fix(xss+perf): SearchView XSS消除(无v-html)+room_id索引+pool_recycle

- SearchView.vue: 用 highlightSegments() 返回 {text,hit} 数组替代 v-html+escapeHtml+regex,模板用 <template v-for> + <mark>/<span> 渲染,从结构上消除 XSS 风险(4 处 v-html 全部移除: 消息片段/客户昵称/realName/手机号)
- models.py: Message 新增 ix_message_channel_owner_room_time(channel,owner_account_id,room_id,timestamp),群聊查询过滤 room_id 而非 talker_id,原 talker 索引无法覆盖
- migrations/d8eee96cd017: 新增 room_id 索引的 upgrade/downgrade (offline SQL 已验证)
- base.py + scheduler.py + cli.py: 所有生产 create_async_engine 增加 pool_recycle=3600,在 MySQL wait_timeout(默认 8h)断连前主动回收

Co-Authored-By: Claude <noreply@anthropic.com>

This commit is contained in:

浅念

2026-08-12 11:50:45 +08:00

parent c261b2bc9a

commit 9a953553ec

6 changed files with 108 additions and 38 deletions

									
										yunke-server/app/db/base.py
									
		+1
		
												View File
												
				@@ -26,6 +26,7 @@ settings = get_settings()

				async_engine = create_async_engine(

				    settings.db_url,

				    pool_pre_ping=True,

				    pool_recycle=3600,  # recycle connections before MySQL wait_timeout (default 8h) closes them

				    future=True,

				)