fix: 修复6个P1级Bug(主题FOUC/拼写错误/登出POST/密钥配置/CORS配置/编辑器主题同步) - #43
Merged
Conversation
- Bug1 主题切换FOUC: head脚本同步初始化markdown/highlight 样式表的disabled属性,消除首屏样式闪烁(FTUE) - Bug2 拼写错误: uplaod_view -> upload_view - Bug3 CSRF防护: logout_view加require_POST装饰器 - Bug4 密钥与Host配置: SECRET_KEY改为不安全占位值(提示 生产环境必设), ALLOWED_HOSTS按DEBUG与否分层 - Bug5 CORS配置: 增加CORS_ALLOWED_ORIGINS环境变量, 仅在DEBUG且空列表时开启ALL; 凭证模式绑定来源列表 - Bug6 md_editor主题同步: 挂载轮询 + MutationObserver 同步data-bs-theme到内部.dark类, 响应主题切换
This was referenced Aug 12, 2026
aba2222
requested changes
Aug 12, 2026
aba2222
self-requested a review
August 13, 2026 02:16
aba2222
approved these changes
Aug 13, 2026
xiokuai
added a commit
to xiokuai/lean_forum
that referenced
this pull request
Aug 16, 2026
- Resolve base.html conflict with origin/main: keep minimal FOUC init pattern - Promote getTheme to window.getTheme inside head IIFE, so the markdown/hljs stylesheet disabled switcher (also in head) can access it without ReferenceError - Remove duplicate getTheme declaration at end of body (uses window global now) - settings.py: SECRET_KEY one-liner, CORS_ALLOWED_ORIGINS list comprehension (per aba2222#43 review) - md_editor.html: remove manual theme sync script (md_editor follows data-bs-theme natively, per aba2222#43 review) - Test suite: 12/12 passing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
继 P0 之后修复 6 个 P1 级问题，涉及首屏主题闪烁（FOUC）、拼写错误、登出 CSRF 防护、密钥与域名配置收紧、CORS 默认安全默认，以及 md_editor 编辑器主题不随页面主题切换的问题。
修复清单
1. 主题切换 FOUC：同步初始化 markdown / highlight.js 样式表禁用状态
问题：虽然
data-bs-theme已在<head>内设置，但github-markdown-dark/light、highlightjs-dark/light样式表的disabled属性要等到 body 末尾脚本syncTheme(initialTheme)执行时才更新，首屏会出现浅/深样式叠加闪烁。修复：
<head>内的内联脚本在设置data-bs-theme后，通过DOMContentLoaded或立即执行同步禁用不符合当前主题的样式表，使首屏视觉保持一致。同时去除了<link>中硬编码的disabled属性，让脚本统一接管（避免HTML 里 disabled + 脚本又切的竞态）。2. 拼写错误：
uplaod_view→upload_view问题：
md_editor/views.py函数名和md_editor/urls.py引用均为uplaod_view，而路由 URL name 为upload_view；虽不影响功能（调用方走的是 URL name 反向解析），但对外命名对内实现不一致，代码可维护性差。修复：统一改为
upload_view。3. 登出接口仅接受 POST（CSRF 防护）
问题：
logout_view同时接受 GET/POST，<a href="/logout/">形式的点击可被第三方页面 img/script 标签触发，导致任意访问者访问到一张恶意网页时会被强制从论坛登出（CSRF DoS）。之前 UI 已改成<form method="post">+csrf_token，但后端没拦 GET。修复：加
@require_POST装饰器，GET 请求会被 Django 自动返回 405。4. SECRET_KEY 硬编码默认值 + ALLOWED_HOSTS 更严格的分层
问题：
SECRET_KEY仍带有一个真实可用的强默认值，部署者未设置环境变量时默认启用生产 session 加密密钥，等于仓库公开所有人的 session 都能被伪造。ALLOWED_HOSTS=['*']生产忘记设环境变量就等于 Host 头攻击面全开。修复：
SECRET_KEY默认值改为带django-insecure-前缀的占位字符串，只有当本地 DEBUG 时才能直接运行；生产部署必须显式注入环境变量，否则无法启动 session/csrf（配合SECRET_KEY语义）ALLOWED_HOSTS改成按 DEBUG 分层：DEBUG 未设环境变量时仍是["*"]方便本地，生产未设环境变量时保守默认["localhost", "127.0.0.1"]5. CORS 默认收紧 + 凭证模式绑定可信来源
问题：
CORS_ALLOW_ALL_ORIGINS = DEBUG在本地开发时方便但只要线上忘了设CORS_ALLOWED_ORIGINS同时 DEBUG 被临时打开就会放开所有来源；另外CORS_ALLOW_CREDENTIALS默认 False 且无来源列表时的配合不明确。修复：
CORS_ALLOWED_ORIGINS，逗号分隔配置可信来源CORS_ALLOW_ALL_ORIGINS = DEBUG and not CORS_ALLOWED_ORIGINS，避免生产环境因调试 DEBUG 打开一时疏忽放开所有来源CORS_ALLOW_CREDENTIALS，与来源严格绑定6. md_editor 编辑器不随主题切换同步
.dark类问题：md_editor 的 CSS 通过
.editor.dark应用深色样式，但base.html的主题切换按钮只会操作根节点data-bs-theme，md_editor 挂载后首次进入（尤其是 localStorage 记忆了 dark 的用户）和后续点击切换按钮，编辑器外观都不变化。修复：
md_editor.html组件模板内加一段同步脚本：MutationObserver监听根节点data-bs-theme变化setInterval轮询.editor元素挂载（因为 index.js 是type=module异步加载）.editor加/去.dark类测试
python manage.py test（12 个测试 OK）upload_viewURL name 仍保持不变，反向解析无变化，文件上传测试test_upload_view_saves_image_to_storage维持绿色logout_view变为 POST 后，现有 UI 已用 form 提交，不受影响部署须知
新增 / 调整的环境变量（与 P0 PR 衔接）：