security+fix: 评审修复——下线webview-token任意账号接管；progress接口付费字段只读；检测题答案脱敏；读接口不记日志；share-gain每日限3次防刷；页面标题/分享标题搜索优化

client/index.html

@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html lang="zh-CN">
   <head>
+    <meta name="sogou_site_verification" content="bZ8oAfjvQm" />
+    <meta name="360-site-verification" content="0cc596886cce77073d8fcba9d5ec7d9c" />
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no, viewport-fit=cover" />
     <link rel="icon" type="image/svg+xml" href="/static/favicon.svg" />

client/src/pages.json

@@ -3,7 +3,7 @@
     {
       "path": "pages/index/index",
       "style": {
-        "navigationBarTitleText": "AI 维度",
+        "navigationBarTitleText": "宇之然AI维度-AI知识学习与人工智能资讯",
         "navigationStyle": "custom",
         "enablePullDownRefresh": true,
         "backgroundTextStyle": "dark"
@@ -19,7 +19,7 @@
     {
       "path": "pages/detail/detail",
       "style": {
-        "navigationBarTitleText": "AI 知识",
+        "navigationBarTitleText": "AI知识详情-人工智能知识点",
         "navigationStyle": "custom"
       }
     },
@@ -33,21 +33,21 @@
     {
       "path": "pages/favorites/favorites",
       "style": {
-        "navigationBarTitleText": "我的收藏",
+        "navigationBarTitleText": "我的AI知识收藏",
         "navigationStyle": "custom"
       }
     },
     {
       "path": "pages/achievements/achievements",
       "style": {
-        "navigationBarTitleText": "成就",
+        "navigationBarTitleText": "我的AI学习成就",
         "navigationStyle": "custom"
       }
     },
     {
       "path": "pages/leaderboard/leaderboard",
       "style": {
-        "navigationBarTitleText": "排行榜",
+        "navigationBarTitleText": "AI学习排行榜",
         "navigationStyle": "custom"
       }
     },
@@ -82,7 +82,7 @@
     {
       "path": "pages/news/news",
       "style": {
-        "navigationBarTitleText": "AI 资讯",
+        "navigationBarTitleText": "AI资讯速递-人工智能热点解读",
         "navigationStyle": "custom",
         "enablePullDownRefresh": true,
         "backgroundTextStyle": "dark"
@@ -91,21 +91,21 @@
     {
       "path": "pages/dimension/dimension",
       "style": {
-        "navigationBarTitleText": "",
+        "navigationBarTitleText": "AI知识星域-五大维度学人工智能",
         "navigationStyle": "custom"
       }
     },
     {
       "path": "pages/chat/chat",
       "style": {
-        "navigationBarTitleText": "AI 问答",
+        "navigationBarTitleText": "AI问答-人工智能知识解答",
         "navigationStyle": "custom"
       }
     },
     {
       "path": "pages/trend/trend",
       "style": {
-        "navigationBarTitleText": "AI 趋势",
+        "navigationBarTitleText": "AI趋势-每日人工智能行业动态",
         "navigationStyle": "custom",
         "enablePullDownRefresh": true,
         "backgroundTextStyle": "dark"

client/src/pages/agreement/agreement.vue

@@ -118,7 +118,7 @@ function onLoad(fn) {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: 'AI知识社区 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/feedback/feedback.vue

@@ -232,7 +232,7 @@ function goBack() {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: '帮AI维度变得更好 · 意见反馈',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/leaderboard/leaderboard.vue

@@ -138,7 +138,7 @@ function dimDotColor(id) {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: 'AI学习排行榜 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/login/login.vue

@@ -324,7 +324,7 @@ function goForgotPassword() {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: '登录解锁AI学习完整功能 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/payment/payment.vue

@@ -291,7 +291,7 @@ function goBack() {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: 'AI知识社区 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/progress/progress.vue

@@ -225,7 +225,7 @@ function goBack() {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: '我的AI学习进度 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/search/search.vue

@@ -192,7 +192,7 @@ onUnmounted(() => {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: '搜一搜想了解的AI知识 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

client/src/pages/settings/settings.vue

@@ -148,7 +148,7 @@ function goBack() {
 // 微信小程序分享
 // #ifdef MP-WEIXIN
 onShareAppMessage(() => ({
-  title: 'AI 维度 - 你的AI知识助手',
+  title: 'AI知识社区 · 宇之然AI维度',
   path: '/pages/index/index'
 }))
 // #endif

server/src/routes/admin.js

@@ -106,7 +106,6 @@ router.get('/dashboard', requirePermission('dashboard:read'), async (req, res) =
       Order.getWeekTrend()
     ])
     
-    await logAction(req, 'read', 'dashboard')
     
     return ApiResponse.success(res, {
       today: {
@@ -201,7 +200,6 @@ router.get('/users', requirePermission('users:read'), async (req, res) => {
       }
     })
     
-    await logAction(req, 'read', 'users', null, { page, limit, search })
     
     return ApiResponse.paginated(res, formattedUsers, {
       page: parseInt(page),
@@ -263,7 +261,6 @@ router.get('/users/:id', requirePermission('users:read'), async (req, res) => {
     
     // 画廊（Gallery）功能已移除，作品数为 0
     
-    await logAction(req, 'read', 'users', req.params.id)
     
     return ApiResponse.success(res, {
       ...user,
@@ -302,7 +299,6 @@ router.get('/knowledge', requirePermission('knowledge:read'), async (req, res) =
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'knowledge', null, { page, limit, dim, status })
     
     return ApiResponse.paginated(res, knowledge, {
       page: parseInt(page),
@@ -435,7 +431,6 @@ router.get('/orders', requirePermission('orders:read'), async (req, res) => {
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'orders', null, { page, limit, status })
     
     return ApiResponse.paginated(res, orders, {
       page: parseInt(page),
@@ -464,7 +459,6 @@ router.get('/shop', requirePermission('shop:read'), async (req, res) => {
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'shop', null, { page, limit, status })
     
     return ApiResponse.paginated(res, items, {
       page: parseInt(page),
@@ -555,7 +549,6 @@ router.get('/admins', requirePermission('*'), async (req, res) => {
       .sort({ createdAt: -1 })
       .lean()
     
-    await logAction(req, 'read', 'admins')
     
     return ApiResponse.success(res, admins)
     
@@ -580,7 +573,6 @@ router.get('/shop-items', requirePermission('shop:read'), async (req, res) => {
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'shop', null, { page, limit, status })
     
     return ApiResponse.paginated(res, items, {
       page: parseInt(page),
@@ -890,7 +882,6 @@ router.get('/feedback', requirePermission('feedback:read'), async (req, res) =>
       hasImages: fb.images?.length > 0
     }))
     
-    await logAction(req, 'read', 'feedback', null, { page, limit, status, type })
     
     return ApiResponse.paginated(res, formattedFeedbacks, {
       page: parseInt(page),
@@ -918,7 +909,6 @@ router.get('/feedback/:id', requirePermission('feedback:read'), async (req, res)
       return ApiResponse.notFound(res, '反馈不存在')
     }
     
-    await logAction(req, 'read', 'feedback', req.params.id)
     
     return ApiResponse.success(res, {
       id: feedback._id,
@@ -1114,7 +1104,6 @@ router.get('/login-logs', requirePermission('user:read'), async (req, res) => {
       createdAt: log.createdAt
     }))
     
-    await logAction(req, 'read', 'login-logs', null, { page, limit })
     
     return ApiResponse.paginated(res, formattedLogs, {
       page: parseInt(page),

server/src/routes/aiChat.js

@@ -227,6 +227,17 @@ router.post('/share-gain', userAuthMiddleware, async (req, res) => {
       quota = new AIChatQuota({ openid })
     }
 
+    // [防刷] 每日分享奖励最多3次
+    const today = new Date().toISOString().slice(0, 10)
+    const shareDate = (quota.shareDate || '').toString().slice(0, 10)
+    const shareCount = shareDate === today ? (quota.shareCount || 0) : 0
+    if (shareCount >= 3) {
+      return ApiResponse.error(res, '今日分享奖励已领完，明天再来吧', 429)
+    }
+    quota.shareDate = new Date()
+    quota.shareCount = shareCount + 1
+    await quota.save()
+
     const remainingQuota = await quota.addQuotaByShare(5)
 
     return ApiResponse.success(res, {

server/src/routes/auth.js

@@ -582,58 +582,61 @@ router.put('/nickname', async (req, res) => {
  * 用于小程序 WebView 内嵌 H5 时，通过 openid 获取登录 token
  * 小程序在 URL 中传递 openid，H5 用这个接口换取 token
  */
-router.post('/webview-token', async (req, res) => {
+// [安全下线 2026-09-19] 该接口仅凭 openid 即可换任意用户 token（配合公开 openid 列表=账号接管）。客户端已确认无调用，如需 H5 登录用 code 换 token 方案。
-  try {
+/* 已下线：router.post('/webview-token', async (req, res) => {
-    const { openid } = req.body
+//   try {
-    
+//     const { openid } = req.body
-    if (!openid) {
+//     
-      return ApiResponse.error(res, '缺少用户标识', 400)
+//     if (!openid) {
-    }
+//       return ApiResponse.error(res, '缺少用户标识', 400)
-    
+//     }
-    // 查找用户
+//     
-    const user = await User.findOne({ openid })
+//     // 查找用户
-    
+//     const user = await User.findOne({ openid })
-    if (!user) {
+//     
-      return ApiResponse.error(res, '用户不存在', 404)
+//     if (!user) {
-    }
+//       return ApiResponse.error(res, '用户不存在', 404)
-    
+//     }
-    // 生成新的 JWT token
+//     
-    const token = jwt.sign(
+//     // 生成新的 JWT token
-      { openid, userId: user._id },
+//     const token = jwt.sign(
-      process.env.JWT_SECRET,
+//       { openid, userId: user._id },
-      { expiresIn: process.env.JWT_EXPIRE }
+//       process.env.JWT_SECRET,
-    )
+//       { expiresIn: process.env.JWT_EXPIRE }
-    
+//     )
-    // 更新最后登录时间
+//     
-    user.lastLoginAt = new Date()
+//     // 更新最后登录时间
-    await user.save()
+//     user.lastLoginAt = new Date()
-    
+//     await user.save()
-    // 记录登录日志
+//     
-    await recordLoginLog(
+//     // 记录登录日志
-      user._id,
+//     await recordLoginLog(
-      openid,
+//       user._id,
-      'auto_login',
+//       openid,
-      'wechat_webview',
+//       'auto_login',
-      'webview_h5',
+//       'wechat_webview',
-      req,
+//       'webview_h5',
-      true
+//       req,
-    )
+//       true
-    
+//     )
-    logger.info(`WebView Token交换成功: ${openid}`)
+//     
-    
+//     logger.info(`WebView Token交换成功: ${openid}`)
-    return ApiResponse.success(res, {
+//     
-      token,
+//     return ApiResponse.success(res, {
-      openid,
+//       token,
-      userInfo: {
+//       openid,
-        nickName: user.nickName,
+//       userInfo: {
-        avatarUrl: user.avatarUrl
+//         nickName: user.nickName,
-      }
+//         avatarUrl: user.avatarUrl
-    }, '登录成功')
+//       }
-    
+//     }, '登录成功')
-  } catch (error) {
+//     
-    logger.error('WebView Token交换失败:', error)
+//   } catch (error) {
-    return ApiResponse.serverError(res, error.message)
+//     logger.error('WebView Token交换失败:', error)
-  }
+//     return ApiResponse.serverError(res, error.message)
-})
+//   }
+// })
+// 
+*/
 
 module.exports = router

server/src/routes/knowledge.js

@@ -330,7 +330,12 @@ router.get('/:dim/questions', async (req, res) => {
     .limit(parseInt(limit))
     .lean()
 
-    return ApiResponse.success(res, questions)
+    // 脱敏：不下发 isCorrect（答案）
+    return ApiResponse.success(res, questions.map(q => {
+      const o = (q.toObject ? q.toObject() : q)
+      if (Array.isArray(o.options)) o.options = o.options.map(op => ({ text: op.text, index: op.index }))
+      return o
+    }))
   } catch (error) {
     logger.error('获取问答失败:', error)
     return ApiResponse.serverError(res, '获取问答失败')

server/src/routes/user.js

@@ -171,11 +171,7 @@ router.post('/progress', async (req, res) => {
       dbUser.exploreData.dim5.bestScore = Math.max(dim5Score, dbUser.exploreData.dim5?.bestScore || 0)
     }
     
-    // 更新其他字段
+    // [安全] 付费权益字段（ownedSkins/isAdFree/isSubscriber/subscribeExpiry）不接受客户端写入，仅支付回调/管理员可改
-    if (ownedSkins !== null && ownedSkins !== undefined) dbUser.ownedSkins = ownedSkins
-    if (isAdFree !== null && isAdFree !== undefined) dbUser.isAdFree = isAdFree
-    if (isSubscriber !== null && isSubscriber !== undefined) dbUser.isSubscriber = isSubscriber
-    if (subscribeExpiry !== null && subscribeExpiry !== undefined) dbUser.subscribeExpiry = subscribeExpiry
     
     await dbUser.save()