miaomiao
f6407a84f7
- setup /complete 改 setup_complete 门禁（修复新装死锁），新密码禁止等于默认 - 验证码 proof 全链路贯通：前端 captcha.js/api/login/register/forum 传 captcha_proof；consumeProof 一次性消费 + jti 防同秒碰撞；删除死端点与死代码 - render.js 引入 DOMPurify 净化 markdown（SPA 侧存储型 XSS） - email.js SMTP 检查提前；avatar 强正则白名单；register 验证码 crypto.randomInt
44 lines
1.5 KiB
JavaScript
44 lines
1.5 KiB
JavaScript
const express = require('express');
|
|
const bcrypt = require('bcryptjs');
|
|
const db = require('../db');
|
|
|
|
const router = express.Router();
|
|
|
|
router.get('/status', (req, res) => {
|
|
const completed = db.getSetting('setup_complete');
|
|
const adminUser = db.get('SELECT id, username FROM users WHERE role = ?', ['admin']);
|
|
res.json({
|
|
setup_complete: completed === '1',
|
|
has_admin: !!adminUser
|
|
});
|
|
});
|
|
|
|
router.post('/complete', (req, res) => {
|
|
if (db.getSetting('setup_complete') === '1') return res.status(403).json({ error: '初始化已完成' });
|
|
const { password, site_name, primary_color, theme_preset } = req.body;
|
|
|
|
// Change admin password
|
|
if (password) {
|
|
if (password === 'admin123') return res.status(400).json({ error: '新密码不能与默认密码相同' });
|
|
const adminUser = db.get('SELECT id FROM users WHERE role = ?', ['admin']);
|
|
if (adminUser) {
|
|
// Verify not default
|
|
if (bcrypt.compareSync('admin123', db.get('SELECT password FROM users WHERE id = ?', [adminUser.id]).password)) {
|
|
const hash = bcrypt.hashSync(password, 10);
|
|
db.run('UPDATE users SET password = ? WHERE id = ?', [hash, adminUser.id]);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Save settings
|
|
if (site_name) db.setSetting('site_name', site_name);
|
|
if (primary_color) db.setSetting('primary_color', primary_color);
|
|
if (theme_preset) db.setSetting('theme_preset', theme_preset);
|
|
|
|
db.setSetting('setup_complete', '1');
|
|
|
|
res.json({ message: '初始化完成', redirect: '/' });
|
|
});
|
|
|
|
module.exports = router;
|