Commit Graph
64 Commits
Author SHA1 Message Date
miaomiao 91cd009899 P0: 删除 Web 更新链路,修复 setup/proxy/email 安全漏洞
- 删除 /api/update/check 与 /api/update/run(无鉴权 RCE 面 + .git 覆盖风险)
- cli.js upgrade 仅保留 git pull 分支,删除 GitHub zip 下载分支
- admin 前端移除更新按钮与 checkUpdate/runUpdate
- JWT_SECRET 启动时随机生成写入 .env.json,删除硬编码回退
- /api/setup/complete 加 adminOnly;/setup/status 移除 default_password 泄露
- /api/proxy/fetch 加 adminOnly + 内网地址拦截(SSRF)
- send-verify 验证码不再回显,改 crypto.randomInt,修复 pending 重建 bug
2026-08-06 21:22:04 +08:00
miaomiao e7f8b3f173 v1.4.2: PJAX router, auto-hide music embed, update script fix
- PJAX navigation: nav clicks fetch & replace <main> seamlessly
- router.js dynamically loads page-specific JS (blog/forum/admin)
- Music embed: global on/off toggle, hover-based auto-collapse
- Update script restored to download-based (no git dependency)
- All PJAX pages have #musicEmbed container (index, blog, forum, admin, passwords)
- Version bump to 1.4.2
2026-07-02 02:22:09 +08:00
miaomiao a30a628772 fix: add musicEmbed container to admin.html for PJAX persistence 2026-07-02 02:09:32 +08:00
miaomiao cd290ff237 PJAX router + music embed with auto-hide
- router.js: intercept nav clicks, fetch page via AJAX, replace <main> content
- Blog/Forum/Admin/Homepage init functions extracted for PJAX re-init
- music-embed.js: hover-based auto-hide (leave → 10s timer → collapse)
- Settings: music_embed_code, position, pages, autohide, idle_timeout
- New keys replace old homepage_music_embed/position (auto-migrated)
2026-07-02 02:00:49 +08:00
miaomiao f7f30af569 v1.4.1: theme color refactor, UI restructuring, markdown improvements 2026-07-01 23:46:01 +08:00
miaomiao bd0c0442ab feat: add public settings endpoint and update settings retrieval in frontend 2026-07-01 19:41:06 +08:00
shanshuilala 73e145df07 v1.1.1: captcha refactor, Turnstile support, SEO, forum boards, icon fixes 2026-06-21 18:05:05 +08:00
shanshuilala 6ffbf19aff Refactor forum.js for improved post and category handling; add sub-category support and enhance captcha verification in login and registration; implement update check and run functionality in server.js; improve captcha generation with noise and difficulty adjustments. 2026-06-21 00:54:49 +08:00
shanshuilala 2e6eeadfc1 feat: 增加数据库导入功能,支持从旧版 RainWeb 导入数据,优化验证码处理逻辑 2026-06-20 21:57:04 +08:00
shanshuilala 608adac6d4 feat: add content rendering and article writing features
- Implemented a content renderer in `render.js` to handle Markdown and custom tags for images and files.
- Created a new article writing page in `write.html` with a form for title, excerpt, and content, including upload functionality for images and files.
- Added server-side rendering functions in `ssr.js` for blog and forum posts, including support for generating a sitemap.
2026-06-20 18:19:06 +08:00
shanshuilala c479b3a31a feat: add proxy route for fetching external URLs and handling CSP headers
- Implemented a new proxy route in `routes/proxy.js` to fetch content from external URLs.
- The proxy handles URL validation, stripping of certain headers, and rewriting of relative URLs to absolute.
- Added a new batch script `start.bat` for easier server startup and dependency installation.
- Included instructions for accessing the server and default admin credentials in the batch script.
- Added a new release file `rainweb-win.zip`.
2026-06-19 23:08:20 +08:00
shanshuilala 2fd2cd01e9 优化验证码生成和验证逻辑,增加错误处理和状态反馈 2026-06-19 21:44:33 +08:00
shanshuilala bee5517f18 Refactor captcha handling and implement email verification codes
- Removed captcha checks from login, registration, and forum post routes.
- Implemented email verification using 8-digit codes for registration and password changes.
- Updated frontend to handle email verification code input during registration and password change.
- Simplified captcha logic by integrating CAPTCHA verification directly in the frontend.
- Enhanced email templates for verification codes and improved error handling.
- Cleaned up unused code related to captcha and improved overall code structure.
2026-06-19 21:13:51 +08:00
shanshuilala 38689b36f8 first commit 2026-06-19 19:34:04 +08:00