreate.jsx

@@ -5,7 +5,7 @@ import { getToken } from '../api/client.js';
 import { safeSourceUrl } from './Tickets.jsx';
 
 const categories = [['forum_bug', '论坛 Bug'], ['site_bug', '站内 Bug'], ['feature', '功能建议'], ['account', '账号问题'], ['other', '其他问题']];
-const priorities = [['low', '普通'], ['normal', '一般'], ['high', '重要'], ['urgent', '紧急']];
+const priorities = [['low', '低'], ['normal', '普通'], ['high', '高'], ['urgent', '紧急']];
 
 export default function TicketCreate() {
   const navigate = useNavigate();
@@ -26,12 +26,19 @@ export default function TicketCreate() {
     if (description.length < 10) { setError('请详细描述问题（至少 10 个字）'); return; }
     setError(''); setBusy(true);
     try {
+      const sourceValue = String(form.source_url ?? '');
+      const sourceUrl = safeSourceUrl(sourceValue);
+      const hasInvalidSource = sourceValue.trim() || /[\u0000-\u001f\u007f-\u009f]/.test(sourceValue) || sourceValue.includes('\\');
+      if (hasInvalidSource && !sourceUrl) {
+        setError('来源地址不合法，请填写站内路径或 http/https 地址');
+        return;
+      }
       const data = await ticketsApi.createTicket({
         ...form,
         subject,
         description,
         source: form.category === 'forum_bug' ? 'forum' : 'site',
-        source_url: safeSourceUrl(form.source_url),
+        source_url: sourceUrl,
         browser_info: [navigator.userAgent, `${window.innerWidth}x${window.innerHeight}`].join(' | ').slice(0, 1000),
       });
       if (!data.ticket || !data.ticket.id) throw new Error('工单创建成功但未返回编号');