dujiao-next
41b86260dc
Merge branch 'feat/invite-registration'
2026-10-11 14:43:43 +08:00
dujiao-next
c5f5511e53
feat: 新增邀请码注册功能
2026-10-11 14:43:43 +08:00
dujiao-next
087e9fbd1d
Merge remote-tracking branch 'github/main'
2026-10-11 13:34:30 +08:00
dujiao-next
d31c9a983e
test: 补充佣金重试消费、子订单退回钱包受限父订单、登录凭证绑定分销站点的测试
2026-10-11 13:30:41 +08:00
dujiao-next
3b7e66b542
fix: 验证码邮件发送失败时删除该记录，不占用发送间隔也不顶替上一封有效验证码
2026-10-11 13:28:46 +08:00
dujiao-next
95bff49a92
fix: 上游拒绝取消已付款采购单时给出明确提示，并补齐采购单错误文案三语
2026-10-11 13:27:27 +08:00
dujiao-next
290ea27ba3
fix: 佣金重试时订单已退款或取消则不再生成佣金
2026-10-11 13:25:33 +08:00
dujiao-next
3db2784268
fix: 采购单状态在下单途中被回调推进或被取消时仍补记上游订单号，取消的告警人工处理
2026-10-11 13:24:16 +08:00
dujiao-next
3e7885b137
fix: 本地订单已退款或取消时不再向上游提交采购单
2026-10-11 13:23:13 +08:00
dujiao-next
e5e80de0cf
fix: 注册/忘记密码/发送验证码限流放宽为独立参数，避免共享 IP 用户被成批误封
2026-10-11 13:22:20 +08:00
dujiao-next
263d70320a
refactor: 合并传输层重复的登录记录、租户解析与请求协议函数
2026-10-11 12:52:40 +08:00
dujiao-next
67355271bd
refactor: 验证码/Google/Telegram 登录设置处理器合并公共读写流程
2026-10-11 12:51:06 +08:00
dujiao-next
67f6c540ea
refactor: settings 内部布尔解析复用 settingsvalue.ParseBool
2026-10-11 12:50:19 +08:00
dujiao-next
807bda7602
refactor: 删除 identity 用户存储中与 memberlevel 重复的会员等级写入方法
2026-10-11 12:49:26 +08:00
dujiao-next
812a0581ba
refactor: 删除迁移守卫中已被上级目录覆盖的冗余路径
2026-10-11 12:48:08 +08:00
dujiao-next
f19b8a7d80
refactor: 各模块复制的分页与方言查询辅助函数统一改用 gormutil
2026-10-11 12:47:38 +08:00
dujiao-next
568e83d4dc
refactor: 删除无人调用的死代码
2026-10-11 12:45:55 +08:00
dujiao-next
6ba6e1907c
fix: 同一对接站点批量导入加互斥锁，超时重试不再并发导入重复商品
2026-10-11 12:44:17 +08:00
dujiao-next
cc12551c04
fix: 支付后佣金创建失败时投递可重试任务，避免推广佣金永久丢失
2026-10-11 12:42:58 +08:00
dujiao-next
70168cbe8d
fix: 通用设置接口拒绝有专用接口的配置键，避免跳过校验与运行时生效
2026-10-11 12:40:41 +08:00
dujiao-next
ff9d9a1f61
fix: 禁止后台单独取消子订单，避免父订单支付后子订单被复活或余额未退
2026-10-11 12:39:20 +08:00
dujiao-next
495a0ce0f0
fix: 采购单列表并发查询上游退款并设整页超时，上游变慢时列表页不再超时
2026-10-11 12:38:43 +08:00
dujiao-next
ada4155bed
fix: 分销站公共配置不再下发主站自定义脚本
2026-10-11 12:37:20 +08:00
dujiao-next
8acae264c2
fix: 启用 2FA 与命令行重置管理员密码/2FA 后清理鉴权缓存，旧令牌立即失效
2026-10-11 12:36:40 +08:00
dujiao-next
94aa8b477c
fix: 上游图片仅下载同主机地址并限制大小与扩展名，防止 SSRF 与写满磁盘
2026-10-11 12:35:33 +08:00
dujiao-next
09fb643fce
fix: 巡检补投停滞的待提交采购单，子订单采购失败不再阻断其余子订单
2026-10-11 12:34:21 +08:00
dujiao-next
53631cf4f4
fix: 超时取消订单任务读库失败时交给队列重试，避免预占库存永久不释放
2026-10-11 12:33:12 +08:00
dujiao-next
fbfdc008d1
fix: 上游商品增量列表纳入 SKU 库存与卡密变化，下游增量同步能及时感知库存
2026-10-11 12:32:47 +08:00
dujiao-next
0c045b201a
fix: 用户登录凭证绑定签发站点，分销站凭证不能在主站或其他分销站使用
2026-10-11 12:31:34 +08:00
dujiao-next
b942773f21
fix: 子订单退款计入并受限于父订单可退金额，防止父子订单重复退款
2026-10-11 12:27:09 +08:00
dujiao-next
14a403e2b1
fix: 采购单巡检加周期锁防多 worker 重复执行，分页覆盖全部已接单并按单限频告警
2026-10-11 12:25:29 +08:00
dujiao-next
06ff48dc18
fix: 采购单状态改为比较后再写，防止回调与提交/轮询并发导致状态回退和重复交付通知
2026-10-11 12:23:32 +08:00
dujiao-next
57af7c6714
fix: 编辑商品未改库存时保留实时库存，避免覆盖下单预占导致超卖
2026-10-11 12:21:36 +08:00
dujiao-next
8f2b7039e4
fix: 采购单按配置间隔延迟重试，上游明确拒单按错误码判断是否重试
2026-10-11 12:18:22 +08:00
dujiao-next
2ae92e8ba4
fix: 余额全额支付时同步入账分销利润
2026-10-11 12:17:16 +08:00
dujiao-next
2f437a39c0
fix: 验证码原子占用尝试次数并先落库后发信，注册/忘记密码/发送验证码接入限流
2026-10-11 12:16:08 +08:00
dujiao-next
3ae53014f2
fix: 上传目录所有文件禁止执行脚本，防止同源存储型 XSS
2026-10-11 12:13:57 +08:00
dujiao-next
bc076c984a
fix: 上游同一下游单号的旧单已取消时允许重新下单，修复余额不足后重试永远失败
2026-10-11 12:13:33 +08:00
dujiao-next
ea785ed773
fix: 采购单已被上游接单时，上游取消失败不再本地标记取消
2026-10-11 12:12:39 +08:00
dujiao-next
71ea31ddc5
fix: 禁止后台取消已支付订单，避免退回钱包与释放已消耗库存
2026-10-11 12:11:18 +08:00
dujiao-next
f627efce94
feat: 后台商品支持批量设置前台库存展示模式
2026-10-11 12:09:13 +08:00
dujiao-next
5bd0ce93d6
feat: 导入上游商品时优先沿用上游 slug
2026-10-11 12:09:13 +08:00
dujiao-next
291a2ae2b6
fix: 商品 slug 查重计入已删除商品，避免撞唯一索引报笼统错误
2026-10-11 12:09:13 +08:00
dujiao-next
f4a06ff366
fix: 限制用户昵称长度并禁止 HTML 敏感字符
2026-10-11 11:25:18 +08:00
Assimon
287b5f4882
Merge pull request #350 from mvanhorn/fix/349-epay-v2-redirect-post
...
fix: submit epay v2 redirect payments as a POST form
2026-10-09 10:17:46 +08:00
Matt Van Horn
6d386b8d08
refactor: fold epay redirect handler into webhook_handler and take redirect host from return_url
2026-10-08 14:37:09 -07:00
dujiao-next
7d2eb8db86
fix: 统一主站与分销站 Telegram/WhatsApp 联系方式校验规则
2026-10-08 10:27:35 +08:00
dujiao-next
f61740195c
fix: 分销站展示 Email 与客服链接并不再回退主站联系方式
2026-10-08 10:22:32 +08:00
dujiao-next
a461338815
fix: 修复上游映射商品交付表单被清空、隐藏或丢弃导致付款后采购失败
2026-10-08 10:08:03 +08:00
Matt Van Horn
1b955da43e
fix: submit epay v2 redirect payments as a POST form
...
v2 redirect now keeps the signed fields in the gateway payload, sets
submit_method to POST, and leaves PayURL empty, while v1 redirect still
returns a query-string PayURL. CreatePayment then returns a same-origin
/api/v1/payments/epay-redirect URL taken from the notify URL's scheme
and host, with the payment id and a random token in the query, and
stores that token on the payload; a zero payment id or a notify URL
without an http or https origin fails creation with a config error. GET
/api/v1/payments/epay-redirect sits on the callback rate-limit group and
is unauthenticated. It answers with an auto-submitting HTML form that
POSTs the stored fields to the stored gateway endpoint only when the
payment is a pending epay redirect, still within its expiry, not
superseded, and the query token matches the stored token by a
constant-time compare of SHA-256 digests; every other request is a 404
with no form.
Fixes #349
2026-10-06 04:29:41 -07:00
dujiao-next