前端优化

前端页面/components/UI交互提示组件.js

@@ -9,12 +9,13 @@
 // ==========================================
 // 🎯 P1体验优化：
 //   - 统一错误处理与重试机制
-//   - 网络状态检测与离线提示
 //   - 按钮加载状态
 //   - 全局加载遮罩
+// 🌐 网络状态检测与离线横幅已收敛至 core/状态管理.js（见下方说明），本模块不再负责
 // ===========================================
 
 import { t } from "./用户体验增强.js";
+import { escapeHtml } from "../core/全局配置.js";
 
 // ==========================================
 // 📢 Toast 消息提示
@@ -72,9 +73,11 @@ export function showToast(message, type = "info", duration = 3000) {
         wordBreak: "break-word"
     });
 
+    // 提示文本统一转义：message 常携带昵称/标题/后端报错等用户可控内容，
+    // 全库无任何调用方故意向 showToast 传 HTML 标签，故无条件转义不会改变现有显示效果。
     toast.innerHTML = `
         <span style="font-size: 16px;">${icons[type] || icons.info}</span>
-        <span style="flex: 1;">${message}</span>
+        <span style="flex: 1;">${escapeHtml(message)}</span>
         <span class="toast-close" style="cursor: pointer; opacity: 0.7; font-size: 18px; margin-left: 8px;">×</span>
     `;
     
@@ -192,6 +195,7 @@ function _closeDialog(overlay, box, hasYTranslate = true, callback) {
  * @param {string} options.confirmText - 确认按钮文字
  * @param {string} options.cancelText - 取消按钮文字
  * @param {string} options.type - 类型: 'warning', 'danger', 'info'
+ * @param {boolean} options.html - 是否把 message 当作可信 HTML 渲染（默认 false，即按纯文本转义）
  * @returns {Promise<boolean>}
  */
 export function showConfirm(message, options = {}) {
@@ -199,7 +203,8 @@ export function showConfirm(message, options = {}) {
         title = "操作确认",
         confirmText = "确认执行",
         cancelText = "取消",
-        type = "warning"
+        type = "warning",
+        html = false
     } = options;
     
     const typeConfig = {
@@ -216,12 +221,12 @@ export function showConfirm(message, options = {}) {
         box.innerHTML = `
             <div style="font-size: 18px; font-weight: bold; color: ${config.color}; display: flex; align-items: center; gap: 10px;">
                 <span style="font-size: 24px;">${config.icon}</span>
-                <span>${title}</span>
+                <span>${escapeHtml(title)}</span>
             </div>
-            <div style="font-size: 14px; color: #ccc; line-height: 1.7; padding: 8px 0;">${message}</div>
+            <div style="font-size: 14px; color: #ccc; line-height: 1.7; padding: 8px 0;">${html ? message : escapeHtml(message)}</div>
             <div style="display: flex; gap: 12px; justify-content: flex-end; margin-top: 8px;">
-                <button id="ui-btn-cancel" style="padding: 10px 20px; background: transparent; border: 1px solid #555; color: #aaa; border-radius: 6px; cursor: pointer; transition: 0.2s; font-size: 14px;">${cancelText}</button>
-                <button id="ui-btn-confirm" style="padding: 10px 20px; background: ${config.btnColor}; border: none; color: #fff; border-radius: 6px; cursor: pointer; font-weight: bold; box-shadow: 0 2px 8px ${config.btnColor}44; transition: 0.2s; font-size: 14px;">${confirmText}</button>
+                <button id="ui-btn-cancel" style="padding: 10px 20px; background: transparent; border: 1px solid #555; color: #aaa; border-radius: 6px; cursor: pointer; transition: 0.2s; font-size: 14px;">${escapeHtml(cancelText)}</button>
+                <button id="ui-btn-confirm" style="padding: 10px 20px; background: ${config.btnColor}; border: none; color: #fff; border-radius: 6px; cursor: pointer; font-weight: bold; box-shadow: 0 2px 8px ${config.btnColor}44; transition: 0.2s; font-size: 14px;">${escapeHtml(confirmText)}</button>
             </div>
         `;
 
@@ -265,13 +270,15 @@ export function showConfirm(message, options = {}) {
  * @param {string} message - 错误信息
  * @param {Function} retryFn - 重试函数
  * @param {Object} options - 配置选项
+ * @param {boolean} options.html - 是否把 message 当作可信 HTML 渲染（默认 false，即按纯文本转义）
  * @returns {Promise<boolean>} - 用户选择重试返回true
  */
 export function showRetryDialog(message, retryFn, options = {}) {
     const {
         title = "操作失败",
         retryText = "🔄 重试",
-        cancelText = "关闭"
+        cancelText = "关闭",
+        html = false
     } = options;
     
     return new Promise((resolve) => {
@@ -291,14 +298,14 @@ export function showRetryDialog(message, retryFn, options = {}) {
         box.innerHTML = `
             <div style="text-align: center;">
                 <div style="font-size: 48px; margin-bottom: 16px;">😕</div>
-                <div style="font-size: 20px; font-weight: bold; color: #F44336;">${title}</div>
+                <div style="font-size: 20px; font-weight: bold; color: #F44336;">${escapeHtml(title)}</div>
             </div>
             <div style="font-size: 14px; color: #bbb; line-height: 1.7; text-align: center; padding: 0 10px; background: #1a1a1a; border-radius: 8px; padding: 16px;">
-                ${message}
+                ${html ? message : escapeHtml(message)}
             </div>
             <div style="display: flex; gap: 12px; justify-content: center;">
-                <button id="ui-btn-cancel" style="flex: 1; padding: 12px 20px; background: #333; border: 1px solid #555; color: #aaa; border-radius: 8px; cursor: pointer; transition: 0.2s; font-size: 14px;">${cancelText}</button>
-                <button id="ui-btn-retry" style="flex: 1; padding: 12px 20px; background: linear-gradient(135deg, #2196F3, #1976D2); border: none; color: #fff; border-radius: 8px; cursor: pointer; font-weight: bold; transition: 0.2s; font-size: 14px;">${retryText}</button>
+                <button id="ui-btn-cancel" style="flex: 1; padding: 12px 20px; background: #333; border: 1px solid #555; color: #aaa; border-radius: 8px; cursor: pointer; transition: 0.2s; font-size: 14px;">${escapeHtml(cancelText)}</button>
+                <button id="ui-btn-retry" style="flex: 1; padding: 12px 20px; background: linear-gradient(135deg, #2196F3, #1976D2); border: none; color: #fff; border-radius: 8px; cursor: pointer; font-weight: bold; transition: 0.2s; font-size: 14px;">${escapeHtml(retryText)}</button>
             </div>
         `;
 
@@ -327,9 +334,15 @@ export function showRetryDialog(message, retryFn, options = {}) {
                 close();
                 resolve(true);
             } catch (error) {
-                // 重试失败，更新错误信息
-                box.querySelector("div[style*='background: #1a1a1a']").innerHTML = error.message || t('common.retry_failed');
-                retryBtn.innerHTML = retryText;
+                // 重试失败，更新错误信息（与初次渲染保持一致：默认纯文本，仅 html=true 时按 HTML 渲染）
+                const errText = error.message || t('common.retry_failed');
+                const errBox = box.querySelector("div[style*='background: #1a1a1a']");
+                if (html) {
+                    errBox.innerHTML = errText;
+                } else {
+                    errBox.textContent = errText;
+                }
+                retryBtn.innerHTML = escapeHtml(retryText);
                 retryBtn.disabled = false;
             }
         };
@@ -338,87 +351,15 @@ export function showRetryDialog(message, retryFn, options = {}) {
 
 
 // ==========================================
-// 🌐 网络状态检测
+// 🌐 网络状态检测（已移除）
 // ==========================================
-
-let isOffline = !navigator.onLine;
-let offlineBanner = null;
-
-/**
- * 初始化网络状态监听
- */
-export function initNetworkStatusListener() {
-    window.addEventListener("online", () => {
-        isOffline = false;
-        hideOfflineBanner();
-        showToast("网络已恢复", "success");
-    });
-    
-    window.addEventListener("offline", () => {
-        isOffline = true;
-        showOfflineBanner();
-    });
-    
-    // 初始状态检测
-    if (!navigator.onLine) {
-        showOfflineBanner();
-    }
-}
-
-function showOfflineBanner() {
-    if (offlineBanner) return;
-    
-    offlineBanner = document.createElement("div");
-    Object.assign(offlineBanner.style, {
-        position: "fixed",
-        bottom: "0",
-        left: "0",
-        right: "0",
-        background: "linear-gradient(135deg, #FF5722, #E64A19)",
-        color: "#fff",
-        padding: "12px 20px",
-        display: "flex",
-        alignItems: "center",
-        justifyContent: "center",
-        gap: "12px",
-        fontSize: "14px",
-        fontWeight: "500",
-        zIndex: "9999",
-        boxShadow: "0 -4px 20px rgba(0,0,0,0.3)",
-        transform: "translateY(100%)",
-        transition: "transform 0.3s ease"
-    });
-    
-    offlineBanner.innerHTML = `
-        <span style="font-size: 18px;">📡</span>
-        <span>网络连接已断开，部分功能可能不可用</span>
-        <button onclick="location.reload()" style="background: rgba(255,255,255,0.2); border: none; color: white; padding: 6px 14px; border-radius: 4px; cursor: pointer; font-size: 12px;">刷新重试</button>
-    `;
-    
-    document.body.appendChild(offlineBanner);
-    
-    requestAnimationFrame(() => {
-        offlineBanner.style.transform = "translateY(0)";
-    });
-}
-
-function hideOfflineBanner() {
-    if (!offlineBanner) return;
-    
-    offlineBanner.style.transform = "translateY(100%)";
-    setTimeout(() => {
-        offlineBanner?.remove();
-        offlineBanner = null;
-    }, 300);
-}
-
-/**
- * 检查网络状态
- * @returns {boolean} - 是否在线
- */
-export function checkOnline() {
-    return navigator.onLine;
-}
+// 本模块曾自行维护一份 isOffline 状态并常驻显示底部「网���连接已断开」横幅，
+// 与 状态管理.js 的网络状态重复，且一条 online/offline 事件需喂多份状态。
+// 现统一收敛：
+//   - 网络状态唯一数据源：core/状态管理.js 的 isOnline()
+//   - 离线反馈改由列表层承担：缓存命中渲染后弹 xxx.network_cache toast
+//     （「网络异常，已加载本地缓存」），比常驻横幅更贴合实际可用状态
+// 原导出的 initNetworkStatusListener / checkOnline 全库无调用方，一并移除。
 
 
 // ==========================================
@@ -463,7 +404,7 @@ export function showLoading(message = "加载中...") {
     
     loadingOverlay.innerHTML = `
         <div class="loading-spinner" style="width: 48px; height: 48px; border: 4px solid var(--border-color, #333); border-top-color: #2196F3; border-radius: 50%; animation: spin 0.8s linear infinite;"></div>
-        <div class="loading-text" style="color: #fff; font-size: 14px; font-weight: 500;">${message}</div>
+        <div class="loading-text" style="color: #fff; font-size: 14px; font-weight: 500;">${escapeHtml(message)}</div>
     `;
     
     // 添加旋转动画样式
@@ -531,7 +472,7 @@ export function setButtonLoading(button, loading, loadingText = "处理中...")
         button.disabled = true;
         button.style.opacity = "0.7";
         button.style.cursor = "not-allowed";
-        button.innerHTML = `<span class="btn-spinner"></span>${loadingText}`;
+        button.innerHTML = `<span class="btn-spinner"></span>${escapeHtml(loadingText)}`;
     } else {
         // 恢复原始状态
         button.disabled = button._originalDisabled || false;
@@ -624,20 +565,6 @@ export async function withFeedback(asyncFn, options = {}) {
 }
 
 
-// ==========================================
-// 🚀 自动初始化
-// ==========================================
-
-// 页面加载时初始化网络状态监听
-if (typeof window !== "undefined") {
-    if (document.readyState === "loading") {
-        document.addEventListener("DOMContentLoaded", initNetworkStatusListener);
-    } else {
-        initNetworkStatusListener();
-    }
-}
-
-
 // ==========================================
 // 📦 安装进度条
 // ==========================================

前端页面/components/互动工具函数.js

@@ -8,6 +8,8 @@
 
 import { showToast } from "./UI交互提示组件.js";
 import { t } from "./用户体验增强.js";
+// 本模块内部也需要转义（下方 renderInteractionButtonsHTML）；re-export 不会绑定本地标识符，故单独 import
+import { escapeHtml } from "../core/全局配置.js";
 
 // 开发模式检测，仅在本地环境输出调试日志
 const DEBUG = location.hostname === 'localhost' || location.hostname === '127.0.0.1';
@@ -103,7 +105,7 @@ export function renderInteractionButtonsHTML(data, currentAccount, options = {})
     
     const tipBtn = showTip ? `
         <button id="btn-tip" style="background: #333; border: 1px solid #555; color: #fff; padding: 8px 16px; border-radius: 20px; cursor: pointer; font-size: 13px; display: flex; align-items: center; gap: 6px; transition: 0.2s;">
-            💰 ${tipText}
+            💰 ${escapeHtml(tipText)}
         </button>
     ` : '';
     
@@ -279,20 +281,12 @@ export { renderTipBoardHTML } from './打赏等级工具.js';
 // ==========================================
 // 🔒 HTML转义（通用工具）
 // ==========================================
+// 实现已下沉至 core/全局配置.js（零依赖的底层叶子模块），此处以 re-export 方式
+// 对外暴露同名函数，既有调用方（个人列表组件.js 等）无需改动。
+// 下沉原因：UI交互提示组件.js / 打赏等级工具.js 需要转义，而本文件反向依赖
+// 这两者（导入 showToast、re-export renderTipBoardHTML），若仍在此定义会形成循环依赖。
 
-/**
- * HTML转义（统一版：各组件局部副本已归一到此）
- * @param {*} str - 原始字符串（非字符串会先强制转换，兼容数字等入参）
- * @returns {string} 转义后的字符串
- */
-export function escapeHtml(str) {
-    if (str === null || str === undefined || str === "") return "";
-    return String(str).replace(/&/g, "&amp;")
-              .replace(/</g, "&lt;")
-              .replace(/>/g, "&gt;")
-              .replace(/"/g, "&quot;")
-              .replace(/'/g, "&#039;");
-}
+export { escapeHtml } from "../core/全局配置.js";
 
 /**
  * 读取用户设置中的列表缓存 TTL（统一版：讨论区/任务榜/提示词组件局部副本已归一到此）

前端页面/components/全局设置组件.js

@@ -430,7 +430,7 @@ export function createSettingsView() {
         setLanguage(newLang);
         
         const langName = LANGUAGE_OPTIONS.find(opt => opt.value === newLang)?.label || newLang;
-        showToast(`🌐 ${t('settings.language_changed') || '语言已切换为'} ${langName.split(' / ')[0]}`, "success");
+        showToast(`🌐 ${t('settings.language_changed')} ${langName.split(' / ')[0]}`, "success");
         
         // 🔄 通过路由系统刷新，保持 activeInlineView 同步
         setTimeout(() => {

前端页面/components/图片展示测试.js

@@ -6,6 +6,8 @@
 // 接口：openImageViewer(imageUrls, startIndex, options)
 // ==========================================
 
+import { escapeHtml } from "../core/全局配置.js";
+
 // ==========================================
 // 🎨 CSS样式定义（CSS-in-JS模式）
 // ==========================================
@@ -785,7 +787,8 @@ class CyberImageViewer {
         for (let i = 0; i < maxThumbs; i++) {
             const thumb = document.createElement('div');
             thumb.className = 'cyber-thumb' + (i === this.currentIndex ? ' active' : '');
-            thumb.innerHTML = `<img src="${this.imageUrls[i]}" alt="">`;
+            // 🔒 XSS防护：图片 URL 来自其他用户发布的内容，写入 innerHTML 前必须转义
+            thumb.innerHTML = `<img src="${escapeHtml(this.imageUrls[i])}" alt="">`;
             thumb.addEventListener('click', (e) => {
                 this._stopAutoPlay(); // 手动切换时停止自动播放
                 this.goTo(i, e.clientX, e.clientY);

前端页面/components/图片沙盒组件.js

@@ -12,6 +12,7 @@
 // ==========================================
 
 import { t } from "./用户体验增强.js";
+import { escapeHtml } from "../core/全局配置.js";
 import { openImageViewer } from "./图片展示测试.js";
 
 // 🔧 通用SVG占位图生成函数
@@ -77,8 +78,10 @@ export function getCoverSandboxHTML(imageSource, lazyLoad = true) {
     const isLocalProxy = firstUrl && firstUrl.startsWith('/community_hub/image?url=');
     const shouldLazy = lazyLoad && !isLocalProxy;
     
+    // 🔒 XSS防护：图片 URL 来自其他用户发布的内容，写入 HTML 属性前必须转义
+    // （上方 startsWith 代理判定用的是原始值，不受影响；浏览器解码后 dataset 仍为原 URL）
     const imgSrc = shouldLazy ? getPlaceholderSVG() : firstUrl;
-    const dataAttr = shouldLazy ? `data-src="${firstUrl}"` : '';
+    const dataAttr = shouldLazy ? `data-src="${escapeHtml(firstUrl)}"` : '';
     const lazyClass = shouldLazy ? 'lazy-image lazy-loading' : '';
     
     // 🖼️ 多图模式：显示左右切换按钮和计数器
@@ -101,8 +104,8 @@ export function getCoverSandboxHTML(imageSource, lazyLoad = true) {
     
     return `
         <div style="font-size: 12px; font-weight: bold; margin-bottom: 6px; color: #aaa;">🖼️ ${t('image.gallery')}${hasMultiple ? ` (${imageUrls.length})` : ''}</div>
-        <div class="img-viewport" data-images='${JSON.stringify(imageUrls)}' data-current="0" style="position: relative; width: 100%; height: 260px; background: #111; border: 2px dashed #666; border-radius: 6px; overflow: hidden; display: flex; align-items: center; justify-content: center; margin-bottom: 12px; cursor: grab; user-select: none; -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none;" oncontextmenu="return false;">
-            <img class="target-img ${lazyClass}" src="${imgSrc}" ${dataAttr} draggable="false" style="max-width: 100%; max-height: 100%; object-fit: contain; transform-origin: center; transition: transform 0.05s linear, opacity 0.3s ease; ${protectionStyles}">
+        <div class="img-viewport" data-images='${escapeHtml(JSON.stringify(imageUrls))}' data-current="0" style="position: relative; width: 100%; height: 260px; background: #111; border: 2px dashed #666; border-radius: 6px; overflow: hidden; display: flex; align-items: center; justify-content: center; margin-bottom: 12px; cursor: grab; user-select: none; -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none;" oncontextmenu="return false;">
+            <img class="target-img ${lazyClass}" src="${escapeHtml(imgSrc)}" ${dataAttr} draggable="false" style="max-width: 100%; max-height: 100%; object-fit: contain; transform-origin: center; transition: transform 0.05s linear, opacity 0.3s ease; ${protectionStyles}">
             ${navButtons}
             <div style="position: absolute; top: 10px; right: 10px; display: flex; gap: 5px; opacity: 0.3; transition: 0.3s; z-index: 10;" onmouseover="this.style.opacity=1" onmouseout="this.style.opacity=0.3">
                 <button class="btn-zoom-out" style="background: #333; color: #fff; border: 1px solid #555; width: 28px; height: 28px; border-radius: 4px; cursor: pointer; font-weight: bold;">-</button>

前端页面/components/图片裁剪组件.js

@@ -9,6 +9,10 @@
 // 🔧 P3优化：事件监听器生命周期管理，防止内存泄漏
 // ==========================================
 
+import { escapeHtml } from "../core/全局配置.js";
+// 🔧 i18n：头部操作提示走词典（用户体验_国际化.js 是零依赖叶子模块，引入不成环）
+import { t } from "./用户体验_国际化.js";
+
 // 辅助函数：将 value 限制在 [min, max] 范围内
 function _clamp(value, min, max) {
     return Math.max(min, Math.min(max, value));
@@ -59,11 +63,11 @@ export function openImageCropper(file, aspectRatio = 16/9, title = "裁剪图片
         let ratioText = '16:9';
         if (aspectRatio === 1) ratioText = '1:1';
         else if (aspectRatio < 1) ratioText = '9:16';
-        // 📱 触控设备与鼠标设备的操作提示区分（移动端无滚轮/拖动概念）
-        const gestureHint = _isTouchDevice() ? '单指拖动调整位置 | 双指捏合或滑块缩放' : '拖动调整位置 | 滚轮缩放';
+        // 📱 触控设备与鼠标设备的操作提示区分（移动端无滚轮/拖动概念）；文案走词典，随界面语言切换
+        const gestureHint = _isTouchDevice() ? t('crop.gesture_hint_touch') : t('crop.gesture_hint_mouse');
         header.innerHTML = `
-            <span style="font-size: 16px; font-weight: bold; color: #fff;">✂️ ${title}</span>
-            <span style="font-size: 12px; color: #888;">比例 ${ratioText} | ${gestureHint}</span>
+            <span style="font-size: 16px; font-weight: bold; color: #fff;">✂️ ${escapeHtml(title)}</span>
+            <span style="font-size: 12px; color: #888;">${escapeHtml(t('crop.ratio_label'))} ${ratioText} | ${escapeHtml(gestureHint)}</span>
         `;
 
         // 裁剪区域容器
@@ -203,6 +207,9 @@ export function openImageCropper(file, aspectRatio = 16/9, title = "裁剪图片
         let pinchCenterY = 0;
         let pinchStartOffsetX = 0;
         let pinchStartOffsetY = 0;
+        // 🔧 手势起始时容器的视口原点（含 border），用于把 clientX/Y 换算成与 img.style.left 同源的容器内坐标
+        let pinchOriginX = 0;
+        let pinchOriginY = 0;
 
         // 获取缩放边界（与滚轮缩放共用同一规则）
         function _getScaleLimits() {
@@ -234,9 +241,14 @@ export function openImageCropper(file, aspectRatio = 16/9, title = "裁剪图片
                 isDragging = false;
                 pinchStartDist = _getTouchDistance(e.touches);
                 pinchStartScale = scale;
+                // 🔧 clientX 是视口坐标，offsetX/containerWidth 是容器内坐标，两者必须同原点才能参与锚点计算；
+                // clientLeft/clientTop 为 2px 边框宽度（img 的 absolute 定位原点在 padding box 左上角）
+                const rect = cropContainer.getBoundingClientRect();
+                pinchOriginX = rect.left + cropContainer.clientLeft;
+                pinchOriginY = rect.top + cropContainer.clientTop;
                 const mid = _getTouchMidPoint(e.touches);
-                pinchCenterX = mid.x;
-                pinchCenterY = mid.y;
+                pinchCenterX = mid.x - pinchOriginX;
+                pinchCenterY = mid.y - pinchOriginY;
                 pinchStartOffsetX = offsetX;
                 pinchStartOffsetY = offsetY;
             }
@@ -255,10 +267,17 @@ export function openImageCropper(file, aspectRatio = 16/9, title = "裁剪图片
                 const newScale = _clamp(pinchStartScale * (_getTouchDistance(e.touches) / pinchStartDist), minScale, maxScale);
                 const ratio = newScale / pinchStartScale;
                 const mid = _getTouchMidPoint(e.touches);
+                // 换算到容器内坐标（与 handleTouchStart 同原点，一次捏合手势期间弹窗不移动）
+                const relX = mid.x - pinchOriginX;
+                const relY = mid.y - pinchOriginY;
+                // 图片 left = (W - s·imgW)/2 + o，故锚点不动的条件解出：
+                //   o1 = (p1 - p0) + ratio·(o0 - d) + d，其中 d = p0 - W/2 为起始手指相对容器中心的偏移
                 const centerX = containerWidth / 2;
                 const centerY = containerHeight / 2;
-                offsetX = (mid.x - pinchCenterX) + (pinchStartOffsetX - (centerX - pinchCenterX)) * ratio + (centerX - pinchCenterX);
-                offsetY = (mid.y - pinchCenterY) + (pinchStartOffsetY - (centerY - pinchCenterY)) * ratio + (centerY - pinchCenterY);
+                const anchorX = pinchCenterX - centerX;
+                const anchorY = pinchCenterY - centerY;
+                offsetX = (relX - pinchCenterX) + (pinchStartOffsetX - anchorX) * ratio + anchorX;
+                offsetY = (relY - pinchCenterY) + (pinchStartOffsetY - anchorY) * ratio + anchorY;
                 scale = newScale;
                 updateImagePosition();
             }

前端页面/components/性能优化工具.js

@@ -5,8 +5,10 @@
 // 作用：提供分页加载、图片懒加载、缓存管理等性能优化工具
 // 关联文件：
 //   - 全局配置.js (配置中心)
+//   - 网络请求_缓存管理.js (列表缓存工具 readListCache/writeListCache 的底层实现)
 //   - 列表卡片组件.js (使用分页加载)
 //   - 创作者卡片组件.js (使用分页加载)
+//   - 任务榜组件.js / 讨论区组件.js / 提示词组件.js (使用列表缓存工具)
 //   - 所有图片渲染场景 (使用懒加载)
 // ==========================================
 // 🏗️ P2架构优化：使用配置中心常量
@@ -14,6 +16,9 @@
 // ==========================================
 
 import { PAGINATION } from "../core/全局配置.js";
+// 📦 列表缓存工具需要本地可用的缓存实现；下方「向后兼容重导出」那行是纯转发、
+// 不会生成本地绑定，故此处必须单独 import（勿误删，否则 readListCache 运行时报错）
+import { setCache, getCacheWithMeta } from "../core/网络请求_缓存管理.js";
 
 // ==========================================
 // 🔒 P0安全优化：敏感数据脱敏工具
@@ -195,7 +200,7 @@ export function maskAmount(amount, hide = false) {
 // ==========================================
 // 缓存实现已统一迁移到 ../core/网络请求_缓存管理.js
 // 此处保持向后兼容重导出，调用方无需修改 import 路径
-export { setCache, getCache, getCacheWithMeta, removeCache, clearAllCache, CACHE_TTL, getRecommendedTTL, setSmartCache } from '../core/网络请求_缓存管理.js';
+export { setCache, getCache, getCacheWithMeta, removeCache, removeCacheByPrefix, clearAllCache, CACHE_TTL, getRecommendedTTL, setSmartCache } from '../core/网络请求_缓存管理.js';
 
 
 // ==========================================
@@ -1236,9 +1241,40 @@ const eventManager = {
 export { eventManager };
 
 // ==========================================
-// 🔍 列表缓存查找工具（详情页离线回退用）
+// 🔍 列表缓存工具（列表视图缓存优先 / 详情页离线回退用）
 // ==========================================
 
+/**
+ * 📴 读取列表首屏缓存（离线容灾口径，任务榜/讨论区/提示词统一走这里）
+ *
+ * 口径说明（原三处各自实现 getCacheWithMeta(key, true) + found && length>0，
+ * 抄写三份容易在维护中走偏，故归一到本函数）：
+ *   - 忽略过期：第二个参数传 true，缓存过期也算命中——断网/云端不通时首屏仍要能出内容，
+ *     新鲜度交由调用方的 silentRefresh 后台补齐，不在此处拦
+ *   - 空列表不算命中：云端确实返回过 0 条时同样落到网络分支重新拉取，
+ *     避免用户新建第一条内容后被旧的空缓存挡住
+ *   - 返回值是写入时的原始数据，调用方自行 proxyImages（与改造前完全一致）
+ *
+ * @param {string} cacheKey - 完整缓存 Key（含各自的筛选参数）
+ * @returns {Array|null} 命中返回数组，未命中/空列表返回 null
+ */
+export function readListCache(cacheKey) {
+    const { value } = getCacheWithMeta(cacheKey, true);  // true = 忽略过期
+    if (!Array.isArray(value) || value.length === 0) return null;
+    return value;
+}
+
+/**
+ * 💾 回写列表首屏缓存（持久化到 localStorage，保证重启后离线仍可展示）
+ * @param {string} cacheKey - 完整缓存 Key
+ * @param {Array} items - 原始数据（未经图片代理）
+ * @param {number} ttl - 有效期（毫秒），由调用方传 getCacheTTL()
+ */
+export function writeListCache(cacheKey, items, ttl) {
+    if (!Array.isArray(items)) return;
+    setCache(cacheKey, items, ttl, true);  // true = 持久化 localStorage
+}
+
 /**
  * 🔍 从列表缓存中查找指定项（详情页离线回退用）
  * @param {string} prefix - 缓存Key前缀（如 "TasksCache_"、"PostsCache_"）

前端页面/components/打赏等级工具.js

@@ -11,7 +11,7 @@
 // ===========================================
 
 import { t } from "./用户体验增强.js";
-import { getCachedProfile, getProfileWithSWR, PLACEHOLDERS } from "../core/全局配置.js";
+import { getCachedProfile, getProfileWithSWR, PLACEHOLDERS, escapeHtml } from "../core/全局配置.js";
 import { api } from "../core/网络请求_业务API.js";
 
 /**
@@ -218,13 +218,15 @@ export function renderTipBoardItemHTML(tipData, rank, size = 'normal') {
         });
     }, 0);
     
+    // 🔒 XSS防护：昵称/头像来自用户可修改的资料，写入 HTML 前必须转义
+    // （上方 SWR 刷新路径用的是 .src / .textContent，本身就是安全的）
     return `
-        <div id="${containerId}" style="display:flex; justify-content:space-between; padding:${cfg.padding}px 0; font-size:${cfg.font}px; align-items:center; border-bottom:1px dashed #333;">
+        <div id="${escapeHtml(containerId)}" style="display:flex; justify-content:space-between; padding:${cfg.padding}px 0; font-size:${cfg.font}px; align-items:center; border-bottom:1px dashed #333;">
             <span style="display:flex; align-items:center; gap:6px;">
                 ${badgeHtml}
                 <span style="display:flex; align-items:center; gap:6px;">
-                    <img class="tip-board-avatar" src="${avatarUrl}" style="width:${cfg.avatar}px; height:${cfg.avatar}px; border-radius:50%; object-fit:cover; flex-shrink:0; background:#333;">
-                    <span class="tip-board-name" style="color:#ddd;">${userName}</span>
+                    <img class="tip-board-avatar" src="${escapeHtml(avatarUrl)}" style="width:${cfg.avatar}px; height:${cfg.avatar}px; border-radius:50%; object-fit:cover; flex-shrink:0; background:#333;">
+                    <span class="tip-board-name" style="color:#ddd;">${escapeHtml(userName)}</span>
                 </span>
             </span>
             <span style="display:flex; align-items:center; gap:6px;">
@@ -245,7 +247,7 @@ export function renderTipBoardItemHTML(tipData, rank, size = 'normal') {
  */
 export function renderTipBoardHTML(boardData, maxShow = 5, emptyText = "暂无打赏，快来成为首个赞赏人吧！", size = 'normal') {
     if (!boardData || boardData.length === 0) {
-        return `<div style="color:#666; font-size:12px; text-align:center; padding:12px 0;">${emptyText}</div>`;
+        return `<div style="color:#666; font-size:12px; text-align:center; padding:12px 0;">${escapeHtml(emptyText)}</div>`;
     }
     
     return boardData.slice(0, maxShow).map((t, i) => renderTipBoardItemHTML(t, i, size)).join('');

前端页面/components/用户体验_国际化.js

@@ -31,6 +31,9 @@ const translations = {
         'common.sending': '发送中...',
         'common.retrying': '重试中...',
         'common.retry_failed': '重试失败，请稍后再试',
+        'common.no_more': '没有更多了',
+        'common.parse_error': '响应解析失败',
+        'common.network_error_retry': '网络连接失败，请稍后重试',
         'common.more': '更多',
         'common.back': '返回',
         'common.search': '搜索',
@@ -308,6 +311,7 @@ const translations = {
         'wallet.recharge.custom_placeholder': '请输入自定义金额 (1~10000)',
         'wallet.recharge.max_amount_exceeded': '单次充值金额不得超过10000元',
         'wallet.recharge.processing': '处理中...',
+        'wallet.recharge.timeout': '支付查询超时，如已支付请稍后刷新查看余额',
         
         // 提现相关
         'wallet.withdraw.title': '💳 收益提现中心',
@@ -326,6 +330,7 @@ const translations = {
         'wallet.withdraw.resend_in': '{seconds}s 后重发',
         'wallet.withdraw.confirm': '确认提现 (金额将转入冻结审核)',
         'wallet.withdraw.submitting': '⏳ 提交中...',
+        'wallet.withdraw.timeout': '提现请求超时，请检查网络后重试',
         'wallet.withdraw.no_balance': '您的可提现收益为 0，快去发布优质插件赚取积分吧！',
         'wallet.withdraw.min_amount': '最低提现额度为 1 积分！',
         'wallet.withdraw.fill_account': '请完整填写收款人支付宝账号与真实姓名！',
@@ -393,8 +398,6 @@ const translations = {
         'feedback.loading': '处理中...',
         'feedback.success': '操作成功',
         'feedback.error': '操作失败，请重试',
-        'feedback.network_error': '网络连接失败',
-        'feedback.offline': '当前处于离线状态',
         'feedback.timeout': '请求超时',
         'feedback.saved': '已保存',
         'feedback.logged_out': '已退出登录',
@@ -419,6 +422,7 @@ const translations = {
         'social.reply': '回复',
         'social.reply_to': '回复',
         'social.comment_deleted': '此条评论已由用户删除',
+        'social.delete_comment_title': '删除评论',
         'social.delete_comment_confirm': '确定要删除这条评论吗？删除后将无法恢复。',
         'social.no_comments': '暂无留言，来抢沙发吧~',
         
@@ -486,6 +490,7 @@ const translations = {
         'chat.date_day': '日',
         'chat.load_more': '加载更早的消息',
         'chat.msg_too_long': '消息不能超1000字',
+        'chat.send_failed': '发送失败: {msg}',
         'chat.load_list_failed': '加载对话列表失败',
         'chat.load_history_failed': '加载消息记录失败',
         'chat.load_failed_hint': '消息加载失败',
@@ -588,6 +593,12 @@ const translations = {
         'item.tip_board_title': '该作品赞赏贡献榜 (TOP 10)',
         'item.owned_reinstall': '已拥有 (点击重新覆盖安装)',
         'item.owned_purchased': '已购买 (请在电脑端安装)',
+        'web.publish_not_supported': '⚠️ 网页版暂不支持发布/编辑功能',
+        'web.install_on_desktop': '请在电脑端进行安装',
+        'web.purchase_success_desktop': '购买成功！请在电脑端进行安装',
+        'crop.ratio_label': '比例',
+        'crop.gesture_hint_touch': '单指拖动调整位置 | 双指捏合或滑块缩放',
+        'crop.gesture_hint_mouse': '拖动调整位置 | 滚轮缩放',
         'item.update_available': '发现新版本 (点击静默热更新)',
         'item.get_now': '立即获取使用',
         'item.free': '完全免费',
@@ -600,7 +611,13 @@ const translations = {
         // 反馈补充
         'feedback.deleted': '已成功删除',
         'feedback.delete_failed': '删除失败',
+        'feedback.retry_suffix': '，请重试',
         'feedback.cache_fallback': '⚠️ 网络连接失败，展示的是缓存数据',
+        // 🔧 新增：以下三条原为散落在各组件里的硬编码中文，现收口到词典以支持多语言
+        'feedback.offline_no_cache': '网络已断开，且无本地缓存',
+        'feedback.search_local_result': '⚠️ 网络不可用，显示本地搜索结果',
+        // 🔍 搜索请求被新关键词取代时抛出的错误消息（详见 网络请求_基础设施.js 的主动取消分支）
+        'feedback.request_cancelled': '请求已取消',
         
         // 通用
         'common.processing': '处理中',
@@ -815,6 +832,11 @@ const translations = {
         'post.network_cache': '网络异常，已加载本地缓存',
         'post.login_first': '请先登录后再发布作品',
         'post.video_tag': '视频',
+        'post.images_unit': '张',
+        'post.delete_comment_confirm': '确定删除这条评论吗？',
+        'post.delete_comment_warning': '删除后无法恢复',
+        'post.delete_comment_success': '评论已删除',
+        'post.delete_comment_failed': '删除失败',
         
         // 帖子详情
         'post.sort_latest': '最新',
@@ -1056,6 +1078,8 @@ const translations = {
         'common.uploading': '上传中',
         'common.upload_progress': '上传 ({current}/{total})',
         'common.submitting': '提交中',
+        'common.confirming': '确认中',
+        'common.cancelling': '取消中',
         'common.upload_image_progress': '上传图片 ({current}/{total})',
         'common.unknown_task': '未知任务',
         
@@ -1070,15 +1094,20 @@ const translations = {
         'task.confirm_assign': '确定选择 {assignee} 作为接单者吗？',
         'task.confirm_deposit': '将从您的账户扣除订金 {amount} 积分',
         'task.apply_message_prompt': '请输入申请留言（可选）：',
+        'task.apply_message_placeholder': '简单说明你的优势与预计交付时间...',
         'task.confirm_cancel_apply': '确定撤回申请吗？',
+        'task.cancel_apply_warning': '撤回后你的申请将从候选列表中移除',
         'task.apply_cancelled': '已撤回申请',
         'task.cancel_apply_failed': '撤回失败',
         'task.confirm_cancel_task': '确定取消任务吗？此操作不可撤销。',
+        'task.cancel_task_warning': '取消后已冻结的订金将退回你的账户',
         'task.task_cancelled': '任务已取消',
         'task.cancel_task_failed': '取消失败',
         'task.confirm_accept': '确定验收通过吗？',
         'task.confirm_pay_remaining': '将支付尾款 {amount} 积分给接单者',
         'task.reject_reason_prompt': '请输入不通过的原因：',
+        'task.reject_reason_placeholder': '请说明需要修改的具体问题...',
+        'task.reject_reason_required': '请输入拒绝原因',
         'task.work_returned': '已退回修改',
         'task.submit_work': '提交成果',
         'task.deliverable_images': '交付图片',
@@ -1270,6 +1299,8 @@ const translations = {
         // 个人列表
         'profile.privacy_hidden': '由于作者的隐私设置，该列表不对外公开',
         'profile.no_following': '暂无关注的人',
+        'profile.no_followers': '暂无粉丝',
+        'profile.load_more': '加载更多 ({count})',
         'profile.no_collected': '还没有收藏任何内容',
         'profile.go_discover': '去榜单页面或讨论区发现精彩内容吧！',
         'profile.collected_items': '收藏的资源',
@@ -1426,6 +1457,9 @@ const translations = {
         'common.sending': 'Sending...',
         'common.retrying': 'Retrying...',
         'common.retry_failed': 'Retry failed, please try again later',
+        'common.no_more': 'No more items',
+        'common.parse_error': 'Failed to parse response',
+        'common.network_error_retry': 'Network connection failed, please try again later',
         'common.more': 'More',
         'common.back': 'Back',
         'common.search': 'Search',
@@ -1698,6 +1732,7 @@ const translations = {
         'wallet.recharge.custom_placeholder': 'Enter custom amount (1~10000)',
         'wallet.recharge.max_amount_exceeded': 'Single recharge cannot exceed 10000',
         'wallet.recharge.processing': 'Processing...',
+        'wallet.recharge.timeout': 'Payment check timed out. If you have already paid, refresh later to see your balance',
         
         // Withdraw
         'wallet.withdraw.title': '💳 Earnings Withdrawal Center',
@@ -1716,6 +1751,7 @@ const translations = {
         'wallet.withdraw.resend_in': 'Resend in {seconds}s',
         'wallet.withdraw.confirm': 'Confirm Withdrawal (Funds Will Be Frozen for Review)',
         'wallet.withdraw.submitting': '⏳ Submitting...',
+        'wallet.withdraw.timeout': 'Withdrawal request timed out. Check your network and try again',
         'wallet.withdraw.no_balance': 'Your withdrawable balance is 0. Publish quality plugins to earn points!',
         'wallet.withdraw.min_amount': 'Minimum withdrawal is 1 point!',
         'wallet.withdraw.fill_account': 'Please fill in both Alipay account and real name!',
@@ -1783,8 +1819,6 @@ const translations = {
         'feedback.loading': 'Processing...',
         'feedback.success': 'Success',
         'feedback.error': 'Failed, please retry',
-        'feedback.network_error': 'Network error',
-        'feedback.offline': 'Currently offline',
         'feedback.timeout': 'Request timeout',
         'feedback.saved': 'Saved',
         'feedback.logged_out': 'Logged out',
@@ -1808,6 +1842,7 @@ const translations = {
         'social.say_something': 'Say something...',
         'social.reply_to': 'Reply to',
         'social.comment_deleted': 'This comment has been deleted',
+        'social.delete_comment_title': 'Delete Comment',
         'social.delete_comment_confirm': 'Are you sure you want to delete this comment? This cannot be undone.',
         'social.no_comments': 'No comments yet. Be the first!',
         
@@ -1873,6 +1908,7 @@ const translations = {
         'chat.date_day': '',
         'chat.load_more': 'Load earlier messages',
         'chat.msg_too_long': 'Message cannot exceed 1000 characters',
+        'chat.send_failed': 'Send failed: {msg}',
         'chat.load_list_failed': 'Failed to load conversations',
         'chat.load_history_failed': 'Failed to load messages',
         'chat.load_failed_hint': 'Message loading failed',
@@ -1973,6 +2009,12 @@ const translations = {
         'item.tip_board_title': 'Top Supporters (TOP 10)',
         'item.owned_reinstall': 'Owned (Click to reinstall)',
         'item.owned_purchased': 'Purchased (Install on PC)',
+        'web.publish_not_supported': '⚠️ Publishing and editing are not available in the web version',
+        'web.install_on_desktop': 'Please install it in the desktop version',
+        'web.purchase_success_desktop': 'Purchase successful! Please install it in the desktop version',
+        'crop.ratio_label': 'Ratio',
+        'crop.gesture_hint_touch': 'Drag with one finger to reposition | Pinch or use the slider to zoom',
+        'crop.gesture_hint_mouse': 'Drag to reposition | Scroll to zoom',
         'item.update_available': 'Update available (Click for silent hot update)',
         'item.get_now': 'Get Now',
         'item.free': 'Free',
@@ -1981,7 +2023,11 @@ const translations = {
         'time.hours_later': ' hours effective',
         'feedback.deleted': 'Successfully deleted',
         'feedback.delete_failed': 'Delete failed',
+        'feedback.retry_suffix': ', please try again',
         'feedback.cache_fallback': '⚠️ Network failed, showing cached data',
+        'feedback.offline_no_cache': 'Network disconnected, and no local cache available',
+        'feedback.search_local_result': '⚠️ Network unavailable, showing local search results',
+        'feedback.request_cancelled': 'Request cancelled',
         'common.processing': 'Processing',
         'common.got_it': 'Got it',
         'confirm.delete_title': 'Confirm Delete',
@@ -2127,6 +2173,63 @@ const translations = {
         'task.publish_success': 'Task published!',
         'task.publish_failed': 'Publishing failed, please retry',
         'task.max_images': 'Max 6 images',
+        // 🔧 补齐：以下 50 条 zh-CN 已有、en-US 缺失，导致英文界面下任务榜退回中文显示
+        'task.description': 'Task Description',
+        'task.reference_images': 'Reference Images',
+        'task.reference_link': 'Reference Link',
+        'task.assignee': 'Assignee',
+        'task.note': 'Note',
+        // 中文量词「人」，英文不用量词（Applicants (5)），故刻意留空；t() 已修为尊重空值
+        'task.applicants_count': '',
+        'task.choose_assignee': 'Select',
+        'task.confirm_assign': 'Confirm selecting {assignee} as the assignee?',
+        'task.confirm_deposit': 'A deposit of {amount} credits will be deducted from your account',
+        'task.apply_message_prompt': 'Enter your application message (optional):',
+        'task.apply_message_placeholder': 'Briefly describe your strengths and estimated delivery time...',
+        'task.confirm_cancel_apply': 'Withdraw your application?',
+        'task.cancel_apply_warning': 'Your application will be removed from the candidate list',
+        'task.apply_cancelled': 'Application withdrawn',
+        'task.confirm_cancel_task': 'Cancel this task? This cannot be undone.',
+        'task.cancel_task_warning': 'The frozen deposit will be refunded to your account after cancellation',
+        'task.task_cancelled': 'Task cancelled',
+        'task.cancel_task_failed': 'Cancellation failed',
+        'task.confirm_accept': 'Approve and accept the delivery?',
+        'task.confirm_pay_remaining': 'The remaining {amount} credits will be paid to the assignee',
+        'task.reject_reason_prompt': 'Enter the reason for rejection:',
+        'task.reject_reason_placeholder': 'Describe the specific issues that need revision...',
+        'task.reject_reason_required': 'Please enter a reason for rejection',
+        'task.work_returned': 'Returned for revision',
+        'task.submit_work': 'Submit Work',
+        'task.deliverable_images': 'Delivery Images',
+        'task.support_multiple_images': 'Multiple images supported',
+        'task.note_optional': 'Note (optional)',
+        'task.note_placeholder': 'Describe the delivered content...',
+        'task.please_upload_deliverables': 'Please upload delivery images',
+        'task.upload_failed_retry': 'Image upload failed, please retry',
+        'task.submit_success_waiting': 'Work submitted, awaiting acceptance',
+        'task.start_dispute': 'File Dispute',
+        'task.accept_work': 'Accept Work',
+        'task.reject_work': 'Reject Work',
+        'task.task_title': 'Task Title',
+        'task.description_placeholder': 'Describe the requirements, delivery criteria, references...',
+        'task.reference_images_optional': 'Reference images (optional, max 6)',
+        'task.add_reference_image': 'Add reference image',
+        'task.reference_link_optional': 'Reference link (optional)',
+        'task.min_10_credits': 'Minimum 10 credits',
+        'task.deposit_deducted_on_assign': 'Deducted on assignment',
+        'task.price_description': 'Price Breakdown',
+        'task.deposit_on_assign': 'Deposit (deducted when assigning)',
+        'task.remaining_on_accept': 'Balance (deducted on acceptance)',
+        'task.publish_task': 'Publish Task',
+        'task.manage_in_task_list': 'After publishing, manage your tasks in the Task Board',
+        'task.please_enter_title': 'Please enter a task title',
+        'task.please_enter_description': 'Please enter a task description',
+        'task.price_min_10': 'Task price cannot be lower than 10 credits',
+        'task.please_select_deadline': 'Please select a deadline',
+        'task.uploading_images': 'Uploading images',
+        'task.upload_progress': 'Uploading images ({current}/{total})',
+        'task.publishing': 'Publishing',
+        'task.max_6_images': 'Max 6 images',
         'task.view_total': '🔥 Total Views',
         'task.view_today': '📅 Today Views',
         'task.save_changes': 'Save Changes',
@@ -2174,6 +2277,26 @@ const translations = {
         'dispute.notice_2': 'The other party will respond to your dispute',
         'dispute.notice_3': 'Please provide valid evidence',
         'dispute.max_images': 'Max 6 images',
+        // 🔧 补齐：以下 19 条 zh-CN 已有、en-US 缺失，导致英文界面下申诉流程退回中文显示
+        'dispute.start': 'File Dispute',
+        'dispute.reason': 'Dispute Reason',
+        'dispute.reason_placeholder': 'Please describe your reason in detail...',
+        'dispute.evidence_optional': 'Evidence images (optional, max 6)',
+        'dispute.click_upload_evidence': 'Click to upload evidence images',
+        'dispute.submit': 'Submit Dispute',
+        'dispute.submit_success': 'Dispute submitted, awaiting response',
+        'dispute.submit_failed': 'Dispute failed',
+        'dispute.max_6_images': 'Max 6 images',
+        'dispute.please_enter_reason': 'Please enter a dispute reason',
+        'dispute.get_detail_failed': 'Failed to load dispute details',
+        'dispute.related_task': 'Related Task',
+        'dispute.task_id': 'Task ID',
+        'dispute.click_upload_evidence_optional': 'Click to upload evidence images (optional)',
+        'dispute.resolution_result': 'Arbitration Result',
+        'dispute.upload_failed': 'Upload failed',
+        'dispute.please_enter_response': 'Please enter your response',
+        'dispute.response_submitted': 'Response submitted',
+        'dispute.split_result': 'Split by mutual agreement',
         
         // Posts / Forum
         'post.title': 'Forum',
@@ -2186,6 +2309,12 @@ const translations = {
         'post.network_cache': 'Network error, loaded from cache',
         'post.login_first': 'Please login to create posts',
         'post.video_tag': 'Video',
+        // 中文量词「张」，英文不用量词（🖼️ 5），故刻意留空；t() 已修为尊重空值
+        'post.images_unit': '',
+        'post.delete_comment_confirm': 'Delete this comment?',
+        'post.delete_comment_warning': 'This cannot be undone',
+        'post.delete_comment_success': 'Comment deleted',
+        'post.delete_comment_failed': 'Delete failed',
         'post.sort_latest': 'Latest',
         'post.sort_likes': '👍 Most Liked',
         'post.sort_favorites': '🔖 Most Favorited',
@@ -2214,6 +2343,13 @@ const translations = {
         'post.comment_failed': 'Comment failed',
         'post.tip_board_title': '🎁 Top Tippers',
         'post.no_tips': '🎁 No tips yet',
+        // 🔧 补齐：以下 6 条 zh-CN 已有、en-US 缺失，导致英文界面下讨论区退回中文显示
+        'post.uploading_images': 'Uploading images',
+        'post.edit_title': 'Edit Post',
+        'post.delete_confirm_title': 'Confirm Deletion',
+        'post.delete_confirm_desc': 'This cannot be undone. Delete this post?',
+        'post.delete_success': 'Deleted successfully',
+        'post.delete_failed': 'Deletion failed',
         
                 // ✨ Prompt Market
                 'nav.prompts': 'Prompts',
@@ -2417,6 +2553,8 @@ const translations = {
         'common.uploading': 'Uploading',
         'common.upload_progress': 'Upload ({current}/{total})',
         'common.submitting': 'Submitting',
+        'common.confirming': 'Confirming',
+        'common.cancelling': 'Cancelling',
         'common.upload_image_progress': 'Uploading ({current}/{total})',
         'common.unknown_task': 'Unknown Task',
         
@@ -2518,6 +2656,8 @@ const translations = {
         'profile.task_earnings': 'Task Earnings',
         'profile.privacy_hidden': 'This list is private due to the author\'s privacy settings',
         'profile.no_following': 'Not following anyone',
+        'profile.no_followers': 'No followers yet',
+        'profile.load_more': 'Load More ({count})',
         'profile.no_collected': 'No favorites yet',
         'profile.go_discover': 'Go discover content in rankings or forum!',
         'profile.collected_items': 'Favorited Resources',
@@ -2664,7 +2804,17 @@ const translations = {
  */
 export function t(key, params = {}) {
     const lang = translations[currentLang] || translations['zh-CN'];
-    let text = lang[key] || translations['zh-CN'][key] || key;
+    // 🔧 修复：原实现 lang[key] || zh[key] || key 会把「刻意留空的词条」当成缺失又退回中文。
+    // 中文量词/助词在英文里没有对应，必须留空：
+    //   chat.date_day        9月8日  → 9/8
+    //   chat.chatting_suffix 与 X 聊天 → Chatting with X
+    //   creator.output.unit  产出插件 12 个 → Plugins: 12
+    //   profile.transactions_unit  5笔 → 5
+    // 旧逻辑下英文界面实际显示为 9/8日、Chatting with X 聊天、Plugins: 12 个、(5笔)。
+    // 现改为：词条存在即采用（含空串），仅在真正缺键时才回退到中文。
+    let text = Object.prototype.hasOwnProperty.call(lang, key)
+        ? lang[key]
+        : (translations['zh-CN'][key] || key);
     
     // 处理插值 {name}
     Object.entries(params).forEach(([k, v]) => {
@@ -2680,7 +2830,10 @@ export function t(key, params = {}) {
  */
 export function tIfExists(key, fallback = '') {
     const lang = translations[currentLang] || translations['zh-CN'];
-    return lang[key] || translations['zh-CN'][key] || fallback;
+    // 🔧 与 t() 同口径：词条存在即采用（含刻意留空），仅在两级都缺键时用 fallback
+    if (Object.prototype.hasOwnProperty.call(lang, key)) return lang[key];
+    if (Object.prototype.hasOwnProperty.call(translations['zh-CN'], key)) return translations['zh-CN'][key];
+    return fallback;
 }
 
 /**

前端页面/components/视频播放器组件.js

@@ -317,7 +317,7 @@ function _updatePlayButton(btnPlay, video) {
     if (!btnPlay) return;
     const playing = !video.paused && !video.ended;
     btnPlay.textContent = getPlayIcon(playing);
-    btnPlay.title = playing ? (t('video.pause') || '暂停') : (t('video.play') || '播放');
+    btnPlay.title = playing ? t('video.pause') : t('video.play');
 }
 
 /**
@@ -394,14 +394,14 @@ export function getVideoPlayerHTML(videoUrl, posterUrl, options = {}) {
       <div class="video-progress-tooltip">0:00</div>
     </div>
     <div class="video-controls-row">
-      <button class="video-btn-play" title="${t('video.play') || '播放'}">${getPlayIcon(false)}</button>
+      <button class="video-btn-play" title="${t('video.play')}">${getPlayIcon(false)}</button>
       <span class="video-time">0:00 / 0:00</span>
       <div class="video-volume-wrap">
-        <button class="video-btn-volume" title="${t('video.volume') || '音量'}">🔊</button>
+        <button class="video-btn-volume" title="${t('video.volume')}">🔊</button>
         <input type="range" class="video-volume-slider" min="0" max="100" value="100">
       </div>
       <div class="video-speed-wrap">
-        <button class="video-btn-speed" title="${t('video.speed') || '播放速度'}">1x</button>
+        <button class="video-btn-speed" title="${t('video.speed')}">1x</button>
         <div class="video-speed-menu">
           <div data-speed="0.5">0.5x</div>
           <div data-speed="1" class="active">1x</div>
@@ -410,7 +410,7 @@ export function getVideoPlayerHTML(videoUrl, posterUrl, options = {}) {
           <div data-speed="2">2x</div>
         </div>
       </div>
-      <button class="video-btn-fullscreen" title="${t('video.fullscreen') || '全屏'}">⛶</button>
+      <button class="video-btn-fullscreen" title="${t('video.fullscreen')}">⛶</button>
     </div>
   </div>
 </div>
@@ -444,10 +444,10 @@ export function setupVideoPlayerEvents(container) {
     if (!video) return;
 
     // 设置按钮文字（fallback）
-    if (btnPlay) btnPlay.title = t('video.play') || '播放';
-    if (btnVolume) btnVolume.title = t('video.volume') || '音量';
-    if (btnSpeed) btnSpeed.title = t('video.speed') || '播放速度';
-    if (btnFullscreen) btnFullscreen.title = t('video.fullscreen') || '全屏';
+    if (btnPlay) btnPlay.title = t('video.play');
+    if (btnVolume) btnVolume.title = t('video.volume');
+    if (btnSpeed) btnSpeed.title = t('video.speed');
+    if (btnFullscreen) btnFullscreen.title = t('video.fullscreen');
 
     let isDraggingProgress = false;
     let wasPlayingBeforeDrag = false;
@@ -824,7 +824,7 @@ export function openFullscreenVideo(videoUrl, posterUrl, options = {}) {
     const startRate = options.playbackRate || 1;
 
     overlay.innerHTML = `
-    <button class="fs-video-close" title="${t('video.close') || '关闭'}">✕</button>
+    <button class="fs-video-close" title="${t('video.close')}">✕</button>
     <video preload="metadata" poster="${safePoster}" playsinline
         style="width:100vw;height:100vh;object-fit:contain;">
       <source src="${safeVideo}">
@@ -837,14 +837,14 @@ export function openFullscreenVideo(videoUrl, posterUrl, options = {}) {
         <div class="video-progress-tooltip">0:00</div>
       </div>
       <div class="video-controls-row">
-        <button class="video-btn-play" title="${t('video.play') || '播放'}">▶</button>
+        <button class="video-btn-play" title="${t('video.play')}">▶</button>
         <span class="video-time">0:00 / 0:00</span>
         <div class="video-volume-wrap">
-          <button class="video-btn-volume" title="${t('video.volume') || '音量'}">🔊</button>
+          <button class="video-btn-volume" title="${t('video.volume')}">🔊</button>
           <input type="range" class="video-volume-slider" min="0" max="100" value="100">
         </div>
         <div class="video-speed-wrap">
-          <button class="video-btn-speed" title="${t('video.speed') || '播放速度'}">1x</button>
+          <button class="video-btn-speed" title="${t('video.speed')}">1x</button>
           <div class="video-speed-menu">
             <div data-speed="0.5">0.5x</div>
             <div data-speed="1" class="active">1x</div>
@@ -853,7 +853,7 @@ export function openFullscreenVideo(videoUrl, posterUrl, options = {}) {
             <div data-speed="2">2x</div>
           </div>
         </div>
-        <button class="video-btn-fullscreen" title="${t('video.exit_fullscreen') || '退出全屏'}">⛶</button>
+        <button class="video-btn-fullscreen" title="${t('video.exit_fullscreen')}">⛶</button>
       </div>
     </div>
   `;

前端页面/components/顶部导航组件.js

@@ -7,7 +7,7 @@ import { showToast } from "./UI交互提示组件.js";
 import { showAboutInfo } from "./关于插件组件.js";
 import { openNotificationCenter, loadUnreadCount } from "../social/通知中心组件.js";
 import { openSettingsPage } from "./全局设置组件.js";  // ⚙️ 新增
-import { CACHE } from "../core/全局配置.js";
+import { CACHE, escapeHtml } from "../core/全局配置.js";
 import { t } from "./用户体验增强.js";  // 🌐 多语言支持
 import { createTopBanner } from "./顶部广告组件.js";
 import { uploadFile } from "../market/发布内容_提交引擎.js";  // 🖼️ 带压缩管线的统一上传包装器
@@ -42,7 +42,7 @@ export function createTopNav() {
     });
 
     const titleSpan = document.createElement("div");
-    titleSpan.innerHTML = `<strong style='color:#4CAF50;'>ComfyUI</strong> ${t('nav.community') || '社区精选'}`;
+    titleSpan.innerHTML = `<strong style='color:#4CAF50;'>ComfyUI</strong> ${t('nav.community')}`;
     
     Object.assign(titleSpan.style, { fontSize: "16px", cursor: "pointer", transition: "opacity 0.2s" });
     titleSpan.title = "查看关于本插件与作者信息";
@@ -105,7 +105,7 @@ export function createTopNav() {
     // 避免每次 createTopNav 重复 addEventListener 导致闭包累积与轮询失效
 
     chatEntryBtn.onclick = () => {
-        if (!currentUser) return showToast(t('auth.login_required') || "请先登录您的社区账号！", "warning");
+        if (!currentUser) return showToast(t('auth.login_required'), "warning");
         openChatModal(currentUser);
     };
 
@@ -114,7 +114,7 @@ export function createTopNav() {
 
     const updateUserButtonState = () => {
         if (currentUser) {
-            userActionBtn.innerHTML = `👤 ${currentUser.name || currentUser.account || t('common.unknown_user') || '未知用户'}`;
+            userActionBtn.innerHTML = `👤 ${escapeHtml(currentUser.name || currentUser.account || t('common.unknown_user'))}`;
             userActionBtn.style.backgroundColor = "#2196F3";
             userActionBtn.style.borderColor = "#2196F3";
             userActionBtn.onclick = () => openUserProfileModal(currentUser);
@@ -138,12 +138,12 @@ export function createTopNav() {
                         let userData; let token; let isRemember = false;
                         
                         if (formData.type === "reset") {
-                            userActionBtn.innerHTML = `⏳ ${t('auth.resetting_password') || '修改密码中...'}`;
+                            userActionBtn.innerHTML = `⏳ ${t('auth.resetting_password')}`;
                             
                             // 🚀 核心修复：停止错误地拆解字段导致 undefined，直接将包含所有数据的 formData 对象完整传给 API 装甲！
                             await api.resetPassword(formData);
                             
-                            showToast(t('auth.password_reset_success') || "密码修改成功！请使用新密码重新登录。", "success");
+                            showToast(t('auth.password_reset_success'), "success");
                             window.dispatchEvent(new CustomEvent("comfy-route-back")); updateUserButtonState(); return; 
                         }
                         if (formData.type === "register") {
@@ -153,9 +153,9 @@ export function createTopNav() {
                             delete formData.avatarFile;
                             delete formData.avatarDataUrl;  // base64 预览值会被后端拒绝，不随注册提交
 
-                            userActionBtn.innerHTML = `⏳ ${t('auth.registering') || '注册账号中...'}`;
+                            userActionBtn.innerHTML = `⏳ ${t('auth.registering')}`;
                             await api.register(formData);
-                            showToast(t('auth.register_success') + (t('auth.auto_login') || '！正在为您自动登录...'), "success");
+                            showToast(t('auth.register_success') + t('auth.auto_login'), "success");
                             // 注册后自动登录，默认保持登录
                             const res = await api.login(formData.account, formData.password, true);
                             userData = { account: formData.account, name: formData.name, avatar: res.avatar, ...res }; 
@@ -163,7 +163,7 @@ export function createTopNav() {
 
                             // 🖼️ 登录成功后再上传头像（此时请求可携带 Authorization）
                             if (pendingAvatarFile && token) {
-                                userActionBtn.innerHTML = `⏳ ${t('auth.uploading_avatar') || '上传头像中...'}`;
+                                userActionBtn.innerHTML = `⏳ ${t('auth.uploading_avatar')}`;
                                 // 提前写入 token，确保上传与资料更新请求能通过认证
                                 localStorage.setItem("ComfyCommunity_Token", token);
                                 try {
@@ -174,11 +174,11 @@ export function createTopNav() {
                                         userData = { ...userData, ...(updateRes.data || {}) };
                                         if (userData.avatarDataUrl) userData.avatar = userData.avatarDataUrl;
                                     } else {
-                                        showToast(t('auth.avatar_set_failed') || "⚠️ 头像设置失败，您可稍后在个人设置中重新上传", "warning");
+                                        showToast(t('auth.avatar_set_failed'), "warning");
                                     }
                                 } catch (avatarErr) {
                                     console.warn("注册后设置头像失败:", avatarErr.message || avatarErr);
-                                    showToast(t('auth.avatar_set_failed') || "⚠️ 头像设置失败，您可稍后在个人设置中重新上传", "warning");
+                                    showToast(t('auth.avatar_set_failed'), "warning");
                                 }
                             }
                         } else if (formData.type === "login") {

前端页面/core/侧边栏主程序.js

@@ -125,7 +125,7 @@ export function buildSidebarDOM() {
             <option value="downloads">${noTr(t('market.downloads'))}</option>
             <option value="likes">${noTr(t('market.like'))}</option>
             <option value="favorites">${noTr(t('market.favorites'))}</option>
-            <option value="tips">💰 ${noTr(t('market.tips_ranking') || '近期打赏榜')}</option>
+            <option value="tips">💰 ${noTr(t('market.tips_ranking'))}</option>
             <option value="views">${noTr(t('market.views'))}</option>
             <option value="daily_views">${noTr(t('market.daily_views'))}</option>
             <option value="rating">${noTr(t('market.rating'))}</option>
@@ -156,7 +156,7 @@ export function buildSidebarDOM() {
             <option value="tips">${noTr(t('post.sort_tips'))}</option>
             <option value="views">${noTr(t('post.sort_views'))}</option>
             <option value="daily_views">${noTr(t('post.sort_daily_views'))}</option>
-            <option value="rating">${noTr(t('post.sort_rating') || t('market.rating'))}</option>
+            <option value="rating">${noTr(t('post.sort_rating'))}</option>
         </select>
         <!-- 🧩 提示词排序控件（专用） -->
         <select id="prompts-sort-select" style="display: none; background: var(--comfy-input-bg); color: white; border: 1px solid #555; border-radius: 4px; outline: none; padding: 6px; width: 140px; flex-shrink: 0;">
@@ -300,13 +300,13 @@ export function buildSidebarDOM() {
     // 🔴 修复：编辑时先获取详情API数据，确保 has_private_token 等字段完整（列表缓存可能缺少该字段）
     _onSidebarWindow("comfy-route-edit-publish", async (e) => {
         // 📱 Web 模式中央兜底：发布族功能仅本地 ComfyUI 可用
-        if (IS_WEB_MODE) return showToast("⚠️ 网页版暂不支持发布/编辑功能", "warning");
+        if (IS_WEB_MODE) return showToast(t('web.publish_not_supported'), "warning");
         const { itemData, currentUser } = e.detail;
 
         // 先展示加载状态，避免用户感知延迟
         const loadingView = document.createElement("div");
         loadingView.style.cssText = "display:flex;flex-direction:column;align-items:center;justify-content:center;height:400px;color:#888;font-size:14px;";
-        loadingView.innerHTML = `<div style=\"font-size:24px;margin-bottom:10px;\">⏳</div><div>${t('common.loading') || '加载中...'}</div>`;
+        loadingView.innerHTML = `<div style=\"font-size:24px;margin-bottom:10px;\">⏳</div><div>${t('common.loading')}</div>`;
         showInlineView(loadingView);
 
         // 从详情API获取完整数据（确保 has_private_token、netdisk_password 等字段不缺失）
@@ -331,7 +331,7 @@ export function buildSidebarDOM() {
 
     // 监听进入任务编辑页面的请求
     _onSidebarWindow("comfy-route-edit-task", (e) => {
-        if (IS_WEB_MODE) return showToast("⚠️ 网页版暂不支持发布/编辑功能", "warning");
+        if (IS_WEB_MODE) return showToast(t('web.publish_not_supported'), "warning");
         const { taskData, currentUser } = e.detail;
         try {
             const view = createPublishTaskView(currentUser, taskData);
@@ -343,7 +343,7 @@ export function buildSidebarDOM() {
 
     // 监听进入帖子编辑页面的请求
     _onSidebarWindow("comfy-route-edit-post", (e) => {
-        if (IS_WEB_MODE) return showToast("⚠️ 网页版暂不支持发布/编辑功能", "warning");
+        if (IS_WEB_MODE) return showToast(t('web.publish_not_supported'), "warning");
         const { postData, currentUser } = e.detail;
         const view = createPublishPostView(currentUser, postData);
         showInlineView(view);
@@ -351,7 +351,7 @@ export function buildSidebarDOM() {
 
     // 监听进入提示词编辑页面的请求
     _onSidebarWindow("comfy-route-edit-prompt", (e) => {
-        if (IS_WEB_MODE) return showToast("⚠️ 网页版暂不支持发布/编辑功能", "warning");
+        if (IS_WEB_MODE) return showToast(t('web.publish_not_supported'), "warning");
         const { promptData, currentUser } = e.detail;
         const view = createPublishPromptView(currentUser, promptData);
         showInlineView(view);

前端页面/core/侧边栏数据引擎.js

@@ -18,6 +18,9 @@
 
 import { api } from "./网络请求API.js";
 import { proxyImages } from "./网络请求API.js";
+// 🔍 搜索时撤销上一次在途请求所需的取消管理器与分组 ID
+import { requestCancelManager } from "./网络请求API.js";
+import { API } from "./全局配置.js";
 import { createItemCard } from "../market/列表卡片组件.js";
 import { createCreatorCard } from "../market/创作者卡片组件.js";
 import { 
@@ -29,6 +32,7 @@ import {
 } from "../components/性能优化工具.js";
 import { applyViewportAnimations, getAnimationTypeForTab } from "../components/动画音效引擎.js";
 import { t } from "../components/用户体验增强.js";
+import { showToast } from "../components/UI交互提示组件.js";  // 🔧 降级提示改走统一组件（原为手写 div）
 
 // 💬 讨论区组件（动态导入）
 let postsViewModule = null;
@@ -354,15 +358,25 @@ export async function loadSidebarContent({
         state.loader = null;  // 清除引用，防止旧分页器状态残留
     }
     
-    // ========== 渲染函数：渲染一批数据 ==========
+    // ========== 🔍 搜索过滤统一入口 ==========
+    // 🔧 修复：过滤职责原先分裂在三处且口径不一致 —— loadMoreData 与分页器的
+    // getTotalDataCount 都是「先过滤再切片」（正确），而各首屏分支是「先切 20 条再过滤」，
+    // renderBatch 内部又对切好的批次再过滤一次。后果不只是首屏条数偏少：首屏与分页
+    // 处于不同的数据空间（首屏在「原始前 20 条」里找匹配，分页在「过滤后全集」里按 20
+    // 步长切片），排在第 20 条之后的匹配项会永久丢失，甚至首屏直接显示「没有搜索到相关内容」。
+    // 现统一收口到本函数：所有取数路径都先过滤、再切片，renderBatch 只负责渲染。
+    // 创作者Tab的 keyword 由后端搜索接口过滤，此处不做本地过滤（与原口径一致）。
+    const _applySearchScope = (dataArray) => {
+        if (!keyword || tab === "creators") return dataArray;
+        return _filterBySearch(dataArray, keyword);
+    };
+    
+    // ========== 渲染函数：渲染一批数据（只渲染，过滤由 _applySearchScope 统一负责）==========
     const renderBatch = (dataArray, append = false) => {
         if (renderToken !== getRenderToken()) return;
         
-        // 搜索过滤（创作者Tab有keyword时不进行本地过滤，因为后端已过滤）
-        let displayData = dataArray;
-        if (keyword && tab !== "creators") {
-            displayData = _filterBySearch(dataArray, keyword);
-        }
+        // 🔧 数据已由调用方经 _applySearchScope 过滤，本函数只负责渲染（不再二次过滤）
+        const displayData = dataArray;
         
         // 首次渲染清空容器
         if (!append) {
@@ -449,11 +463,8 @@ export async function loadSidebarContent({
         const start = (page - 1) * size;
         const end = start + size;
         
-        // 从全量数据中截取（创作者Tab有keyword时不进行本地过滤，因为后端已过滤）
-        let dataSlice = state.allData;
-        if (keyword && tab !== "creators") {
-            dataSlice = _filterBySearch(state.allData, keyword);
-        }
+        // 从全量数据中截取（统一走 _applySearchScope，与首屏处于同一数据空间）
+        const dataSlice = _applySearchScope(state.allData);
         
         const batch = dataSlice.slice(start, end);
         
@@ -465,25 +476,35 @@ export async function loadSidebarContent({
     };
     
     // ========== 尝试从缓存加载 ==========
+    // 📌 本处的缓存口径与 任务榜/讨论区/提示词（统一走 性能优化工具.js 的
+    // readListCache，命中后一律调 silentRefresh 后台补新）**刻意不同**，不是历史遗留，勿顺手归一：
+    //   - 这里缓存的是全量数据（items 200 条 / creators 500 条），分页完全在本地做，
+    //     所以缓存命中即等于「数据完整」，只在 expired 时才值得再发一次网络请求；
+    //   - 那三个列表只缓存第一页，命中后数据必然不完整，故一律后台 silentRefresh 补新。
+    // 若强行统一成「总是后台刷新」，插件榜会在每次 Tab 切换时多发一次 200 条的全量请求。
     // 获取完整缓存信息（包含过期状态）
     const { value: cachedData, expired: isCacheExpired, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
     
     // 有缓存时直接渲染缓存（搜索时也使用缓存，renderBatch 会处理 keyword 过滤）
     // 🔍 创作者Tab有keyword时不使用缓存，每次都从后端搜索
-    // 🔍 如果当前state是搜索结果且keyword为空，跳过缓存，强制从网络重新加载全量数据
-    const skipCache = (tab === "creators" && keyword) || (tab === "creators" && !keyword && state.isSearchResult);
+    // 🔧 修复：原实现还把「刚清空搜索框」也列为跳过缓存的理由，但 cacheKey 不含 keyword、
+    // 搜索结果也从不写入该键（见下方 isCreatorSearch 判断），缓存里存的始终是干净的全量列表，
+    // 清空搜索框后完全可以直接用缓存上屏；强制联网只会让用户在弱网下白等一整个重试预算
+    const skipCache = tab === "creators" && !!keyword;
     if (!force && hasCacheData && !skipCache) {
         // 🚀 缓存数据也需要过一遍图片代理，确保新字段也被处理
         const proxiedData = proxyImages(cachedData);
         state.allData = proxiedData;
         state.isFullyLoaded = true;
+        // 缓存是全量列表而非搜索结果，清除搜索标记，避免下次加载仍被当作搜索结果处理
+        if (tab === "creators" && !keyword) state.isSearchResult = false;
         
-        // 首屏渲染（仅第一页）
-        const firstPage = proxiedData.slice(0, pageSize);
-        renderBatch(firstPage, false);
+        // 首屏渲染（仅第一页）—— 先过滤再切片，与 loadMoreData 同一数据空间
+        const scopedData = _applySearchScope(proxiedData);
+        renderBatch(scopedData.slice(0, pageSize), false);
         
         // 如果有更多数据，启动分页加载器
-        if (proxiedData.length > pageSize) {
+        if (scopedData.length > pageSize) {
             _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyword, tab);
         }
         
@@ -531,15 +552,22 @@ export async function loadSidebarContent({
                         
                         // 完整重新渲染（替代之前只更新数字的方案）
                         contentArea.innerHTML = "";
-                        const firstPage = newData.slice(0, pageSize);
-                        renderBatch(firstPage, false);
+                        // 🔧 先过滤再切片：搜索场景下静默刷新同样会触发，
+                        // 原实现在 newData 前 20 条里过滤，会漏掉靠后的匹配项
+                        const scopedNewData = _applySearchScope(newData);
+                        renderBatch(scopedNewData.slice(0, pageSize), false);
                         
-                        if (newData.length > pageSize) {
+                        if (scopedNewData.length > pageSize) {
                             _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyword, savedTab);
                         }
                     } else {
-                        // 数据无变化，仅刷新缓存过期时间
-                        setCache(cacheKey, state.allData, getCacheExpireTime(), true);
+                        // 关键字段无变化 → 无需重渲染。但 newData 才是刚从云端取回的权威数据，
+                        // 缓存必须回写 newData：若仍回写旧的 state.allData，等于把旧数据固化并
+                        // 续期（续期后 isCacheExpired 转 false，下次连静默刷新都不再触发），
+                        // 导致缓存中的旧版本号被长期锁死、卡片徽章无法出现。
+                        // 注意此处刻意不更新 state.allData：首屏已按旧数据渲染，保持二者一致可
+                        // 避免分页加载与已渲染卡片错位；新数据在下次进入读取缓存时生效
+                        setCache(cacheKey, newData, getCacheExpireTime(), true);
                     }
                 } catch (err) {
                     console.warn(`⚠️ ${savedTab}_${savedSort} 后台刷新失败:`, err);
@@ -565,12 +593,12 @@ export async function loadSidebarContent({
         state.isFullyLoaded = true;
         state.displayedCount = 0;  // 重置已显示计数，因为数据重新排序了
         
-        // 首屏渲染
-        const firstPage = locallySorted.slice(0, pageSize);
-        renderBatch(firstPage, false);
+        // 首屏渲染（先过滤再切片）
+        const scopedSorted = _applySearchScope(locallySorted);
+        renderBatch(scopedSorted.slice(0, pageSize), false);
         
         // 启动分页加载器
-        if (locallySorted.length > pageSize) {
+        if (scopedSorted.length > pageSize) {
             _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyword, tab);
         }
         
@@ -580,10 +608,45 @@ export async function loadSidebarContent({
         return; // 本地排序后直接返回，不需要后台刷新（数据是同一批）
     }
     
-    // ========== 显示加载骨架屏 ==========
-    contentArea.innerHTML = "";
-    const skeleton = createSkeleton(tab === "creators" ? "list" : "card", 3);
-    contentArea.appendChild(skeleton);
+    // ========== 🚀 缓存先行：阻塞前先用本地已有数据上屏 ==========
+    // 走到这里说明上面两条快路径都没命中：要么是 force 强制刷新（刻意跳过缓存），
+    // 要么是本次会话还没有该 tab 的完整数据。弱网下一次列表请求最长要烧满整个重试预算，
+    // 期间用户只能盯骨架屏；此刻若本地已有可用数据，就先渲染首屏，网络请求照常往下走，
+    // 回来后按 renderToken + _shouldUpdateData 决定是否重渲染（与上方静默刷新同口径）。
+    // 🔍 创作者搜索场景不参与：renderBatch 对创作者不做本地过滤，先上屏全量列表会混入非搜索结果
+    let renderedInstant = false;
+    if (!isCreatorSearching) {
+        // 可立即上屏的数据：当前排序的列表缓存（force 时被跳过）→ 创作者 sessionStorage 降级副本
+        let instantData = (hasCacheData && Array.isArray(cachedData) && cachedData.length > 0) ? cachedData : null;
+        if (!instantData && tab === "creators") {
+            const sessionData = getCreatorsFromSessionStorage();
+            if (Array.isArray(sessionData) && sessionData.length > 0) instantData = sessionData;
+        }
+        if (instantData) {
+            console.log(`🚀 ${tab}_${sort} 缓存先行：先用本地数据渲染首屏，网络请求转后台`);
+            // 🚀 与上方缓存命中分支同口径：本地数据也过一遍图片代理（proxyImages 内部会先剥除
+            // 已有代理前缀，幂等），确保代理规则新增的字段同样被处理
+            // sessionStorage 副本的顺序不保证与当前排序一致，统一本地排一次（对已排序数据幂等）
+            const sortedData = sortDataLocally(proxyImages(instantData), tab, sort);
+            state.allData = sortedData;
+            state.isFullyLoaded = true;
+            state.isSearchResult = false;
+            // 🔧 先过滤再切片（tools/apps/recommends 带 keyword 时同样会进入本分支）
+            const scopedInstant = _applySearchScope(sortedData);
+            renderBatch(scopedInstant.slice(0, pageSize), false);
+            if (scopedInstant.length > pageSize) {
+                _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyword, tab);
+            }
+            renderedInstant = true;
+        }
+    }
+    
+    // ========== 显示加载骨架屏（已有本地数据上屏时跳过，避免闪屏）==========
+    if (!renderedInstant) {
+        contentArea.innerHTML = "";
+        const skeleton = createSkeleton(tab === "creators" ? "list" : "card", 3);
+        contentArea.appendChild(skeleton);
+    }
     
     // ========== 从网络加载数据 ==========
     try {
@@ -597,6 +660,11 @@ export async function loadSidebarContent({
         } else if (tab === "creators") {
             // 🔍 创作者搜索：有 keyword 时调用后端搜索API，否则获取列表
             if (keyword) {
+                // 🔍 先撤销上一次仍在途的搜索请求：用户继续输入后，上一次的关键词已经作废，
+                // 但它的请求还会继续占用并发额度（全局最多 6 个）与最长 10 秒的超时预算，
+                // 把最新这次搜索挤到后面排队，弱网下表现为「一直在转圈」。
+                // 只撤销搜索分组，不影响列表、详情、点赞等任何其它请求
+                requestCancelManager.cancelAll(API.SEARCH_COMPONENT_ID);
                 response = await api.searchCreators(keyword, sort);
                 realData = response.data || [];
                 realData = proxyImages(realData);  // 确保图片走本地缓存代理
@@ -622,37 +690,67 @@ export async function loadSidebarContent({
             saveCreatorsToSessionStorage(realData);
         }
         
+        state.isFullyLoaded = true;
+        
+        // 🚀 缓存先行场景：网络数据与已上屏的本地数据无实质差异时不重渲染，避免清屏重画
+        // 打断用户已经滚动的阅读位置（与上方后台静默刷新同口径）。缓存已在上面回写权威新数据，
+        // 此处刻意不更新 state.allData，保持与已渲染卡片一致，防止分页加载错位
+        if (renderedInstant && !_shouldUpdateData(state.allData, realData)) {
+            return;
+        }
+        
         // 更新状态
         state.allData = realData;
-        state.isFullyLoaded = true;
         
-        // 渲染首屏
-        const firstPage = realData.slice(0, pageSize);
-        renderBatch(firstPage, false);
+        // 渲染首屏（先过滤再切片：tools/apps/recommends 的 keyword 是本地搜索，
+        // realData 是未过滤的全量数据，原实现在前 20 条里过滤会漏掉靠后的匹配项）
+        const scopedReal = _applySearchScope(realData);
+        renderBatch(scopedReal.slice(0, pageSize), false);
         
         // 启动分页加载器
-        if (realData.length > pageSize) {
+        if (scopedReal.length > pageSize) {
             _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyword, tab);
         }
         
     } catch (error) {
+        // 🔍 防竞态：本次加载已被更新的加载取代（切Tab、换排序、继续输入关键词）时直接退出。
+        // renderBatch 内部本来就有这道守卫，但它之外的降级分支会直接写 contentArea.innerHTML
+        // 并弹提示，缺少守卫会让过期结果覆盖掉新内容
+        if (renderToken !== getRenderToken()) {
+            console.warn(`⏹️ ${tab}_${sort} 请求已过期，忽略本次失败`);
+            return;
+        }
+        // 🔍 主动撤销（上方 cancelAll）不是网络故障：用户只是又敲了一个字，
+        // 新一次加载已经在跑了。这里必须静默退出，否则会误弹「网络不可用」提示
+        if (error && error.name === 'RequestCancelledError') {
+            console.log(`⏹️ ${tab}_${sort} 搜索请求已被新关键词取代`);
+            return;
+        }
         console.error("数据加载失败:", error);
         
+        // 🚀 缓存先行场景：首屏已经用本地数据上屏，网络失败时保持当前画面即可，不再走下面的
+        // 降级分支（否则会把同一批数据重渲染一遍、重播卡片动画）。与上方后台静默刷新失败一致：
+        // 只记录日志，不额外打扰用户
+        if (renderedInstant) {
+            console.warn(`📴 ${tab}_${sort} 网络刷新失败，保持已渲染的本地数据`);
+            return;
+        }
+        
         // 🚀 回退到任何可用缓存（包括过期的）
         // 🔍 创作者Tab搜索场景跳过此分支：renderBatch 对创作者不做本地过滤，
         // 直接渲染全量缓存会导致搜索结果未过滤，改由下方本地搜索降级分支处理
         if (hasCacheData && cachedData && !(tab === "creators" && keyword)) {
             console.warn(`📴 网络失败，降级显示${isCacheExpired ? '过期' : ''}缓存`);
             state.allData = cachedData;
-            renderBatch(cachedData.slice(0, pageSize), false);
+            // 🔧 先过滤再切片：本分支已排除 creators+keyword，但 tools/apps/recommends
+            // 带 keyword 时会进来；renderBatch 不再自行过滤，此处必须显式过滤
+            const scopedCached = _applySearchScope(cachedData);
+            renderBatch(scopedCached.slice(0, pageSize), false);
             
             // 如果是过期缓存，显示提示
+            // 🔧 改用统一提示组件 + 词典（原为手写 div、无动画不排队，且文案硬编码中文）
             if (isCacheExpired) {
-                const toastDiv = document.createElement('div');
-                toastDiv.style.cssText = 'position:fixed; top:20px; left:50%; transform:translateX(-50%); background:#FF9800; color:white; padding:10px 20px; border-radius:4px; z-index:10000; font-size:14px;';
-                toastDiv.textContent = '⚠️ 网络连接失败，展示的是上次缓存的数据';
-                document.body.appendChild(toastDiv);
-                setTimeout(() => toastDiv.remove(), 3000);
+                showToast(t('feedback.cache_fallback'), 'warning');
             }
             return;
         }
@@ -691,11 +789,8 @@ export async function loadSidebarContent({
                             </div>
                         `;
                         
-                        const toastDiv = document.createElement('div');
-                        toastDiv.style.cssText = 'position:fixed; top:20px; left:50%; transform:translateX(-50%); background:#FF9800; color:white; padding:10px 20px; border-radius:4px; z-index:10000; font-size:14px;';
-                        toastDiv.textContent = '⚠️ 网络不可用，显示本地搜索结果';
-                        document.body.appendChild(toastDiv);
-                        setTimeout(() => toastDiv.remove(), 3000);
+                        // 🔧 改用统一提示组件 + 词典（原为手写 div 且文案硬编码中文）
+                        showToast(t('feedback.search_local_result'), 'warning');
                         return;
                     }
                 }
@@ -703,26 +798,24 @@ export async function loadSidebarContent({
                 // 按当前排序排序
                 displayData = sortDataLocally(displayData, tab, sort);
                 state.allData = displayData;
-                renderBatch(displayData.slice(0, pageSize), false);
+                // 统一走 _applySearchScope（创作者Tab恒等返回，数据已由上方
+                // searchCreatorsLocally 过滤），保证各渲染入口口径完全一致
+                const scopedFallback = _applySearchScope(displayData);
+                renderBatch(scopedFallback.slice(0, pageSize), false);
                 
                 // 启动分页加载器
-                if (displayData.length > pageSize) {
+                if (scopedFallback.length > pageSize) {
                     _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyword, tab);
                 }
                 
-                const toastDiv = document.createElement('div');
-                toastDiv.style.cssText = 'position:fixed; top:20px; left:50%; transform:translateX(-50%); background:#FF9800; color:white; padding:10px 20px; border-radius:4px; z-index:10000; font-size:14px;';
-                toastDiv.textContent = keyword 
-                    ? '⚠️ 网络不可用，显示本地搜索结果' 
-                    : '⚠️ 网络连接失败，展示的是本地缓存的数据';
-                document.body.appendChild(toastDiv);
-                setTimeout(() => toastDiv.remove(), 3000);
+                // 🔧 改用统一提示组件 + 词典（原为手写 div 且两条文案均硬编码中文）
+                showToast(keyword ? t('feedback.search_local_result') : t('feedback.cache_fallback'), 'warning');
                 return;
             } else if (keyword) {
                 contentArea.innerHTML = '';
                 const emptyDiv = document.createElement('div');
                 emptyDiv.style.cssText = 'text-align:center; padding: 40px 20px; color:#888;';
-                emptyDiv.textContent = `🔌 ${t('common.network_error_retry') || '网络连接失败，请稍后重试'}`;
+                emptyDiv.textContent = `🔌 ${t('common.network_error_retry')}`;
                 contentArea.appendChild(emptyDiv);
                 return;
             }
@@ -767,24 +860,24 @@ function _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyw
         // 添加手动加载按钮作为 fallback
         let nextPage = 2;
         const loadMoreBtn = document.createElement('button');
-        loadMoreBtn.textContent = t('task.load_more') || '加载更多';
+        loadMoreBtn.textContent = t('task.load_more');
         loadMoreBtn.style.cssText = 'width:100%;padding:10px;margin-top:10px;cursor:pointer;border:1px solid #555;border-radius:6px;background:transparent;color:inherit;';
         loadMoreBtn.onclick = async () => {
             loadMoreBtn.disabled = true;
-            loadMoreBtn.textContent = t('common.loading') || '加载中...';
+            loadMoreBtn.textContent = t('common.loading');
             try {
                 const result = await loadMoreData(nextPage, pageSize);
                 if (result && result.length > 0) {
                     nextPage++;
-                    loadMoreBtn.textContent = t('task.load_more') || '加载更多';
+                    loadMoreBtn.textContent = t('task.load_more');
                 } else {
-                    loadMoreBtn.textContent = t('common.no_more') || '没有更多了';
+                    loadMoreBtn.textContent = t('common.no_more');
                     loadMoreBtn.style.cursor = 'default';
                     loadMoreBtn.onclick = null;
                 }
             } catch (err) {
                 console.error("手动加载更多失败:", err);
-                loadMoreBtn.textContent = t('task.load_failed') || '加载失败，点击重试';
+                loadMoreBtn.textContent = t('task.load_failed');
             }
             loadMoreBtn.disabled = false;
         };
@@ -793,6 +886,8 @@ function _setupPaginationLoader(contentArea, state, pageSize, loadMoreData, keyw
     }
     
     // 计算数据总量（考虑搜索过滤，创作者Tab有keyword时不进行本地过滤，因为后端已过滤）
+    // 📌 口径必须与 loadSidebarContent 内的 _applySearchScope 一致（先过滤再计数）；
+    // 本函数是模块级、拿不到那个闭包，故保留等价实现，改动其一务必同步另一处
     const getTotalDataCount = () => {
         if (!keyword) return state.allData.length;
         // 创作者Tab后端搜索已过滤，直接返回全部数据
@@ -853,7 +948,8 @@ function _shouldUpdateData(oldData, newData) {
     if (oldData.length !== newData.length) return true;
     
     // 检查ID顺序是否一致（检测排序变化、新增/删除）
-    const checkCount = Math.min(10, oldData.length);
+    // 比对条数覆盖首屏渲染量（PAGE_SIZE），避免首屏可见卡片（第 11~20 条）的版本/数字更新被漏检
+    const checkCount = Math.min(PAGE_SIZE, oldData.length);
     for (let i = 0; i < checkCount; i++) {
         const oldId = oldData[i].id || oldData[i].account;
         const newId = newData[i].id || newData[i].account;
@@ -864,6 +960,10 @@ function _shouldUpdateData(oldData, newData) {
         for (const field of keyFields) {
             if ((oldData[i][field] || 0) !== (newData[i][field] || 0)) return true;
         }
+
+        // 检查版本号（字符串）：云端扫描到插件新版本时往往只有 latest_version 变化，
+        // 点赞/下载/浏览等数字字段全不动；若不比对它，卡片上的"可更新"徽章将永远刷不出来
+        if ((oldData[i].latest_version || '') !== (newData[i].latest_version || '')) return true;
     }
     return false;
 }

前端页面/core/全局配置.js

@@ -18,7 +18,7 @@
 // 🌐 API 配置
 // ==========================================
 
-/** @type {{ BASE_URL: string, TIMEOUT: number, MAX_RETRIES: number, RETRY_DELAY: number }} */
+/** @type {{ BASE_URL: string, TIMEOUT: number, MAX_RETRIES: number, RETRY_DELAY: number, LIST_RETRIES: number, SEARCH_TIMEOUT: number, SEARCH_RETRIES: number, SEARCH_COMPONENT_ID: string }} */
 export const API = {
     // 云端 API 基础地址
     BASE_URL: "https://zhiwei666-comfyui-ranking-api.hf.space",
@@ -26,11 +26,29 @@ export const API = {
     // 请求超时时间（毫秒）
     TIMEOUT: 30000,
     
-    // 重试次数
-    MAX_RETRIES: 3,
-    
-    // 重试间隔（毫秒）
-    RETRY_DELAY: 1000
+    // GET 请求重试次数（实际尝试 MAX_RETRIES + 1 次）
+    // 🔧 修复：此前本值为 3 且全库无人读取，真正的重试次数硬编码在 网络请求_基础设施.js 中为 2，
+    // 现改为由基础设施读取本配置；取值 2 以保持既有的「共 3 次尝试」行为不变
+    MAX_RETRIES: 2,
+    
+    // 重试间隔（毫秒，指数退避基数：1s、2s、4s…）
+    RETRY_DELAY: 1000,
+    
+    // 🐢 弱网预算分级（仅作用于 GET，由 网络请求_基础设施.js 按 endpoint 路径精确匹配）
+    // 默认预算下弱网一次列表请求最长要烧 3×30s + 1s + 2s = 93s，期间用户只能盯骨架屏。
+    // 列表类：首屏已可由本地缓存先行上屏（见 侧边栏数据引擎.js），且列表往往是会话的第一个请求、
+    // 可能撞上 HF Space 冷启动（本项目无预热机制），故只砍掉一次冗余重试、保留 30s 单次超时，
+    // 93s → 61s，冷启动仍有机会在前两次尝试内完成
+    LIST_RETRIES: 1,
+    // 搜索类：必然发生在列表已加载之后（空间已被唤醒），可放心收紧，93s → 10s×2 + 1s = 21s
+    SEARCH_TIMEOUT: 10000,
+    SEARCH_RETRIES: 1,
+    
+    // 🔍 创作者搜索请求的取消分组 ID
+    // 用户在搜索框继续输入时，侧边栏数据引擎.js 据此撤销上一次仍在途的搜索请求。
+    // 不撤销的话，作废请求会持续占用并发额度（最多 6 个）与超时预算，
+    // 把最新那次搜索挤到后面排队。仅搜索请求归入本分组，不影响其它任何请求
+    SEARCH_COMPONENT_ID: "sidebar-search"
 };
 
 
@@ -425,6 +443,28 @@ const PROFILE_CACHE_PREFIX = "ComfyCommunity_ProfileCache_";
 const _pendingProfileRequests = new Map();  // 防止 N+1 并发请求
 const PENDING_TIMEOUT = 30000;  // 挂起请求超时清理时间（毫秒）
 
+// ==========================================
+// 🔒 HTML 转义（底层公共工具）
+// ==========================================
+// 放在本文件（零依赖的底层模块）而非 components/互动工具函数.js，是因为
+// UI交互提示组件.js 与 打赏等级工具.js 都需要它，而互动工具函数.js 反向依赖这两者
+// （导入 showToast、re-export renderTipBoardHTML），从那里导入会形成循环依赖。
+// 互动工具函数.js 仍以 re-export 方式对外暴露同名函数，既有调用方无需改动。
+
+/**
+ * HTML转义（统一版：各组件局部副本已归一到此）
+ * @param {*} str - 原始字符串（非字符串会先强制转换，兼容数字等入参）
+ * @returns {string} 转义后的字符串
+ */
+export function escapeHtml(str) {
+    if (str === null || str === undefined || str === "") return "";
+    return String(str).replace(/&/g, "&")
+              .replace(/</g, "&lt;")
+              .replace(/>/g, "&gt;")
+              .replace(/"/g, "&quot;")
+              .replace(/'/g, "&#039;");
+}
+
 /** 统一字段映射：将后端 avatarDataUrl 映射为前端 avatar */
 function _mapAvatarField(profile) {
     if (profile && profile.avatarDataUrl && !profile.avatar) {
@@ -540,12 +580,14 @@ export function renderAvatarWithSWR(options) {
     }
     
     // 生成初始 HTML（无头像时显示首字母背景）
+    // 🔒 XSS防护：avatar/name/initial 均来自用户可修改的资料（昵称首字母可能是 < ），
+    // 写入 HTML 前必须转义；上方 SWR 刷新路径用的是 .src / .textContent，本身就是安全的。
     const initial = (name || account || 'U')[0].toUpperCase();
     const avatarHtml = avatar 
-        ? `<img class="swr-avatar" src="${avatar}" style="width: ${avatarSize}px; height: ${avatarSize}px; border-radius: 50%; object-fit: cover; flex-shrink: 0; background: #333;">` 
-        : `<div class="swr-avatar" style="width: ${avatarSize}px; height: ${avatarSize}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${Math.floor(avatarSize * 0.5)}px; font-weight: bold; flex-shrink: 0;">${initial}</div>`;
+        ? `<img class="swr-avatar" src="${escapeHtml(avatar)}" style="width: ${avatarSize}px; height: ${avatarSize}px; border-radius: 50%; object-fit: cover; flex-shrink: 0; background: #333;">` 
+        : `<div class="swr-avatar" style="width: ${avatarSize}px; height: ${avatarSize}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${Math.floor(avatarSize * 0.5)}px; font-weight: bold; flex-shrink: 0;">${escapeHtml(initial)}</div>`;
     
-    return `<span id="${containerId}" style="display: inline-flex; align-items: center; gap: 6px;">${avatarHtml}<span class="swr-name">${name}</span></span>`;
+    return `<span id="${escapeHtml(containerId)}" style="display: inline-flex; align-items: center; gap: 6px;">${avatarHtml}<span class="swr-name">${escapeHtml(name)}</span></span>`;
 }
 
 

前端页面/core/状态管理.js

@@ -2,12 +2,13 @@
 // ==========================================
 // 🏪 全局状态管理中心
 // ==========================================
-// 作用：集中管理应用状态，提供响应式更新和事件通知
+// 作用：集中管理应用状态（含全项目网络状态），提供响应式更新和事件通知
 // 关联文件：
 //   - 类型定义.js (类型定义)
 //   - 所有需要共享状态的组件
 //   - 顶部导航组件.js (用户登录状态)
 //   - 侧边栏主程序.js (当前视图状态)
+//   - 网络请求_基础设施.js / 网络请求_图片代理.js (调用 isOnline() 决定是否走缓存回退)
 // ==========================================
 // 🏗️ P2架构优化：轻量级状态管理
 // 🏗️ P2质量优化：JSDoc 类型注释
@@ -53,10 +54,9 @@ const state = {
         users: new Map()
     },
     
-    // 网络状态
+    // 网络状态（全项目唯一数据源，见下方「🌐 网络状态管理」段落）
     network: {
-        isOnline: navigator.onLine,
-        lastSyncTime: null
+        isOnline: navigator.onLine
     }
 };
 
@@ -432,9 +432,15 @@ export function isLoading() {
 // ==========================================
 // 🌐 网络状态管理
 // ==========================================
+// 🏗️ 全项目网络状态的唯一数据源。
+// online/offline 事件只在本模块注册一次，下列消费方一律调用 isOnline()，
+// 不再各自维护状态副本与重复监听，避免出现「横幅显示离线但列表仍在发请求」
+// 这类多份状态不同步的分裂表现：
+//   - 网络请求_基础设施.js —— 离线 GET 直返缓存、重试耗尽回退过期缓存
+//   - 网络请求_图片代理.js —— 离线时不构造远程直链，保持相对路径原样
 
 /**
- * 更新网络状态
+ * 更新网络状态（仅供内部 online/offline 监听调用）
  * @param {boolean} online - 是否在线
  */
 export function setNetworkStatus(online) {
@@ -442,19 +448,23 @@ export function setNetworkStatus(online) {
     state.network.isOnline = online;
     
     if (wasOnline !== online) {
+        console.log(online ? '🌐 网络已恢复' : '📴 网络已断开');
         eventBus.emit(EVENTS.NETWORK_CHANGE, { online });
     }
 }
 
 /**
  * 检查是否在线
+ * 
+ * 注意：navigator.onLine 仅反映本机网络接口状态，不代表云端服务可达；
+ * 云端不可达（502 / DNS 污染 / 证书失败）由 request() 的重试耗尽兜底负责。
  * @returns {boolean}
  */
 export function isOnline() {
     return state.network.isOnline;
 }
 
-// 自动监听网络状态
+// 自动监听网络状态（全项目唯一一次注册）
 if (typeof window !== "undefined") {
     window.addEventListener("online", () => setNetworkStatus(true));
     window.addEventListener("offline", () => setNetworkStatus(false));

前端页面/core/网络请求API.js

@@ -8,6 +8,10 @@
 //   - 网络请求_缓存管理.js (缓存配置、TTL、精确失效映射)
 //   - 网络请求_业务API.js (api对象：40+个业务方法)
 // ==========================================
+// 📌 本文件只 re-export 下面三行的符号；缓存读写工具（getCache / setCache /
+//    getCacheWithMeta / removeCache / removeCacheByPrefix，以及列表缓存
+//    readListCache / writeListCache）不在这里，统一从 components/性能优化工具.js 导入。
+// ==========================================
 
 export { request, requestCancelManager, invalidateRelatedCache, requestSSE } from './网络请求_基础设施.js';
 export { proxyImages, unproxyImages } from './网络请求_图片代理.js';

前端页面/core/网络请求_业务API.js

@@ -8,6 +8,7 @@
 // ==========================================
 
 import { request } from "./网络请求_基础设施.js";
+import { API } from "./全局配置.js";
 
 // ============== 业务 API 导出 ==============
 const api = {
@@ -54,7 +55,9 @@ const api = {
     async updatePrivacy(account, privacy) { return request(`/api/users/${account}/privacy`, { method: "PUT", body: privacy }); },
     async toggleFollow(userId, targetAccount, isActive) { return request("/api/users/follow", { method: "POST", body: { user_id: userId, target_account: targetAccount, is_active: isActive } }); },
     async getCreators(sort, limit) { return request(`/api/creators?sort=${sort}&limit=${limit}`); },
-    async searchCreators(keyword, sort, limit = 50) { return request(`/api/creators/search?keyword=${encodeURIComponent(keyword)}&sort=${sort}&limit=${limit}`); },
+    // 🔍 带上取消分组 ID：用户继续输入时，上一次仍在途的搜索请求可被 requestCancelManager 撤销，
+    // 不再占用并发额度与超时预算（调用时机见 侧边栏数据引擎.js 的创作者搜索分支）
+    async searchCreators(keyword, sort, limit = 50) { return request(`/api/creators/search?keyword=${encodeURIComponent(keyword)}&sort=${sort}&limit=${limit}`, { componentId: API.SEARCH_COMPONENT_ID }); },
     async getCreatorDetails(account) { return request(`/api/creators/${account}/details`); },
     async uploadFile(file, fileType, timeout = 120000) {
         const formData = new FormData();

前端页面/core/网络请求_图片代理.js

@@ -6,6 +6,7 @@
 // ==========================================
 
 import { API, IS_WEB_MODE } from './全局配置.js';
+import { isOnline } from './状态管理.js';  // 🌐 网络状态统一取自 状态管理.js，不再直读 navigator.onLine
 
 // 🟢 入口清洗：接收云端数据时，转换为本地代理，并带【自愈机制】清理被污染的历史数据
 // 🚀 统一缓存：所有头像字段都走同一个缓存代理，无需重复下载
@@ -68,7 +69,7 @@ export function proxyImages(obj) {
                 } else if (originalUrl && !originalUrl.startsWith('/') && !originalUrl.startsWith('data:')) {
                     // 🎬 相对路径（如 uploads/post_video/...）
                     // 离线时不构造远程 URL，保持原样让浏览器从当前域尝试加载
-                    if (navigator.onLine === false) {
+                    if (!isOnline()) {
                         obj[key] = originalUrl;
                     } else {
                         const fullUrl = `${API.BASE_URL}/api/image_proxy?path=${encodeURIComponent(originalUrl)}`;

前端页面/core/网络请求_基础设施.js

@@ -11,9 +11,12 @@
 
 import { removeCache, getCacheWithMeta } from "../components/性能优化工具.js";
 import { API, CACHE } from "./全局配置.js";
-import { logoutAndClearUserData } from "./状态管理.js";
+import { logoutAndClearUserData, isOnline } from "./状态管理.js";
 import { CACHE_CONFIG, CACHE_INVALIDATION_MAP, invalidateRelatedCache, _getCacheTTL, getCache, setCache } from "./网络请求_缓存管理.js";
 import { unproxyImages } from "./网络请求_图片代理.js";
+// 🔧 直接引入 i18n 叶子模块（而非 用户体验增强.js）：本文件处于依赖链最上游，
+// 引入带 DOM 初始化副作用的增强层可能造成启动时序问题；国际化模块无副作用、零循环依赖
+import { t } from "../components/用户体验_国际化.js";
 
 // 🚀 动态时序导入：proxyImages 通过动态 import() 获取，避免模块初始化时序问题
 let _proxyImages = null;
@@ -31,10 +34,8 @@ const BASE_URL = API.BASE_URL;
 // ⚡ P1性能优化：请求去重（相同GET请求只发一次）
 const pendingRequests = new Map();
 
-// 🚀 P3优化：网络状态监控
-let isOnline = navigator.onLine;
-window.addEventListener('online', () => { isOnline = true; console.log('🌐 网络已恢复'); });
-window.addEventListener('offline', () => { isOnline = false; console.log('📴 网络已断开'); });
+// 🚀 P3优化：网络状态由 状态管理.js 的 isOnline() 统一提供（见下方离线模式支持），
+// 本模块不再自行注册 online/offline 监听。
 
 // 🔧 修复：401（Token 过期/签名无效）统一处理——清除本地凭证并提示重新登录。
 // 背景：服务端更换 JWT_SECRET 或 Token 过期后，旧 Token 被云端拒签，若不清除
@@ -106,11 +107,16 @@ const requestCancelManager = {
     cancelAll(componentId) {
         const controllers = this._controllers.get(componentId);
         if (controllers) {
+            const count = controllers.size;
             for (const controller of controllers) {
                 controller.abort();
             }
             controllers.clear();
-            console.log(`🚫 已取消组件 [${componentId}] 的所有请求`);
+            // 🔧 仅在实际撤销了请求时打日志：本方法会被搜索框的每一次输入触发，
+            // 绝大多数时候并没有在途请求，无条件打印会刷出大量无意义日志
+            if (count > 0) {
+                console.log(`🚫 已取消组件 [${componentId}] 的 ${count} 个在途请求`);
+            }
         }
     },
     
@@ -226,15 +232,17 @@ async function request(endpoint, options = {}) {
         }
     }
     
-    // 🚀 P3优化：离线模式支持
-    if (!isOnline && method === "GET") {
+    // 🚀 P3优化：离线模式支持（网络状态取自 状态管理.js 的 isOnline()）
+    if (!isOnline() && method === "GET") {
         const { value, expired, found } = getCacheWithMeta(cacheKey, true);  // 忽略过期
         if (found) {
             console.log(`📴 离线模式：返回${expired ? '过期' : ''}缓存 (${endpoint})`);
             const proxyFn2 = await getProxyImages();
             return proxyFn2(value);
         }
-        throw new Error('网络已断开，且无本地缓存');
+        // 🔧 修复：原为硬编码中文，而本错误会被 12+ 处调用方直接 showToast(err.message) 弹给用户，
+        // 导致英文界面下仍弹中文提示；现改走词典
+        throw new Error(t('feedback.offline_no_cache'));
     }
     
     // ⚡ P1性能优化：请求去重（相同GET请求只发一次）
@@ -253,9 +261,26 @@ async function request(endpoint, options = {}) {
         fetchOptions.body = options.body;
     }
 
-    // 🚀 P1优化：重试配置
-    const maxRetries = options.retries ?? (method === "GET" ? 2 : 0);  // GET 默认重试 2 次
-    const retryDelay = options.retryDelay ?? 1000;  // 初始延迟 1 秒
+    // 🚀 P1优化：重试与超时预算
+    // 🔧 修复：重试次数/间隔此前硬编码在本文件（2 / 1000），使 全局配置.js 的
+    // API.MAX_RETRIES、API.RETRY_DELAY 成为死配置，现统一读取配置中心
+    // 🐢 弱网预算分级：列表/搜索类 GET 有本地缓存兜底，失败上限适当收紧，
+    // 避免弱网下用户长时间盯骨架屏；按去掉查询串的路径全匹配，
+    // 不会误伤 /api/items/{id}、/api/creators/{account}/details 等详情请求
+    const endpointPath = endpoint.split("?")[0];
+    let defaultTimeout = API.TIMEOUT;
+    let defaultRetries = method === "GET" ? API.MAX_RETRIES : 0;  // 非 GET 不重试
+    if (method === "GET") {
+        if (endpointPath === "/api/creators/search") {
+            defaultTimeout = API.SEARCH_TIMEOUT;
+            defaultRetries = API.SEARCH_RETRIES;
+        } else if (endpointPath === "/api/items" || endpointPath === "/api/creators") {
+            defaultRetries = API.LIST_RETRIES;
+        }
+    }
+    const requestTimeout = options.timeout || defaultTimeout;
+    const maxRetries = options.retries ?? defaultRetries;
+    const retryDelay = options.retryDelay ?? API.RETRY_DELAY;  // 指数退避基数
     
     // ⚡ P1性能优化：封装请求 Promise（支持去重 + 重试）
     const requestPromise = (async () => {
@@ -271,12 +296,20 @@ async function request(endpoint, options = {}) {
                     
             // 🚀 P4优化：使用请求取消管理器（支持超时 + 组件级取消）
             const controller = requestCancelManager.create(componentId);
-            const timeoutId = setTimeout(() => controller.abort(), options.timeout || API.TIMEOUT);
             const currentFetchOptions = { ...fetchOptions, signal: controller.signal };
+            // 🔧 修复：超时计时器改到真正发出 fetch 时才启动。原实现在入队前就 setTimeout，
+            // 并发满 6 个时排队等待会白烧超时预算，排队时长超过超时值会导致 fetch 尚未发出就被 abort
+            let timeoutId = null;
+            // 🔍 区分「超时中止」与「调用方主动撤销」：两者抛出的都是 AbortError，
+            // 但前者应该重试、后者绝不能重试（详见下方 catch 的主动取消分支）
+            let timedOut = false;
                     
             try {
                 // 🚀 P3优化：使用请求队列限制并发
-                const response = await requestQueue.add(() => fetch(url, currentFetchOptions));
+                const response = await requestQueue.add(() => {
+                    timeoutId = setTimeout(() => { timedOut = true; controller.abort(); }, requestTimeout);
+                    return fetch(url, currentFetchOptions);
+                });
                 clearTimeout(timeoutId);  // 清除超时计时器
                 requestCancelManager.remove(componentId, controller);  // 🚀 P4: 移除已完成的 controller
                 let responseData = await response.json().catch(() => ({}));
@@ -336,6 +369,20 @@ async function request(endpoint, options = {}) {
                 return responseData;
             } catch (error) {
                 clearTimeout(timeoutId);  // 清除超时计时器
+                // 🔍 失败/超时同样摘除 controller：成功路径在上方已 remove，这里不补的话，
+                // 取消分组里会堆积已失效的 controller，使 cancelAll 的在途计数虚高
+                requestCancelManager.remove(componentId, controller);
+                
+                // 🔍 主动撤销（组件级取消）与超时都表现为 AbortError，但语义完全相反：
+                // 超时该重试；主动撤销是调用方明确表示「这次结果我不要了」，绝不能重试，
+                // 否则会白烧一轮超时预算（搜索场景下用户每敲一次键都可能触发一次撤销）。
+                // 直接抛出而不走循环后的「过期缓存兜底」，避免把作废请求的结果上屏
+                if (error.name === 'AbortError' && !timedOut) {
+                    const cancelErr = new Error(t('feedback.request_cancelled'));
+                    cancelErr.name = 'RequestCancelledError';
+                    cancelErr.isCancelled = true;
+                    throw cancelErr;
+                }
                 
                 // 🔧 P1优化：可重试的错误类型
                 const isRetryable = (
@@ -381,9 +428,12 @@ async function request(endpoint, options = {}) {
     }
     
     // 确保请求完成后清除去重记录
+    // 🔧 补 .catch 空处理：finally 会派生出一个新的 Promise，而它从未被返回也无人接收，
+    // 一旦请求失败（含主动撤销）就会在控制台抛 Uncaught (in promise)。
+    // 原始 requestPromise 仍在下方正常返回给调用方处理，此处只是吞掉这份重复的拒绝
     requestPromise.finally(() => {
         pendingRequests.delete(cacheKey);
-    });
+    }).catch(() => {});
     
     return requestPromise;
 }

前端页面/core/网络请求_缓存管理.js

@@ -120,8 +120,8 @@ export function getCache(key) {
             _updateLRU(fk);
             return cached.value;
         }
-        // 过期，清除
-        memoryCache.delete(fk);
+        // 过期，清除（走 _deleteMemoryEntry 同步摘除 LRU 顺序数组，避免幽灵键挤占名额）
+        _deleteMemoryEntry(fk);
     }
     
     // 降级到 localStorage
@@ -164,8 +164,8 @@ export function getCacheWithMeta(key, ignoreExpiry = false) {
             _updateLRU(fk);
             return { value: cached.value, expired, found: true };
         }
-        // 过期且不忽略，清除
-        memoryCache.delete(fk);
+        // 过期且不忽略，清除（同上：必须同步维护 memoryCacheOrder）
+        _deleteMemoryEntry(fk);
     }
     
     // 降级到 localStorage
@@ -192,17 +192,70 @@ export function getCacheWithMeta(key, ignoreExpiry = false) {
 }
 
 /**
- * 删除缓存
+ * 删除内存缓存条目（同步维护 LRU 顺序数组）
+ * 🔧 修复：原先各处只调 memoryCache.delete(fk)，残留在 memoryCacheOrder 里的幽灵键会
+ * 占用 MAX_MEMORY_ITEMS 名额，使 _enforceCacheLimit 淘汰到已不存在的键，内存缓存实际容量缩水
+ * @param {string} fk - 完整缓存键（已含前缀）
+ */
+function _deleteMemoryEntry(fk) {
+    memoryCache.delete(fk);
+    const idx = memoryCacheOrder.indexOf(fk);
+    if (idx > -1) memoryCacheOrder.splice(idx, 1);
+}
+
+/**
+ * 删除缓存（精确键，内存 + localStorage 两级）
  * @param {string} key - 缓存键
  */
 export function removeCache(key) {
     const fk = _fullKey(key);
-    memoryCache.delete(fk);
+    _deleteMemoryEntry(fk);
     try {
         localStorage.removeItem(fk);
     } catch {}
 }
 
+/**
+ * 🧹 按前缀删除缓存（内存 + localStorage 两级）
+ * removeCache 是精确键删除，而 API 层缓存键总是带查询串（形如
+ * api_/api/items?type=tool&sort=time&limit=200），调用方无法预知完整键，
+ * 用 removeCache('api_/api/items') 删除会全部落空（no-op），故提供前缀删除。
+ * 键空间兼容：本模块 setCache 写入的键带 CACHE.PREFIX；少数历史缓存
+ * （如 SWR 头像 ComfyCommunity_ProfileCache_*）是直接写 localStorage 的裸键，
+ * 两种都要匹配，避免无条件补前缀导致裸键类前缀永远命中不到。
+ * @param {string} prefix - 缓存键前缀
+ * @returns {number} 实际删除的缓存项数（两级按完整键去重）
+ */
+export function removeCacheByPrefix(prefix) {
+    if (!prefix) return 0;
+    const candidates = prefix.startsWith(CACHE_PREFIX) ? [prefix] : [_fullKey(prefix), prefix];
+    const isMatch = (key) => candidates.some(p => key.startsWith(p));
+    const removed = new Set();
+    
+    // 🔧 内存层必须先清：getCache / getCacheWithMeta 都优先读 memoryCache，
+    // 只清 localStorage 的话旧数据仍会命中内存并被直接返回（请求根本不会发出）
+    for (const fk of Array.from(memoryCache.keys())) {
+        if (isMatch(fk)) {
+            _deleteMemoryEntry(fk);
+            removed.add(fk);
+        }
+    }
+    
+    try {
+        const keysToRemove = [];
+        for (let i = 0; i < localStorage.length; i++) {
+            const k = localStorage.key(i);
+            if (k && isMatch(k)) keysToRemove.push(k);
+        }
+        keysToRemove.forEach(k => {
+            localStorage.removeItem(k);
+            removed.add(k);
+        });
+    } catch {}
+    
+    return removed.size;
+}
+
 /**
  * 清除所有缓存
  */
@@ -460,19 +513,17 @@ export function invalidateRelatedCache(endpoint, method = null) {
         patterns = ["ComfyRanking_ListCache_"];
     }
     
+    // 🔧 修复：原实现只遍历 localStorage，漏清 memoryCache —— 而 getCache/getCacheWithMeta
+    // 都优先读内存 Map，POST 成功后内存里的旧列表仍会命中并被直接返回（连请求都不发），
+    // 表现为「发布/点赞已成功但界面还是旧数据」，要等内存条目 TTL 到期才自愈。
+    // 🔧 同时修复：原实现无条件给 pattern 补 CACHE.PREFIX，使上方映射表中的裸键前缀
+    // （ComfyCommunity_ProfileCache_，SWR 头像缓存直接写 localStorage、不带前缀）被拼成
+    // ComfyRanking_ComfyCommunity_ProfileCache_，永远匹配不到，改头像/昵称后该缓存清不掉。
+    // 现统一走 removeCacheByPrefix：两级缓存一起清，且兼容带前缀与裸键两种键空间。
     let cleared = 0;
-    Object.keys(localStorage).forEach(key => {
-        for (const pattern of patterns) {
-            // 自动补上缓存前缀，确保能匹配到实际的 localStorage 键
-            // localStorage 中的 key 形如 "ComfyRanking_api_/api/tasks?..."
-            const prefixedPattern = pattern.startsWith(CACHE.PREFIX) ? pattern : CACHE.PREFIX + pattern;
-            if (key.startsWith(prefixedPattern)) {
-                localStorage.removeItem(key);
-                cleared++;
-                break;
-            }
-        }
-    });
+    for (const pattern of patterns) {
+        cleared += removeCacheByPrefix(pattern);
+    }
     
     if (cleared > 0) {
         console.log(`🗑️ 精确清除缓存: ${cleared} 个项 (${endpoint}${method ? ` ${method}` : ''})`);

前端页面/market/列表卡片组件.js

@@ -80,9 +80,11 @@ export function createItemCard(itemData, currentUser = null, contextType = null)
     const initialCommentCount = itemData.commentsData ? calcActiveComments(itemData.commentsData) : (itemData.comments || 0);
     
     // 🚀 检查插件安装状态（用于显示更新徽章）
+    // 徽章作为标题行的独立 flex 项（flex: none），不再追加在标题文本之后，
+    // 避免标题容器的 overflow: hidden + ellipsis 在长标题时把徽章一并裁掉
     const installStatus = checkItemStatus(itemData.id, itemData.latest_version);
     const updateBadgeHtml = installStatus.hasUpdate 
-        ? `<span style="margin-left: 6px; background: linear-gradient(135deg, #FF9800, #F44336); color: #fff; font-size: 10px; padding: 2px 6px; border-radius: 10px; font-weight: bold; animation: pulse 2s infinite;">🔄 ${t('market.update_available')}</span>` 
+        ? `<span style="flex: none; white-space: nowrap; background: linear-gradient(135deg, #FF9800, #F44336); color: #fff; font-size: 10px; padding: 2px 6px; border-radius: 10px; font-weight: bold; animation: pulse 2s infinite;">🔄 ${t('market.update_available')}</span>` 
         : '';
 
     const summaryView = document.createElement("div");
@@ -92,10 +94,11 @@ export function createItemCard(itemData, currentUser = null, contextType = null)
     // 🚀 核心修改：为评论计数的 span 加上专属的 class，并填入过滤后的真实数量
     // 🚀 布局重构：第1行标题+使用次数，第2行描述，第3行互动数据+发布者信息
     summaryView.innerHTML = `
-        <!-- 第1行: 标题 + 使用次数 -->
-        <div style="display: flex; align-items: center; margin-bottom: 4px;">
-            <div style="font-weight: bold; font-size: 14px; color: #4CAF50; flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${escapeHtml(itemData.title)}${updateBadgeHtml}</div>
-            <span style="margin-left: auto; font-size: 11px; color: #888; display: flex; align-items: center; gap: 6px;">
+        <!-- 第1行: 标题 + 更新徽章 + 使用次数 -->
+        <div style="display: flex; align-items: center; margin-bottom: 4px; gap: 6px;">
+            <div style="font-weight: bold; font-size: 14px; color: #4CAF50; flex: 0 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${escapeHtml(itemData.title)}</div>
+            ${updateBadgeHtml}
+            <span style="margin-left: auto; flex: none; font-size: 11px; color: #888; display: flex; align-items: center; gap: 6px;">
                 <span data-stat="uses" style="display: flex; align-items: center; gap: 2px;">📥 ${itemData.uses || 0}</span>
                 <span data-stat="views" style="display: flex; align-items: center; gap: 2px;">🔥 ${itemData.views || 0}</span>
             </span>

前端页面/market/创作者卡片组件.js

@@ -11,7 +11,7 @@
 import { openOtherUserProfileModal } from "../profile/个人中心视图.js";
 import { createCommentSection } from "../social/评论与互动组件.js";
 import { renderTipLevelHTML, getTipLevelRuleShort } from "../components/打赏等级工具.js";
-import { getBannerCacheKey, PLACEHOLDERS, getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
+import { getBannerCacheKey, PLACEHOLDERS, getCachedProfile, getProfileWithSWR, escapeHtml } from "../core/全局配置.js";
 import { api } from "../core/网络请求_业务API.js";
 import { getSettings } from "../components/全局设置组件.js";
 import { t } from "../components/用户体验增强.js";
@@ -51,7 +51,7 @@ let currentExpandedCard = null;
 async function handleTipCreator(creatorData, currentUser, onTipSuccess) {
     // 检查用户是否登录
     if (!currentUser) {
-        showToast(t('creator.tip_login_required') || "请先登录", "warning");
+        showToast(t('creator.tip_login_required'), "warning");
         return;
     }
     
@@ -92,7 +92,7 @@ function loadECharts() {
  * 渲染打赏榜单条目HTML（匿名/非匿名共用外层结构）
  */
 function _renderTipBoardEntry(entry, idx, rankIcon, levelHtml, userHtml, containerId = '') {
-    const idAttr = containerId ? ` id="${containerId}"` : '';
+    const idAttr = containerId ? ` id="${escapeHtml(containerId)}"` : '';
     return `<div${idAttr} style="display:flex;align-items:center;justify-content:space-between;padding:6px 8px;background:${idx % 2 === 0 ? '#222' : 'var(--comfy-menu-bg)'};border-radius:4px;margin-bottom:4px;">` +
         `<div style="display:flex;align-items:center;gap:8px;"><span style="font-size:14px;min-width:24px;">${rankIcon}</span>${userHtml}</div>` +
         `<div style="display:flex;align-items:center;gap:6px;">${levelHtml}<span style="color:#4CAF50;font-weight:bold;font-size:11px;">${entry.amount}</span></div></div>`;
@@ -125,7 +125,7 @@ export function createTipBoardSection(tipBoard = [], title = "🎁 赞赏贡献
         container.innerHTML = `
             <div style="display: flex; align-items: center; justify-content: space-between; margin-bottom: 8px;">
                 <div style="font-size: 12px; font-weight: bold; color: #FF9800; display: flex; align-items: center; gap: 6px;">
-                    ${title}
+                    ${escapeHtml(title)}
                     <span style="font-size: 10px; color: #888; font-weight: normal;">(${t('creator.tip_board.count', {count: 0})})</span>
                 </div>
                 ${creatorData ? `<button id="btn-tip-creator-empty" class="creator-tip-btn" style="${_TIP_BUTTON_STYLE}">${t('creator.tip_this_creator')}</button>` : ''}
@@ -188,14 +188,16 @@ export function createTipBoardSection(tipBoard = [], title = "🎁 赞赏贡献
             });
         }, 0);
         
-        const userHtml = `<span class="tip-board-user" data-account="${entry.account}" data-anon="false" style="display: flex; align-items: center; gap: 6px; color: #4CAF50; cursor: pointer; font-size: 13px;"><img class="tip-board-avatar" src="${avatarUrl}" style="width: 20px; height: 20px; border-radius: 50%; object-fit: cover; flex-shrink: 0; background: var(--comfy-input-bg);"><span class="tip-board-name">${userName}</span></span>`;
+        // 🔒 XSS防护：昵称/头像均来自用户可修改的资料，写入 HTML 前必须转义
+        // （下方 SWR 刷新路径用的是 .src / .textContent，本身就是安全的）
+        const userHtml = `<span class="tip-board-user" data-account="${escapeHtml(entry.account)}" data-anon="false" style="display: flex; align-items: center; gap: 6px; color: #4CAF50; cursor: pointer; font-size: 13px;"><img class="tip-board-avatar" src="${escapeHtml(avatarUrl)}" style="width: 20px; height: 20px; border-radius: 50%; object-fit: cover; flex-shrink: 0; background: var(--comfy-input-bg);"><span class="tip-board-name">${escapeHtml(userName)}</span></span>`;
         return _renderTipBoardEntry(entry, idx, rankIcon, levelHtml, userHtml, containerId);
     }).join("");
 
     container.innerHTML = `
         <div style="display: flex; align-items: center; justify-content: space-between; margin-bottom: 6px;">
             <div style="font-size: 12px; font-weight: bold; color: #FF9800; display: flex; align-items: center; gap: 6px;">
-                ${title}
+                ${escapeHtml(title)}
                 <span style="font-size: 10px; color: #888; font-weight: normal;">(${t('creator.tip_board.count', {count: tipBoard.length})})</span>
             </div>
             ${creatorData ? `<button id="btn-tip-creator" class="creator-tip-btn" style="${_TIP_BUTTON_STYLE}">${t('creator.tip_this_creator')}</button>` : ''}
@@ -264,11 +266,11 @@ export function createCreatorCard(creatorData, currentUser = null) {
             ${hasBanner ? '<div style="position: absolute; inset: 0; background: rgba(0,0,0,0.2); border-radius: 8px;"></div>' : ''}
             <div style="position: relative; z-index: 1;">
                 <div style="display: flex; align-items: center; gap: 15px; margin-bottom: 10px; padding: 5px 0;">
-                    <img class="creator-avatar-link" src="${avatarSrc}" title="${t('creator.visit_profile')}" style="width: 50px; height: 50px; border-radius: 50%; border: 2px solid ${hasBanner ? 'rgba(255,255,255,0.8)' : '#555'}; object-fit: cover; cursor: pointer; transition: 0.2s; ${hasBanner ? 'box-shadow: 0 2px 8px rgba(0,0,0,0.3);' : ''}" onmouseover="this.style.borderColor='#4CAF50'" onmouseout="this.style.borderColor='${hasBanner ? 'rgba(255,255,255,0.8)' : '#555'}'">
-                    <div class="creator-name-link" title="${t('creator.visit_profile')}" style="font-weight: bold; font-size: 16px; cursor: pointer; transition: 0.2s; color: #FFD700; text-shadow: 0 1px 4px rgba(0,0,0,0.8), 0 0 8px rgba(255,215,0,0.3);" onmouseover="this.style.color='#FFA500'" onmouseout="this.style.color='#FFD700'">${creatorData.name}</div>
+                    <img class="creator-avatar-link" src="${escapeHtml(avatarSrc)}" title="${t('creator.visit_profile')}" style="width: 50px; height: 50px; border-radius: 50%; border: 2px solid ${hasBanner ? 'rgba(255,255,255,0.8)' : '#555'}; object-fit: cover; cursor: pointer; transition: 0.2s; ${hasBanner ? 'box-shadow: 0 2px 8px rgba(0,0,0,0.3);' : ''}" onmouseover="this.style.borderColor='#4CAF50'" onmouseout="this.style.borderColor='${hasBanner ? 'rgba(255,255,255,0.8)' : '#555'}'">
+                    <div class="creator-name-link" title="${t('creator.visit_profile')}" style="font-weight: bold; font-size: 16px; cursor: pointer; transition: 0.2s; color: #FFD700; text-shadow: 0 1px 4px rgba(0,0,0,0.8), 0 0 8px rgba(255,215,0,0.3);" onmouseover="this.style.color='#FFA500'" onmouseout="this.style.color='#FFD700'">${escapeHtml(creatorData.name)}</div>
                     <div data-stat="downloads" style="font-size: 12px; color: #FF6B6B; margin-left: auto; text-shadow: 0 1px 3px rgba(0,0,0,0.6);">${t('creator.usage_count', {count: creatorData.downloads || 0})}</div>
                 </div>
-                <div style="font-size: 12px; color: ${hasBanner ? '#ccc' : '#aaa'}; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; margin-bottom: 10px;">${creatorData.shortDesc && creatorData.shortDesc !== "null" ? creatorData.shortDesc : t('profile.no_intro') || "这个人很懒，什么都没写..."}</div>
+                <div style="font-size: 12px; color: ${hasBanner ? '#ccc' : '#aaa'}; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; margin-bottom: 10px;">${escapeHtml(creatorData.shortDesc && creatorData.shortDesc !== "null" ? creatorData.shortDesc : t('profile.no_intro'))}</div>
                 <div style="background: rgba(34,34,34,${hasBanner ? '0.8' : '1'}); border-radius: 6px; padding: 8px 10px; border: 1px dashed #555;">
                     <div style="display: flex; gap: 15px; font-size: 12px; color: #eee; justify-content: space-between; margin-bottom: 8px;">
                         <span data-stat="likes" style="color: #FF5722;">👍 ${t('creator.stats.likes')}: <strong>${creatorData.likes}</strong></span>

前端页面/market/发布内容_UI模板.js

@@ -1,4 +1,5 @@
 // 前端页面/market/发布内容_UI模板.js
+import { escapeHtml } from "../core/全局配置.js";
 
 export function generatePublishHTML(isEditMode, viewTitle, submitBtnText, hasExistingToken, editItemData, t) {
     const safeData = editItemData || {};
@@ -10,7 +11,7 @@ export function generatePublishHTML(isEditMode, viewTitle, submitBtnText, hasExi
             <button id="btn-back" style="margin-left: 15px; margin-top: 15px; background: rgba(51,51,51,0.8); border: 1px solid rgba(85,85,85,0.8); color: #fff; padding: 6px 14px; border-radius: 6px; cursor: pointer; font-size: 13px; font-weight: bold; display: flex; align-items: center; gap: 6px; box-shadow: 0 2px 4px rgba(0,0,0,0.3); transition: 0.2s;" onmouseover="this.style.background='#4CAF50'; this.style.borderColor='#4CAF50'" onmouseout="this.style.background='rgba(51,51,51,0.8)'; this.style.borderColor='rgba(85,85,85,0.8)'">
                 ⬅ ${t('common.back')}
             </button>
-            <span style="font-size: 16px; font-weight: bold; color: #fff;">${viewTitle}</span>
+            <span style="font-size: 16px; font-weight: bold; color: #fff;">${escapeHtml(viewTitle)}</span>
         </div>
 
         <div style="display: flex; gap: 10px; margin-bottom: 5px;">
@@ -135,6 +136,6 @@ export function generatePublishHTML(isEditMode, viewTitle, submitBtnText, hasExi
             </div>
         </div>
 
-        <button id="btn-submit-publish" style="width: 100%; padding: 12px; background: #2196F3; color: white; border: none; border-radius: 4px; cursor: pointer; font-weight: bold; font-size: 15px; transition: 0.3s; margin-bottom: 20px;">${submitBtnText}</button>
+        <button id="btn-submit-publish" style="width: 100%; padding: 12px; background: #2196F3; color: white; border: none; border-radius: 4px; cursor: pointer; font-weight: bold; font-size: 15px; transition: 0.3s; margin-bottom: 20px;">${escapeHtml(submitBtnText)}</button>
     `;
 }

前端页面/market/发布内容_提交引擎.js

@@ -2,7 +2,7 @@
 import { api } from "../core/网络请求API.js";
 import { showToast } from "../components/UI交互提示组件.js";
 import { t } from "../components/用户体验增强.js";
-import { removeCache } from "../components/性能优化工具.js";
+import { removeCache, removeCacheByPrefix } from "../components/性能优化工具.js";
 import { TYPE_RULES } from "./发布内容组件.js";  // 📋 三榜发布表单声明式规则（与 UI 联动同源）
 
 /**
@@ -27,9 +27,12 @@ function clearItemCacheByType(type) {
     }
     
     // 清除 API 缓存
-    removeCache('api_/api/items');
-    removeCache(`api_/api/items?type=${type.replace('recommend_', '')}`);
-    removeCache('api_/api/creators');  // 创作者列表也需要刷新
+    // 🔧 修复：API 层缓存键总是带完整查询串（api_/api/items?type=tool&sort=time&limit=200），
+    // 而 removeCache 是精确键删除，原先这几个调用一个也命中不到（no-op），发布成功后
+    // request() 仍会从缓存直接返回旧列表、看不到刚发布的内容。改用前缀删除，
+    // 一次覆盖全部 type/sort/limit 组合（原先按 type 单独删的那行已被本前缀覆盖，属冗余）
+    removeCacheByPrefix('api_/api/items');
+    removeCacheByPrefix('api_/api/creators');  // 创作者列表也需要刷新
     
     // 清除侧边栏数据引擎缓存（只清除对应类型）
     const sorts = ['time', 'downloads', 'likes', 'favorites', 'tips', 'views', 'daily_views', 'rating'];

前端页面/market/发布内容组件.js

@@ -4,6 +4,7 @@ import { handlePublishSubmit } from "./发布内容_提交引擎.js";
 import { t } from "../components/用户体验增强.js";
 import { showConfirm, showToast } from "../components/UI交互提示组件.js";
 import { globalModal } from "../components/全局弹窗管理器.js";
+import { escapeHtml } from "../core/全局配置.js";
 
 // ==========================================
 // 📌 模块级常量
@@ -40,7 +41,7 @@ function _createImagePreviewWrapper(imgUrl, idx) {
     const wrapper = document.createElement('div');
     wrapper.style.cssText = 'position: relative; width: 80px; height: 80px;';
     wrapper.innerHTML = `
-        <img src="${imgUrl}" style="width: 80px; height: 80px; object-fit: cover; border-radius: 4px; border: 2px solid ${idx === 0 ? '#4CAF50' : '#444'};">
+        <img src="${escapeHtml(imgUrl)}" style="width: 80px; height: 80px; object-fit: cover; border-radius: 4px; border: 2px solid ${idx === 0 ? '#4CAF50' : '#444'};">
         ${idx === 0 ? `<span class="cover-label" style="${_COVER_LABEL_STYLE}">${t('post.cover')}</span>` : ''}
         <button data-action="remove" style="position: absolute; top: -6px; right: -6px; width: 18px; height: 18px; border-radius: 50%; background: #F44336; color: #fff; border: none; cursor: pointer; font-size: 12px; line-height: 1;">×</button>
     `;

前端页面/market/资源安装引擎.js

@@ -3,7 +3,8 @@ import { showToast, showConfirm, createInstallProgress } from "../components/UI
 import { api } from "../core/网络请求API.js";
 import { requestSSE, request } from "../core/网络请求_基础设施.js";
 import { openUserProfileModal } from "../profile/个人中心视图.js";
-import { API, CACHE, IS_WEB_MODE } from "../core/全局配置.js";
+import { API, CACHE, IS_WEB_MODE, escapeHtml } from "../core/全局配置.js";
+import { t } from "../components/用户体验增强.js";
 
 // 📱 Web 模式兼容：ComfyUI 的 app 对象仅存在于本地环境，改为受保护动态导入
 // （Web 模式不暴露安装/下载入口，不会走到此路径；万一走到也不抛错）
@@ -17,7 +18,7 @@ async function _loadGraphToCanvas(graphData) {
         return false;
     }
 }
-import { removeCache } from "../components/性能优化工具.js";
+import { removeCache, removeCacheByPrefix } from "../components/性能优化工具.js";
 
 // ==========================================
 // 📦 已获取资源记录管理
@@ -27,8 +28,10 @@ import { removeCache } from "../components/性能优化工具.js";
  * 🗑️ 清除使用量相关缓存
  */
 function clearUsesCache() {
-    removeCache('api_/api/items');
-    removeCache('api_/api/creators');
+    // 🔧 修复：API 层缓存键带完整查询串，removeCache 精确删除命中不到（no-op），
+    // 安装后使用量/下载数仍会从旧缓存返回，改用前缀删除
+    removeCacheByPrefix('api_/api/items');
+    removeCacheByPrefix('api_/api/creators');
     const tabs = ['tools', 'apps', 'recommends', 'creators'];
     const sorts = ['time', 'downloads', 'likes', 'favorites', 'tips', 'views', 'daily_views', 'rating'];
     for (const tab of tabs) {
@@ -199,7 +202,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
 
         // 📱 Web 模式：不支持下载/安装。免费（含作者本人）或已购买 → 仅提醒电脑端安装；未购买 → 放行到下方纯购买流程
         if (IS_WEB_MODE) {
-            if (isFree) return showToast("请在电脑端进行安装", "warning");
+            if (isFree) return showToast(t('web.install_on_desktop'), "warning");
             let webOwned = false;
             try {
                 const st = await api.getPurchaseStatus(currentUser.account, itemData.id);
@@ -207,7 +210,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
             } catch (e) {
                 console.warn('购买状态查询失败，继续购买流程', e);
             }
-            if (webOwned) return showToast("请在电脑端进行安装", "warning");
+            if (webOwned) return showToast(t('item.owned_purchased'), "warning");
         }
 
         // 记录是否已经拥有，决定是否涨销量
@@ -267,7 +270,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                 clearTimeout(valTimeout);
                 const valData = await valRes.json();
                 if (!valRes.ok || valData.error) {
-                    inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 拦截提示: ${valData.error || '无法访问源地址'}</span>`;
+                    inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 拦截提示: ${escapeHtml(valData.error || '无法访问源地址')}</span>`;
                     return; // 发现死链，强行阻断用户付款
                 }
             } catch(e) {
@@ -280,7 +283,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
 
             // 已购买用户跳过购买确认弹窗，直接进入后续流程
             if (!alreadyOwned) {
-                const confirmPay = await showConfirm(`该资源标价为 <strong style="color:#FF9800;">${itemData.price} 积分</strong>。<br><br>确认获取吗？<br><span style="font-size:12px;color:#aaa;">(注：一次购买永久免费，如果已购买过系统将直接放行，不会重复扣款)</span>`);
+                const confirmPay = await showConfirm(`该资源标价为 <strong style="color:#FF9800;">${itemData.price} 积分</strong>。<br><br>确认获取吗？<br><span style="font-size:12px;color:#aaa;">(注：一次购买永久免费，如果已购买过系统将直接放行，不会重复扣款)</span>`, { html: true });
                 if (!confirmPay) {
                     inlineStatusBox.style.display = "none";
                     return;
@@ -329,7 +332,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                 }
                 return; // 直接退出函数，不会走到下方的安装流程
             } else {
-                inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 获取失败: ${err.message}</span>`;
+                inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 获取失败: ${escapeHtml(err.message)}</span>`;
                 showToast("获取失败：" + err.message, "error");
                 return;
             }
@@ -339,9 +342,9 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
         if (IS_WEB_MODE) {
             inlineStatusBox.style.display = "block";
             inlineStatusBox.innerHTML = alreadyOwned
-                ? `<span style="color: #4CAF50;">✅ 您已购买过此资源，请在电脑端进行安装。</span>`
-                : `<span style="color: #4CAF50;">✅ 购买成功！请在电脑端进行安装。</span>`;
-            showToast("请在电脑端进行安装", "info");
+                ? `<span style="color: #4CAF50;">✅ ${escapeHtml(t('item.owned_purchased'))}</span>`
+                : `<span style="color: #4CAF50;">✅ ${escapeHtml(t('web.purchase_success_desktop'))}</span>`;
+            showToast(t('web.install_on_desktop'), "info");
             return;
         }
 
@@ -449,8 +452,16 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                         if (data.error) {
                             const isLinkError = data.error.includes('不是有效的 Git');
                             inlineStatusBox.innerHTML = isLinkError
-                                ? `<span style="color: #F44336;">❌ ${data.error}</span><br><button onclick="window.open('${itemData.link}', '_blank')" style="margin-top:8px;padding:6px 14px;background:#2563eb;color:white;border:none;border-radius:4px;cursor:pointer;font-weight:bold;">🔗 前往资源原始页面</button>`
-                                : `<span style="color: #F44336;">❌ 安装失败: ${data.error}</span>`;
+                                ? `<span style="color: #F44336;">❌ ${escapeHtml(data.error)}</span><br><button id="btn-open-source-link" style="margin-top:8px;padding:6px 14px;background:#2563eb;color:white;border:none;border-radius:4px;cursor:pointer;font-weight:bold;">🔗 前往资源原始页面</button>`
+                                : `<span style="color: #F44336;">❌ 安装失败: ${escapeHtml(data.error)}</span>`;
+                            // 🔒 XSS防护：链接改为 DOM 事件绑定（内联 onclick 里的引号即使转义，
+                            // 也会被浏览器先还原再交给 JS 解析，依然能被注入；本文件其他分支均用此写法）
+                            if (isLinkError) {
+                                const btnOpenSource = inlineStatusBox.querySelector('#btn-open-source-link');
+                                if (btnOpenSource) {
+                                    btnOpenSource.onclick = () => window.open(itemData.link, '_blank');
+                                }
+                            }
                             showToast(`插件 [${itemData.title}] 安装失败: ${data.error}`, "error");
                         } else {
                             // 根据后端返回的 message 判断是否为自更新场景
@@ -517,7 +528,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                     btnUse.style.background = "#4CAF50";
                 } else {
                     progress.error(result.message);
-                    inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 加载失败：${result.message}</span>`;
+                    inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 加载失败：${escapeHtml(result.message)}</span>`;
                     showToast(`工作流加载失败：${result.message}`, "error");
                 }
             } catch(err) {
@@ -533,7 +544,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                     });
                     if (!res.ok) {
                         const errText = await res.text().catch(() => '未知服务端错误');
-                        inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 加载失败 (${res.status})：${errText}</span>`;
+                        inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 加载失败 (${res.status})：${escapeHtml(errText)}</span>`;
                         return;
                     }
                     let data;
@@ -541,11 +552,11 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                         data = await res.json();
                     } catch (parseErr) {
                         inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 响应解析失败，请重试</span>`;
-                        showToast(t('common.parse_error') || '响应解析失败', "error");
+                        showToast(t('common.parse_error'), "error");
                         return;
                     }
                     if (data.error) {
-                        inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 加载失败：${data.error}</span>`;
+                        inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 加载失败：${escapeHtml(data.error)}</span>`;
                         showToast(`工作流加载失败：${data.error}`, "error");
                     } else {
                         await _loadGraphToCanvas(data.data);
@@ -567,7 +578,7 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                     }
                 } catch(err2) {
                     console.error('❌ 应用下载失败:', err2);
-                    inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 无法连接到本地服务：${err2.message || '网络错误'}</span>`;
+                    inlineStatusBox.innerHTML = `<span style="color: #F44336;">❌ 无法连接到本地服务：${escapeHtml(err2.message || '网络错误')}</span>`;
                 }
             }
         } else {

前端页面/market/资源详情页面组件.js

@@ -15,7 +15,7 @@ import { openTipModal } from "../profile/个人中心_赞赏组件.js";
 import { setupResourceInstall } from "./资源安装引擎.js";
 import { renderTipBoardHTML } from "../components/打赏等级工具.js";
 import { t } from "../components/用户体验增强.js";
-import { removeCache } from "../components/性能优化工具.js";
+import { removeCache, removeCacheByPrefix } from "../components/性能优化工具.js";
 import { invalidateRelatedCache } from "../core/网络请求API.js";
 import { showToast } from "../components/UI交互提示组件.js";
 // 🧹 P2归一：escapeHtml 局部副本已移除，改用统一版（转义更严格，防XSS语义不变）
@@ -101,7 +101,7 @@ function _showConfirmOverlay({ title, titleColor, infoHtml, warningHtml, warning
     overlay.innerHTML = `
         <div style="background: #1e2233; border-radius: 12px; padding: 25px; max-width: 420px; width: 90%; color: #fff; box-shadow: 0 8px 32px rgba(0,0,0,0.5);">
             <div style="font-size: 18px; font-weight: bold; margin-bottom: 20px; color: ${titleColor}; display: flex; align-items: center; gap: 10px;">
-                ⚠️ ${title}
+                ⚠️ ${escapeHtml(title)}
             </div>
 
             <div style="background: #2a2d3e; border-radius: 8px; padding: 15px; margin-bottom: 15px;">
@@ -119,7 +119,7 @@ function _showConfirmOverlay({ title, titleColor, infoHtml, warningHtml, warning
                     ${t('common.cancel')}
                 </button>
                 <button id="btn-confirm-action" style="background: ${confirmColor}; font-weight: bold; ${_btnBaseStyle}">
-                    ${confirmText}
+                    ${escapeHtml(confirmText)}
                 </button>
             </div>
         </div>
@@ -212,8 +212,10 @@ function burnLocalFiles(itemId) {
     removeCache(`ItemOwnership_${itemId}`);
     
     // 清除列表缓存（强制下次刷新）
-    removeCache('api_/api/items');
-    removeCache('api_/api/creators');
+    // 🔧 修复：API 层缓存键带完整查询串，removeCache 精确删除命中不到（no-op），
+    // 购买/下载后返回列表仍会看到旧数据，改用前缀删除
+    removeCacheByPrefix('api_/api/items');
+    removeCacheByPrefix('api_/api/creators');
     
     // 清除工具/应用/推荐列表缓存（使用标准 ListCache 格式）
     const tabs = ['tools', 'apps', 'recommends'];
@@ -328,7 +330,7 @@ export function createItemDetailView(itemData, currentUser) {
     let authorInfoHtml = `
         <div style="display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 10px;">
             <div>
-                <strong>${t('item.author')}：</strong> <span id="detail-author-name">${authorName}</span>
+                <strong>${t('item.author')}：</strong> <span id="detail-author-name">${escapeHtml(authorName)}</span>
                 <!-- 原创标识 -->
                 ${itemData.is_original ? `
                 <div style="display: inline-flex; align-items: center; gap: 6px; padding: 4px 12px; 

前端页面/market/资金与钱包_充值组件.js

@@ -149,7 +149,7 @@ export async function openRechargeModal(currentUser, onBalanceChange) {
                 return showToast(t('wallet.recharge.invalid_amount'), "warning");
             }
             if (customVal > 10000) {
-                return showToast(t('wallet.recharge.max_amount_exceeded') || "单次充值金额不得超过10000元", "warning");
+                return showToast(t('wallet.recharge.max_amount_exceeded'), "warning");
             }
             finalPoints = customVal;
             finalPrice = customVal;
@@ -167,7 +167,7 @@ export async function openRechargeModal(currentUser, onBalanceChange) {
         });
         if (!confirmed) return;
 
-        _setButtonLoading(btnCreateOrder, true, t('wallet.recharge.processing') || "处理中...", t('wallet.recharge.get_qr'));
+        _setButtonLoading(btnCreateOrder, true, t('wallet.recharge.processing'), t('wallet.recharge.get_qr'));
         qrContainer.style.display = "block";
         qrLoading.style.display = "block";
         qrImage.style.display = "none";
@@ -201,7 +201,7 @@ qrImage.src = `https://api.qrserver.com/v1/create-qr-code/?size=180x180&data=${e
                 if (pollCount >= MAX_POLL_COUNT) {
                     clearInterval(pollingInterval);
                     pollingInterval = null;
-                    showToast(t('wallet.recharge.timeout') || '支付查询超时，如已支付请稍后刷新查看余额', "warning");
+                    showToast(t('wallet.recharge.timeout'), "warning");
                     return;
                 }
                 try {
@@ -244,7 +244,7 @@ qrImage.src = `https://api.qrserver.com/v1/create-qr-code/?size=180x180&data=${e
             qrLoading.innerText = t('wallet.recharge.order_failed') + error.message;
             qrLoading.style.color = "#F44336";
         } finally {
-            _setButtonLoading(btnCreateOrder, false, t('wallet.recharge.processing') || "处理中...", t('wallet.recharge.get_qr'));
+            _setButtonLoading(btnCreateOrder, false, t('wallet.recharge.processing'), t('wallet.recharge.get_qr'));
         }
     };
 

前端页面/market/资金与钱包_提现组件.js

@@ -178,7 +178,7 @@ export async function openWithdrawModal(currentUser, onSuccess) {
         const timeoutId = setTimeout(() => {
             isSubmitting = false;
             _setButtonState(btnSubmit, false, "#4CAF50", t('wallet.withdraw.confirm'));
-            showToast(t('wallet.withdraw.timeout') || "提现请求超时，请检查网络后重试", "warning");
+            showToast(t('wallet.withdraw.timeout'), "warning");
         }, 30000);
 
         try {

前端页面/post/发布帖子组件.js

@@ -11,12 +11,14 @@
 import { api } from "../core/网络请求API.js";
 import { showToast, showConfirm } from "../components/UI交互提示组件.js";
 import { t } from "../components/用户体验增强.js";
-import { removeCache } from "../components/性能优化工具.js";
-import { API } from "../core/全局配置.js";
+import { removeCache, removeCacheByPrefix } from "../components/性能优化工具.js";
+import { API, escapeHtml } from "../core/全局配置.js";
 
 // 📦 清除帖子列表缓存
 function clearPostListCache() {
-    removeCache('api_/api/posts');
+    // 🔧 修复：API 层缓存键带完整查询串（api_/api/posts?sort=..&limit=..），
+    // removeCache 精确删除命中不到（no-op），发帖后讨论区仍会从旧缓存返回，改用前缀删除
+    removeCacheByPrefix('api_/api/posts');
     // 🔧 P1修复：讨论区组件实际使用 PostsCache_${sort} 键（非 ListCache_*），按真实键格式精准清除
     // 讨论区排序值：latest, likes, favorites, tips, views, daily_views, rating
     const sorts = ['latest', 'likes', 'favorites', 'tips', 'views', 'daily_views', 'rating'];
@@ -372,14 +374,14 @@ export function createPublishPostView(currentUser, editPostData = null) {
             <!-- 模式切换 -->
             <div style="margin-bottom: 15px;">
                 <label style="display: block; font-size: 13px; font-weight: bold; color: #fff; margin-bottom: 8px;">
-                    ${t('post.mode_label') || '发布模式'}
+                    ${t('post.mode_label')}
                 </label>
                 <div style="display: flex; gap: 0; background: #1a1a1a; border: 1px solid #444; border-radius: 6px; overflow: hidden;">
                     <button id="mode-image" style="flex: 1; padding: 10px; background: #4CAF50; color: #fff; border: none; cursor: pointer; font-size: 13px; font-weight: bold; transition: 0.2s;">
-                        📷 ${t('post.mode_image') || '图文'}
+                        📷 ${t('post.mode_image')}
                     </button>
                     <button id="mode-video" style="flex: 1; padding: 10px; background: transparent; color: #888; border: none; cursor: pointer; font-size: 13px; font-weight: bold; transition: 0.2s; border-left: 1px solid #444;">
-                        🎬 ${t('post.mode_video') || '视频'}
+                        🎬 ${t('post.mode_video')}
                     </button>
                 </div>
             </div>
@@ -402,14 +404,14 @@ export function createPublishPostView(currentUser, editPostData = null) {
             <!-- 视频上传区 -->
             <div id="video-upload-section" style="margin-bottom: 20px; display: none;">
                 <label style="display: block; font-size: 13px; font-weight: bold; color: #fff; margin-bottom: 8px;">
-                    🎬 ${t('post.upload_video') || '上传视频'} <span style="color: #F44336;">*</span>
+                    🎬 ${t('post.upload_video')} <span style="color: #F44336;">*</span>
                     <span style="font-weight: normal; color: #888; font-size: 12px;">（mp4/webm/mov，≤50MB，≤3分钟）</span>
                 </label>
                 <input type="file" id="video-input" accept="video/mp4,video/webm,video/quicktime" style="display: none;">
                 <div id="video-preview-area" style="padding: 15px; background: #1a1a1a; border: 2px dashed #444; border-radius: 8px; cursor: pointer; transition: 0.2s;">
                     <div id="video-empty-state" style="display: flex; flex-direction: column; align-items: center; justify-content: center; width: 100%; color: #666; font-size: 13px;">
                         <div style="font-size: 32px; margin-bottom: 8px;">🎬</div>
-                        ${t('post.click_upload_video') || '点击选择视频'}
+                        ${t('post.click_upload_video')}
                     </div>
                     <div id="video-player-wrap" style="display: none;">
                         <video id="video-player" controls style="width: 100%; max-height: 300px; border-radius: 8px; background: #000; display: block;"></video>
@@ -422,7 +424,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
                         </div>
                         <!-- 封面区域 -->
                         <div id="video-cover-wrap" style="display: none; margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--border-color, #333);">
-                            <div style="font-size: 12px; font-weight: bold; color: #fff; margin-bottom: 8px;">${t('post.video_cover') || '视频封面'}</div>
+                            <div style="font-size: 12px; font-weight: bold; color: #fff; margin-bottom: 8px;">${t('post.video_cover')}</div>
                             <div style="display: flex; align-items: center; gap: 12px;">
                                 <div style="position: relative; width: 80px; height: 80px; flex-shrink: 0;">
                                     <img id="cover-thumb" src="" style="width: 80px; height: 80px; object-fit: cover; border-radius: 6px; border: 2px solid #4CAF50; display: none;">
@@ -430,10 +432,10 @@ export function createPublishPostView(currentUser, editPostData = null) {
                                 </div>
                                 <div style="display: flex; flex-direction: column; gap: 6px;">
                                     <button id="btn-capture-frame" style="padding: 6px 12px; background: #333; border: 1px solid #555; color: #ccc; border-radius: 4px; cursor: pointer; font-size: 12px; transition: 0.2s;" onmouseover="this.style.background='#444'" onmouseout="this.style.background='#333'">
-                                        📸 ${t('post.capture_frame') || '截取当前帧'}
+                                        📸 ${t('post.capture_frame')}
                                     </button>
                                     <button id="btn-upload-cover" style="padding: 6px 12px; background: #333; border: 1px solid #555; color: #ccc; border-radius: 4px; cursor: pointer; font-size: 12px; transition: 0.2s;" onmouseover="this.style.background='#444'" onmouseout="this.style.background='#333'">
-                                        🖼️ ${t('post.upload_cover') || '手动上传封面'}
+                                        🖼️ ${t('post.upload_cover')}
                                     </button>
                                     <input type="file" id="cover-input" accept="image/*" style="display: none;">
                                 </div>
@@ -448,7 +450,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
                 <label style="display: block; font-size: 13px; font-weight: bold; color: #fff; margin-bottom: 8px;">
                     📝 ${t('post.title_label')} <span style="color: #F44336;">*</span>
                 </label>
-                <input type="text" id="title-input" value="${editTitle}" placeholder="${t('post.title_placeholder')}" maxlength="50" style="width: 100%; padding: 12px; background: #1a1a1a; border: 1px solid #444; border-radius: 6px; color: #fff; font-size: 14px; box-sizing: border-box; outline: none;" onfocus="this.style.borderColor='#4CAF50'" onblur="this.style.borderColor='#444'">
+                <input type="text" id="title-input" value="${escapeHtml(editTitle)}" placeholder="${t('post.title_placeholder')}" maxlength="50" style="width: 100%; padding: 12px; background: #1a1a1a; border: 1px solid #444; border-radius: 6px; color: #fff; font-size: 14px; box-sizing: border-box; outline: none;" onfocus="this.style.borderColor='#4CAF50'" onblur="this.style.borderColor='#444'">
                 <div style="text-align: right; font-size: 11px; color: #666; margin-top: 4px;">
                     <span id="title-count">${editTitle.length}</span>/50
                 </div>
@@ -459,7 +461,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
                 <label style="display: block; font-size: 13px; font-weight: bold; color: #fff; margin-bottom: 8px;">
                     ✍️ ${t('post.content_label')}
                 </label>
-                <textarea id="content-input" placeholder="${t('post.content_placeholder')}" maxlength="2000" style="width: 100%; height: 200px; padding: 12px; background: #1a1a1a; border: 1px solid #444; border-radius: 6px; color: #fff; font-size: 14px; box-sizing: border-box; outline: none; resize: none; line-height: 1.6;" onfocus="this.style.borderColor='#4CAF50'" onblur="this.style.borderColor='#444'">${editContent}</textarea>
+                <textarea id="content-input" placeholder="${t('post.content_placeholder')}" maxlength="2000" style="width: 100%; height: 200px; padding: 12px; background: #1a1a1a; border: 1px solid #444; border-radius: 6px; color: #fff; font-size: 14px; box-sizing: border-box; outline: none; resize: none; line-height: 1.6;" onfocus="this.style.borderColor='#4CAF50'" onblur="this.style.borderColor='#444'">${escapeHtml(editContent)}</textarea>
                 <div style="text-align: right; font-size: 11px; color: #666; margin-top: 4px;">
                     <span id="content-count">${editContent.length}</span>/2000
                 </div>
@@ -684,7 +686,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
             Object.assign(wrapper.style, PREVIEW_WRAPPER_STYLE);
             
             wrapper.innerHTML = `
-                <img src="${url}" style="width: 80px; height: 80px; object-fit: cover; border-radius: 6px; border: 2px solid ${idx === 0 ? '#4CAF50' : '#444'};">
+                <img src="${escapeHtml(url)}" style="width: 80px; height: 80px; object-fit: cover; border-radius: 6px; border: 2px solid ${idx === 0 ? '#4CAF50' : '#444'};">
                 ${idx === 0 ? `<span class="cover-label" style="position: absolute; top: 4px; left: 4px; background: #4CAF50; color: #fff; font-size: 10px; padding: 2px 6px; border-radius: 3px;">${t('post.cover')}</span>` : ''}
                 <button data-action="remove" data-existing-idx="${idx}" style="position: absolute; top: -6px; right: -6px; width: 20px; height: 20px; border-radius: 50%; background: #F44336; color: #fff; border: none; cursor: pointer; font-size: 12px; line-height: 1;">×</button>
             `;
@@ -792,14 +794,14 @@ export function createPublishPostView(currentUser, editPostData = null) {
         const validExts = ['.mp4', '.webm', '.mov'];
         const isValidType = validTypes.includes(file.type) || validExts.some(ext => file.name.toLowerCase().endsWith(ext));
         if (!isValidType) {
-            _showVideoErrorAndReset(t('post.error_video_format') || '仅支持 mp4、webm、mov 格式的视频', videoInput);
+            _showVideoErrorAndReset(t('post.error_video_format'), videoInput);
             return;
         }
         
         // 大小检查
         const MAX_SIZE = 100 * 1024 * 1024;
         if (file.size > MAX_SIZE) {
-            _showVideoErrorAndReset(t('post.error_video_size') || '视频大小不能超过 100MB', videoInput);
+            _showVideoErrorAndReset(t('post.error_video_size'), videoInput);
             return;
         }
         
@@ -812,7 +814,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
         tempVideo.onloadedmetadata = () => {
             URL.revokeObjectURL(tempUrl);
             if (tempVideo.duration > 180) {
-                _showVideoErrorAndReset(t('post.error_video_duration') || '视频时长不能超过 3 分钟', videoInput);
+                _showVideoErrorAndReset(t('post.error_video_duration'), videoInput);
                 return;
             }
             
@@ -826,7 +828,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
         
         tempVideo.onerror = () => {
             URL.revokeObjectURL(tempUrl);
-            _showVideoErrorAndReset(t('post.error_video_load') || '无法读取视频信息', videoInput);
+            _showVideoErrorAndReset(t('post.error_video_load'), videoInput);
         };
     };
     
@@ -854,7 +856,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
             videoNameEl.textContent = videoFile.name;
             videoMetaEl.textContent = `${formatFileSize(videoFile.size)} · ${Math.round(videoDuration)}秒`;
         } else if (currentVideoUrl) {
-            videoNameEl.textContent = t('post.existing_video') || '已有视频';
+            videoNameEl.textContent = t('post.existing_video');
             videoMetaEl.textContent = '';
         }
         
@@ -930,7 +932,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
     btnCaptureFrame.onclick = async (e) => {
         e.stopPropagation();
         if (!videoPlayer.videoWidth) {
-            showToast(t('post.error_video_not_ready') || '视频尚未加载完成', "warning");
+            showToast(t('post.error_video_not_ready'), "warning");
             return;
         }
         const cover = await generateCoverFromVideo(videoPlayer);
@@ -938,9 +940,9 @@ export function createPublishPostView(currentUser, editPostData = null) {
             videoCoverFile = cover;
             currentCoverUrl = '';
             renderCoverThumb();
-            showToast(t('post.cover_captured') || '封面已更新', "success");
+            showToast(t('post.cover_captured'), "success");
         } else {
-            showToast(t('post.cover_capture_failed') || '封面截取失败', "error");
+            showToast(t('post.cover_capture_failed'), "error");
         }
     };
     
@@ -954,7 +956,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
         const file = e.target.files?.[0];
         if (!file) return;
         if (!file.type.startsWith('image/')) {
-            _showVideoErrorAndReset(t('post.error_cover_format') || '请选择图片文件作为封面', coverInput);
+            _showVideoErrorAndReset(t('post.error_cover_format'), coverInput);
             return;
         }
         videoCoverFile = file;
@@ -984,15 +986,15 @@ export function createPublishPostView(currentUser, editPostData = null) {
                 return;
             }
             if (!content) {
-                showToast(t('post.error_no_content') || '请输入正文内容', "warning");
+                showToast(t('post.error_no_content'), "warning");
                 return;
             }
             if (!videoFile && !currentVideoUrl) {
-                showToast(t('post.error_no_video') || '请选择视频文件', "warning");
+                showToast(t('post.error_no_video'), "warning");
                 return;
             }
             if (!videoCoverFile && !currentCoverUrl) {
-                showToast(t('post.error_no_cover') || '请等待封面生成或手动上传封面', "warning");
+                showToast(t('post.error_no_cover'), "warning");
                 return;
             }
             
@@ -1002,7 +1004,7 @@ export function createPublishPostView(currentUser, editPostData = null) {
                 // 上传封面
                 let coverUrl = currentCoverUrl;
                 if (videoCoverFile) {
-                    submitBtn.textContent = `⏳ ${t('post.uploading_cover') || '上传封面中...'}`;
+                    submitBtn.textContent = `⏳ ${t('post.uploading_cover')}`;
                     const res = await api.uploadFile(videoCoverFile, "post");
                     coverUrl = res.url;
                 }
@@ -1010,9 +1012,9 @@ export function createPublishPostView(currentUser, editPostData = null) {
                 // 上传视频（带进度的 XMLHttpRequest）
                 let videoUrl = currentVideoUrl;
                 if (videoFile) {
-                    submitBtn.textContent = `⏳ ${t('post.uploading_video') || '上传视频中...'} 0%`;
+                    submitBtn.textContent = `⏳ ${t('post.uploading_video')} 0%`;
                     const res = await uploadVideoWithProgress(videoFile, (percent) => {
-                        submitBtn.textContent = `⏳ ${t('post.uploading_video') || '上传视频中...'} ${percent}%`;
+                        submitBtn.textContent = `⏳ ${t('post.uploading_video')} ${percent}%`;
                     });
                     videoUrl = res.url;
                 }

前端页面/post/帖子详情组件.js

@@ -31,11 +31,12 @@ import { createRatingStars } from "../social/评论与互动组件.js";
  */
 function _generateAvatarHtml(avatar, name, size, extraStyle = '') {
     const initial = (name || 'U')[0].toUpperCase();
+    // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
-        return `<img class="swr-avatar" src="${avatar}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
+        return `<img class="swr-avatar" src="${escapeHtml(avatar)}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
     }
     const fontSize = Math.max(9, Math.round(size * 0.4));
-    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${initial}</div>`;
+    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${escapeHtml(initial)}</div>`;
 }
 
 /**
@@ -50,7 +51,7 @@ function _updateAvatarElement(avatarEl, profile, size, extraStyle = '') {
     if (avatarEl.tagName === 'IMG') {
         avatarEl.src = profile.avatar;
     } else {
-        avatarEl.outerHTML = `<img class="swr-avatar" src="${profile.avatar}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
+        avatarEl.outerHTML = `<img class="swr-avatar" src="${escapeHtml(profile.avatar)}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
     }
 }
 
@@ -360,11 +361,9 @@ async function loadPostDetail(container, postId, currentUser) {
         loadComments(contentArea, postId, currentUser);
         
         if (fromCache) {
-            const toast = document.createElement('div');
-            toast.style.cssText = 'position:fixed; top:20px; left:50%; transform:translateX(-50%); background:#FF9800; color:white; padding:10px 20px; border-radius:4px; z-index:10000; font-size:14px;';
-            toast.textContent = '⚠️ 网络连接失败，展示的是缓存的数据';
-            document.body.appendChild(toast);
-            setTimeout(() => toast.remove(), 3000);
+            // 🔧 改用统一提示组件 + 词典：原为手写 div（无动画、不排队、不避重叠）且文案硬编码中文；
+            // 原文「展示的是缓存的数据」与已有词条 feedback.cache_fallback 语义一致，直接复用避免重复建键
+            showToast(t('feedback.cache_fallback'), 'warning');
         } else {
             // 👀 记录浏览量（fire-and-forget，不阻塞渲染）
             recordPostView(contentArea, postId);
@@ -470,7 +469,7 @@ async function showTipDialog(post, currentUser, container) {
             
             // 本地前置余额校验
             if ((currentUser.balance || 0) < amount) {
-                showToast(t('wallet.insufficient_balance') || "余额不足，请前往充值", "warning");
+                showToast(t('wallet.insufficient_balance'), "warning");
                 return;
             }
             

前端页面/post/讨论区组件.js

@@ -17,7 +17,7 @@
 import { api } from "../core/网络请求API.js";
 import { proxyImages } from "../core/网络请求API.js";
 import { showToast } from "../components/UI交互提示组件.js";
-import { setCache, getCacheWithMeta, createSkeleton, createPaginationLoader, lazyLoadImages } from "../components/性能优化工具.js";
+import { readListCache, writeListCache, createSkeleton, createPaginationLoader, lazyLoadImages } from "../components/性能优化工具.js";
 import { applyViewportAnimations } from "../components/动画音效引擎.js";
 import { t } from "../components/用户体验增强.js";
 import { getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
@@ -76,11 +76,12 @@ function _renderEmptyState(t) {
  */
 function _generateAvatarHtml(avatar, name, size) {
     const initial = (name || 'U')[0].toUpperCase();
+    // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
-        return `<img class="swr-avatar" src="${avatar}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; border: 1px solid #444; background: #333;">`;
+        return `<img class="swr-avatar" src="${escapeHtml(avatar)}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; border: 1px solid #444; background: #333;">`;
     }
     const fontSize = Math.max(9, Math.round(size * 0.5));
-    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${initial}</div>`;
+    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${escapeHtml(initial)}</div>`;
 }
 
 /**
@@ -312,8 +313,8 @@ export function createPostsView(currentUser, keyword = "") {
         
         // ✅ 优先从本地缓存读取（含过期缓存：离线容灾，与插件榜/工作流/推荐榜策略一致）
         if (!append && page === 1) {
-            const { value: cachedData, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
-            if (hasCacheData && cachedData && cachedData.length > 0) {
+            const cachedData = readListCache(cacheKey);
+            if (cachedData) {
                 // 🚀 缓存数据也需要过一遍图片代理，确保新字段也被处理
                 allPostsData = proxyImages(cachedData);
                 renderPostsFromCache(allPostsData);
@@ -337,7 +338,7 @@ export function createPostsView(currentUser, keyword = "") {
             // 缓存第一页数据
             if (page === 1) {
                 allPostsData = proxyImages(posts);
-                setCache(cacheKey, posts, getCacheTTL(), true);
+                writeListCache(cacheKey, posts, getCacheTTL());  // 存原始数据，离线时经图片代理后可展示
             } else {
                 allPostsData = [...allPostsData, ...proxyImages(posts)];
             }
@@ -388,8 +389,8 @@ export function createPostsView(currentUser, keyword = "") {
             isLoadingFromNetwork = false;
             // 网络失败时尝试从缓存读取（包括过期缓存，离线容灾）
             if (!append) {
-                const { value: cachedData, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
-                if (hasCacheData && cachedData && cachedData.length > 0) {
+                const cachedData = readListCache(cacheKey);
+                if (cachedData) {
                     // 🚀 缓存数据也需要过一遍图片代理
                     allPostsData = proxyImages(cachedData);
                     renderPostsFromCache(allPostsData);
@@ -457,7 +458,7 @@ export function createPostsView(currentUser, keyword = "") {
             
             // 更新缓存
             const cacheKey = getCacheKey();
-            setCache(cacheKey, posts, getCacheTTL(), true);
+            writeListCache(cacheKey, posts, getCacheTTL());
             
             // 对比新旧数据，有变化时重新渲染
             if (_postsDataChanged(allPostsData, posts)) {

前端页面/profile/个人中心_UI模板.js

@@ -54,8 +54,10 @@ export function buildProfileHTML(userData, isMe, isSettingsView, isFollowing, fo
         }
     }
     
+    // 🔒 XSS防护：他人查看时 bannerUrl 直接来自云端（用户可自行填写），
+    // 写入 CSS url() 前剔除引号与括号，避免突破属性（与创作者卡片、个人设置表单同一写法）
     const bannerStyle = bannerImageUrl 
-        ? `background-image: url(${bannerImageUrl}); background-size: cover; background-position: center;`
+        ? `background-image: url(${String(bannerImageUrl).replace(/['"()\\]/g, '')}); background-size: cover; background-position: center;`
         : `background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);`;
 
     // 设置视图时返回简化的返回按钮（与个人资料页按钮样式一致，但不显示背景图）
@@ -114,7 +116,7 @@ export function buildProfileHTML(userData, isMe, isSettingsView, isFollowing, fo
                 
                 <!-- 用户信息区域 -->
                 <div style="display: flex; align-items: flex-start; gap: 15px; position: relative;">
-                    <img src="${userData.avatarDataUrl || userData.avatar || PLACEHOLDERS.AVATAR}" style="width: 80px; height: 80px; border-radius: 50%; border: 3px solid #4CAF50; object-fit: cover; box-shadow: 0 4px 12px rgba(0,0,0,0.4);">
+                    <img src="${escapeHtml(userData.avatarDataUrl || userData.avatar || PLACEHOLDERS.AVATAR)}" style="width: 80px; height: 80px; border-radius: 50%; border: 3px solid #4CAF50; object-fit: cover; box-shadow: 0 4px 12px rgba(0,0,0,0.4);">
                     <div style="flex: 1; padding-right: 150px;">
                         <div style="font-size: 20px; font-weight: bold; margin-bottom: 4px; display: flex; align-items: center; gap: 8px; text-shadow: 0 2px 4px rgba(0,0,0,0.6);">
                             ${escapeHtml(userData.name)}

前端页面/profile/个人中心视图.js

@@ -159,7 +159,7 @@ export function showUserProfile(initialUserData, currentUser = null, isMe = true
         if (isMe) tabs.push({ id: "collected", label: t('profile.my_collected') });
         if (isMe || !privacy.likes) tabs.push({ id: "liked", label: t('profile.recent_likes') });
         if (isMe || !privacy.follows) tabs.push({ id: "following", label: t('profile.following') });
-        if (isMe || !privacy.followers) tabs.push({ id: "followers", label: t('profile.followers') || "粉丝" });
+        if (isMe || !privacy.followers) tabs.push({ id: "followers", label: t('profile.followers') });
 
         if (!tabs.find(t => t.id === activeTab)) activeTab = "published";
 

前端页面/profile/个人列表组件.js

@@ -1,7 +1,7 @@
 // 前端页面/profile/个人列表组件.js
 import { api } from "../core/网络请求API.js";
 import { createItemCard } from "../market/列表卡片组件.js";
-import { getAcquiredItems, checkItemStatus } from "../market/资源安装引擎.js";
+import { getAcquiredItems } from "../market/资源安装引擎.js";
 import { showToast } from "../components/UI交互提示组件.js";
 import { t, tIfExists, getLanguage } from "../components/用户体验增强.js";
 import { PLACEHOLDERS, getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
@@ -28,11 +28,13 @@ function renderUserCard(account, currentUser, openOtherUserModalCb) {
     const name = cached?.name || account;
     const intro = cached?.intro || '';
 
+    // 🔒 XSS防护：头像/昵称/简介均来自用户可修改的资料（下方 SWR 刷新路径用的是
+    // .src / .textContent，本身就是安全的，仅初次渲染的模板串需要转义）
     card.innerHTML = `
-        <img id="user-avatar-${account}" src="${avatar}" style="width: 48px; height: 48px; border-radius: 50%; object-fit: cover; border: 2px solid #4CAF50; flex-shrink: 0;">
+        <img id="user-avatar-${account}" src="${escapeHtml(avatar)}" style="width: 48px; height: 48px; border-radius: 50%; object-fit: cover; border: 2px solid #4CAF50; flex-shrink: 0;">
         <div style="flex: 1; min-width: 0;">
-            <div id="user-name-${account}" style="font-weight: bold; color: #4CAF50; font-size: 14px; margin-bottom: 4px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">@${name}</div>
-            <div id="user-intro-${account}" style="font-size: 12px; color: #888; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${intro || t('profile.no_intro') || '暂无简介'}</div>
+            <div id="user-name-${account}" style="font-weight: bold; color: #4CAF50; font-size: 14px; margin-bottom: 4px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">@${escapeHtml(name)}</div>
+            <div id="user-intro-${account}" style="font-size: 12px; color: #888; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${escapeHtml(intro || t('profile.no_intro'))}</div>
         </div>
         <button style="padding: 6px 12px; background: #2196F3; border: none; border-radius: 4px; color: white; cursor: pointer; font-size: 12px; flex-shrink: 0;">${t('profile.homepage')}</button>
     `;
@@ -50,7 +52,7 @@ function renderUserCard(account, currentUser, openOtherUserModalCb) {
             nameDiv.textContent = `@${profile.name}`;
         }
         if (introDiv && profile.intro !== undefined) {
-            introDiv.textContent = profile.intro || t('profile.no_intro') || '暂无简介';
+            introDiv.textContent = profile.intro || t('profile.no_intro');
         }
     });
 
@@ -87,7 +89,7 @@ function renderPaginatedUserList(userList, containerDiv, currentUser, openOtherU
     containerDiv.innerHTML = "";
     
     if (userList.length === 0) {
-        containerDiv.innerHTML = `<div style='text-align:center; padding: 20px; color:#666;'>${emptyMessage}</div>`;
+        containerDiv.innerHTML = `<div style='text-align:center; padding: 20px; color:#666;'>${escapeHtml(emptyMessage)}</div>`;
         return;
     }
 
@@ -110,7 +112,7 @@ function renderPaginatedUserList(userList, containerDiv, currentUser, openOtherU
         // 如果有更多，显示"加载更多"按钮
         if (displayedCount < userList.length) {
             const loadMoreBtn = document.createElement("button");
-            loadMoreBtn.textContent = t('profile.load_more') || `加载更多 (${userList.length - displayedCount})`;
+            loadMoreBtn.textContent = t('profile.load_more', { count: userList.length - displayedCount });
             loadMoreBtn.style.cssText = "width: 100%; padding: 12px; background: var(--comfy-input-bg); border: 1px solid #555; border-radius: 6px; color: #4CAF50; cursor: pointer; font-size: 13px; margin-top: 8px; transition: all 0.2s;";
             loadMoreBtn.onmouseover = () => { loadMoreBtn.style.background = "#3a3a3a"; };
             loadMoreBtn.onmouseout = () => { loadMoreBtn.style.background = "var(--comfy-input-bg)"; };
@@ -142,13 +144,13 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
 
     // 👥 关注列表（使用 SWR 缓存技术）
     if (tabId === "following") {
-        _renderUserListTab(userData.following || [], domElement, currentUser, openOtherUserModalCb, t('profile.no_following') || '还没有关注任何人');
+        _renderUserListTab(userData.following || [], domElement, currentUser, openOtherUserModalCb, t('profile.no_following'));
         return;
     }
 
     // 👥 粉丝列表（使用 SWR 缓存技术）
     if (tabId === "followers") {
-        _renderUserListTab(userData.followers || [], domElement, currentUser, openOtherUserModalCb, t('profile.no_followers') || '还没有粉丝');
+        _renderUserListTab(userData.followers || [], domElement, currentUser, openOtherUserModalCb, t('profile.no_followers'));
         return;
     }
 
@@ -331,12 +333,14 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
             containerDiv.style.cssText = "display: flex; flex-direction: column; gap: 15px;";
             
             // 💰 销售统计卡片（放在最上方，与打赏统计样式一致）
+            // 🔧 下方销售/打赏两处的 profile.transactions_unit 不再加 || '笔' 兜底：
+            // 该词条英文值刻意留空（中文 5笔 → 英文 5），兜底会把中文量词引回英文界面
             containerDiv.appendChild(_createStatsCard(
-                `💰 ${t('profile.sales_stats') || '销售统计'}`,
+                `💰 ${t('profile.sales_stats')}`,
                 [
-                    { value: `+${salesStats.total_sales || 0}`,    color: '#4CAF50', bgRgb: '76,175,80',  label: t('profile.sales_income') || '销售收入' },
-                    { value: `-${salesStats.total_purchase || 0}`,  color: '#F44336', bgRgb: '244,67,54', label: `${t('profile.purchase_expense') || '购买支出'} (${salesStats.purchase_count || 0}${t('profile.transactions_unit') || '笔'})` },
-                    { value: `${(salesStats.net_sales || 0) > 0 ? '+' : ''}${salesStats.net_sales || 0}`, color: '#2196F3', bgRgb: '33,150,243', label: t('profile.net_sales') || '净销售' }
+                    { value: `+${salesStats.total_sales || 0}`,    color: '#4CAF50', bgRgb: '76,175,80',  label: t('profile.sales_income') },
+                    { value: `-${salesStats.total_purchase || 0}`,  color: '#F44336', bgRgb: '244,67,54', label: `${t('profile.purchase_expense')} (${salesStats.purchase_count || 0}${t('profile.transactions_unit')})` },
+                    { value: `${(salesStats.net_sales || 0) > 0 ? '+' : ''}${salesStats.net_sales || 0}`, color: '#2196F3', bgRgb: '33,150,243', label: t('profile.net_sales') }
                 ],
                 ' margin-bottom: 15px;'
             ));
@@ -353,11 +357,11 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
 
             // 🎁 打赏统计卡片
             containerDiv.appendChild(_createStatsCard(
-                `🎁 ${t('profile.tip_stats') || '打赏统计'}`,
+                `🎁 ${t('profile.tip_stats')}`,
                 [
-                    { value: `+${tipStats.total_tip_in || 0}`,  color: '#4CAF50', bgRgb: '76,175,80',  label: `${t('profile.tip_received') || '收到打赏'} (${tipStats.tip_in_count || 0}${t('profile.transactions_unit') || '笔'})` },
-                    { value: `-${tipStats.total_tip_out || 0}`, color: '#F44336', bgRgb: '244,67,54', label: `${t('profile.tip_sent') || '打赏支出'} (${tipStats.tip_out_count || 0}${t('profile.transactions_unit') || '笔'})` },
-                    { value: `${(tipStats.net_tips || 0) > 0 ? '+' : ''}${tipStats.net_tips || 0}`, color: '#2196F3', bgRgb: '33,150,243', label: t('profile.net_tips') || '净打赏' }
+                    { value: `+${tipStats.total_tip_in || 0}`,  color: '#4CAF50', bgRgb: '76,175,80',  label: `${t('profile.tip_received')} (${tipStats.tip_in_count || 0}${t('profile.transactions_unit')})` },
+                    { value: `-${tipStats.total_tip_out || 0}`, color: '#F44336', bgRgb: '244,67,54', label: `${t('profile.tip_sent')} (${tipStats.tip_out_count || 0}${t('profile.transactions_unit')})` },
+                    { value: `${(tipStats.net_tips || 0) > 0 ? '+' : ''}${tipStats.net_tips || 0}`, color: '#2196F3', bgRgb: '33,150,243', label: t('profile.net_tips') }
                 ],
                 ' margin-bottom: 15px;'
             ));
@@ -464,7 +468,7 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
         const applyDOM = (items, posts, prompts) => {
             domElement.innerHTML = "";
             if ((!items || items.length === 0) && (!posts || posts.length === 0) && (!prompts || prompts.length === 0)) {
-                domElement.innerHTML = _renderEmptyState('🔖', t('profile.no_collected') || '还没有收藏任何内容', t('profile.go_discover') || '去榜单页面或讨论区发现精彩内容吧！');
+                domElement.innerHTML = _renderEmptyState('🔖', t('profile.no_collected'), t('profile.go_discover'));
                 return;
             }
             const listDiv = document.createElement("div");
@@ -473,7 +477,7 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
             if (items && items.length > 0) {
                 const sectionTitle = document.createElement("div");
                 sectionTitle.style.cssText = "font-size: 13px; font-weight: bold; color: #FF9800; margin-bottom: 5px; padding: 5px 0;";
-                sectionTitle.textContent = `📦 ${t('profile.collected_items') || '收藏的资源'} (${items.length})`;
+                sectionTitle.textContent = `📦 ${t('profile.collected_items')} (${items.length})`;
                 listDiv.appendChild(sectionTitle);
                 items.forEach(item => { listDiv.appendChild(createItemCard(item, currentUser)); });
             }
@@ -481,7 +485,7 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
             if (posts && posts.length > 0) {
                 const sectionTitle = document.createElement("div");
                 sectionTitle.style.cssText = "font-size: 13px; font-weight: bold; color: #9C27B0; margin-bottom: 5px; padding: 5px 0;" + (items && items.length > 0 ? " margin-top: 15px;" : "");
-                sectionTitle.textContent = `💬 ${t('profile.collected_posts') || '收藏的帖子'} (${posts.length})`;
+                sectionTitle.textContent = `💬 ${t('profile.collected_posts')} (${posts.length})`;
                 listDiv.appendChild(sectionTitle);
                 posts.forEach(post => { listDiv.appendChild(createPostItem(post, currentUser)); });
             }
@@ -489,7 +493,7 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
             if (prompts && prompts.length > 0) {
                 const sectionTitle = document.createElement("div");
                 sectionTitle.style.cssText = "font-size: 13px; font-weight: bold; color: #00BCD4; margin-bottom: 5px; padding: 5px 0;" + ((items && items.length > 0) || (posts && posts.length > 0) ? " margin-top: 15px;" : "");
-                sectionTitle.textContent = `🧩 ${t('profile.collected_prompts') || '收藏的提示词'} (${prompts.length})`;
+                sectionTitle.textContent = `🧩 ${t('profile.collected_prompts')} (${prompts.length})`;
                 listDiv.appendChild(sectionTitle);
                 prompts.forEach(prompt => { listDiv.appendChild(createPromptItem(prompt, currentUser)); });
             }
@@ -528,7 +532,7 @@ export async function renderProfileListContent(tabId, domElement, userData, curr
             }
         } catch (error) {
             console.error("加载收藏失败:", error);
-            if (!cachedStr) domElement.innerHTML = `<div style='text-align:center; padding: 20px; color:#F44336;'>${t('profile.load_collected_failed') || '收藏加载失败'}</div>`;
+            if (!cachedStr) domElement.innerHTML = `<div style='text-align:center; padding: 20px; color:#F44336;'>${t('profile.load_collected_failed')}</div>`;
         }
         return;
     }
@@ -702,7 +706,7 @@ function createPostItem(post, currentUser) {
         <div style="display: flex; align-items: flex-start; gap: 10px;">
             ${coverImageUrl ? `
                 <div style="position: relative; flex-shrink: 0;">
-                    <img src="${coverImageUrl}" style="width: 60px; height: 60px; object-fit: cover; border-radius: 6px; display: block;">
+                    <img src="${escapeHtml(coverImageUrl)}" style="width: 60px; height: 60px; object-fit: cover; border-radius: 6px; display: block;">
                     ${isVideo ? `
                     <div style="position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%);
                                 width: 28px; height: 28px; background: rgba(0,0,0,0.6); border-radius: 50%;
@@ -721,7 +725,7 @@ function createPostItem(post, currentUser) {
                 <div style="display: flex; align-items: center; gap: 12px; font-size: 11px; color: #888;">
                     <span>❤️ ${post.like_count || 0}</span>
                     <span>💬 ${post.comment_count || 0}</span>
-                    ${isVideo ? `<span>🎬 ${t('post.video_tag') || '视频'}</span>` : ((post.images || []).length > 1 ? `<span>🖼️ ${(post.images || []).length}张</span>` : "")}
+                    ${isVideo ? `<span>🎬 ${t('post.video_tag')}</span>` : ((post.images || []).length > 1 ? `<span>🖼️ ${(post.images || []).length}${t('post.images_unit')}</span>` : "")}
                     <span style="margin-left: auto;">${timeStr}</span>
                 </div>
             </div>
@@ -770,13 +774,13 @@ function createPromptItem(prompt, currentUser) {
     // 价格徽标
     const priceBadge = (prompt.price > 0)
         ? `<span style="background: rgba(255,193,7,0.15); color: #FFC107; padding: 1px 6px; border-radius: 4px; font-size: 10px;">💎 ${prompt.price}</span>`
-        : `<span style="background: rgba(76,175,80,0.15); color: #4CAF50; padding: 1px 6px; border-radius: 4px; font-size: 10px;">${t('prompt.free') || '免费'}</span>`;
+        : `<span style="background: rgba(76,175,80,0.15); color: #4CAF50; padding: 1px 6px; border-radius: 4px; font-size: 10px;">${t('prompt.free')}</span>`;
 
     promptDiv.innerHTML = `
         <div style="display: flex; align-items: flex-start; gap: 10px;">
             ${coverImageUrl ? `
                 <div style="position: relative; flex-shrink: 0;">
-                    <img src="${coverImageUrl}" style="width: 60px; height: 60px; object-fit: cover; border-radius: 6px; display: block;">
+                    <img src="${escapeHtml(coverImageUrl)}" style="width: 60px; height: 60px; object-fit: cover; border-radius: 6px; display: block;">
                     ${isVideo ? `
                     <div style="position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%);
                                 width: 28px; height: 28px; background: rgba(0,0,0,0.6); border-radius: 50%;
@@ -865,9 +869,9 @@ function createTransactionCard(tx) {
             }
             // 状态标签
             if (tx.withdraw_status === 'pending') {
-                detailLine = `⏳ ${t('tx.withdraw_pending') || '待打款'}`;
+                detailLine = `⏳ ${t('tx.withdraw_pending')}`;
             } else if (tx.withdraw_status === 'completed') {
-                detailLine = `✅ ${t('tx.withdraw_completed') || '已完成'}`;
+                detailLine = `✅ ${t('tx.withdraw_completed')}`;
             }
             break;
             
@@ -927,7 +931,7 @@ function createTransactionCard(tx) {
             
         case 'RECHARGE':
             // 充值
-            description = t('tx.recharge_desc') || '支付宝充值';
+            description = t('tx.recharge_desc');
             break;
             
         case 'REFUND':
@@ -937,7 +941,7 @@ function createTransactionCard(tx) {
             
         case 'WITHDRAW_FEE':
             // 提现手续费
-            description = t('tx.withdraw_fee_desc') || '提现手续费';
+            description = t('tx.withdraw_fee_desc');
             break;
             
         default:
@@ -959,7 +963,7 @@ function createTransactionCard(tx) {
     
     // 实到金额（仅提现类型）
     const netAmountHtml = (tx.tx_type === 'WITHDRAW' && tx.net_amount !== null && tx.net_amount !== undefined)
-        ? `<div style="font-size: 11px; color: #888; text-align: right;">${t('tx.net_amount') || '实到'}: ${tx.net_amount}</div>`
+        ? `<div style="font-size: 11px; color: #888; text-align: right;">${t('tx.net_amount')}: ${tx.net_amount}</div>`
         : '';
     
     if (hasDetailedInfo) {
@@ -973,7 +977,7 @@ function createTransactionCard(tx) {
                         ${itemTitle}
                     </div>
                     ${description ? `<div style="font-size: 11px; color: #aaa; margin-top: 3px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${escapeHtml(description)}</div>` : ''}
-                    ${detailText ? `<div style="font-size: 11px; color: #888; margin-top: 3px;">${detailText}</div>` : ''}
+                    ${detailText ? `<div style="font-size: 11px; color: #888; margin-top: 3px;">${escapeHtml(detailText)}</div>` : ''}
                 </div>
             </div>
             <div style="text-align: right; flex-shrink: 0; margin-left: 10px;">
@@ -990,7 +994,7 @@ function createTransactionCard(tx) {
                 <span style="font-size: 20px;">${typeConfig.icon}</span>
                 <div>
                     <div style="font-weight: bold; color: #eee; font-size: 13px;">${typeConfig.title}</div>
-                    <div style="font-size: 11px; color: #888;">${timeStr}${tx.related_account ? ' · ' + tx.related_account.substring(0, 8) + '...' : ''}</div>
+                    <div style="font-size: 11px; color: #888;">${timeStr}${tx.related_account ? ' · ' + escapeHtml(tx.related_account.substring(0, 8)) + '...' : ''}</div>
                 </div>
             </div>
             <div style="font-weight: bold; font-size: 15px; color: ${amountColor};">
@@ -1007,20 +1011,20 @@ function createTransactionCard(tx) {
  */
 function getTransactionTypeConfig(txType) {
     const configs = {
-        'WITHDRAW': { icon: '💸', title: t('tx.withdraw') || '提现申请' },
-        'TIP_IN': { icon: '🎁', title: t('tx.tip_in') || '收到打赏' },
-        'TIP_OUT': { icon: '🎁', title: t('tx.tip_out') || '打赏支出' },
-        'PURCHASE': { icon: '🛒', title: t('tx.purchase') || '购买资源' },
-        'TASK_DEPOSIT': { icon: '📋', title: t('tx.task_deposit') || '任务订金' },
-        'TASK_PAYMENT': { icon: '📋', title: t('tx.task_payment') || '任务尾款' },
-        'TASK_INCOME': { icon: '📋', title: t('tx.task_income') || '任务收入' },
-        'TASK_FREEZE': { icon: '🔒', title: t('tx.task_freeze') || '任务冻结' },
-        'TASK_REFUND': { icon: '↩️', title: t('tx.task_refund') || '任务退款' },
-        'TASK_CANCEL_REFUND': { icon: '🔄', title: t('tx.task_cancel_refund') || '任务取消退款' },
-        'SALE': { icon: '💎', title: t('tx.sale') || '销售收入', color: '#28a745' },
-        'RECHARGE': { icon: '💰', title: t('tx.recharge') || '充值' },
-        'REFUND': { icon: '↩️', title: t('tx.refund') || '退款' },
-        'WITHDRAW_FEE': { icon: '💸', title: t('tx.withdraw_fee') || '手续费' }
+        'WITHDRAW': { icon: '💸', title: t('tx.withdraw') },
+        'TIP_IN': { icon: '🎁', title: t('tx.tip_in') },
+        'TIP_OUT': { icon: '🎁', title: t('tx.tip_out') },
+        'PURCHASE': { icon: '🛒', title: t('tx.purchase') },
+        'TASK_DEPOSIT': { icon: '📋', title: t('tx.task_deposit') },
+        'TASK_PAYMENT': { icon: '📋', title: t('tx.task_payment') },
+        'TASK_INCOME': { icon: '📋', title: t('tx.task_income') },
+        'TASK_FREEZE': { icon: '🔒', title: t('tx.task_freeze') },
+        'TASK_REFUND': { icon: '↩️', title: t('tx.task_refund') },
+        'TASK_CANCEL_REFUND': { icon: '🔄', title: t('tx.task_cancel_refund') },
+        'SALE': { icon: '💎', title: t('tx.sale'), color: '#28a745' },
+        'RECHARGE': { icon: '💰', title: t('tx.recharge') },
+        'REFUND': { icon: '↩️', title: t('tx.refund') },
+        'WITHDRAW_FEE': { icon: '💸', title: t('tx.withdraw_fee') }
     };
     
     return configs[txType] || { icon: '💰', title: txType };

前端页面/profile/个人设置表单组件.js

@@ -4,7 +4,7 @@ import { regionData, getSortedCountries } from "../auth/国家地区数据.js";
 import { showToast } from "../components/UI交互提示组件.js";
 import { uploadFile } from "../market/发布内容_提交引擎.js";
 import { openImageCropper } from "../components/图片裁剪组件.js";
-import { CACHE, getBackgroundKey, getBannerCacheKey, PLACEHOLDERS } from "../core/全局配置.js";
+import { CACHE, getBackgroundKey, getBannerCacheKey, PLACEHOLDERS, escapeHtml } from "../core/全局配置.js";
 import { t } from "../components/用户体验增强.js";
 
 // 计算年龄工具函数
@@ -90,7 +90,7 @@ export function createSettingsForm(initialUserData, onCancelCallback, onSaveSucc
         <div style="margin-bottom: 15px; padding-bottom: 10px; border-bottom: 1px solid #444; font-weight: bold; font-size: 16px;">⚙️ ${t('settings_form.title')}</div>
         <div style="display: flex; flex-direction: column; gap: 10px; margin-bottom: 20px;">
             <div style="display: flex; align-items: center; gap: 15px; margin-bottom: 5px; background: var(--comfy-input-bg); padding: 10px; border-radius: 6px; border: 1px dashed #555;">
-                <img id="setting-avatar-preview" src="${userData.avatarDataUrl || PLACEHOLDERS.AVATAR}" style="width: 60px; height: 60px; border-radius: 50%; object-fit: cover; border: 2px solid #666;">
+                <img id="setting-avatar-preview" src="${escapeHtml(userData.avatarDataUrl || PLACEHOLDERS.AVATAR)}" style="width: 60px; height: 60px; border-radius: 50%; object-fit: cover; border: 2px solid #666;">
                 <div>
                     <button id="btn-trigger-avatar" style="padding: 6px 12px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; cursor: pointer; font-size: 12px; margin-bottom: 5px;">${t('settings_form.change_avatar')}</button>
                     <div style="font-size: 11px; color: #888;">${t('settings_form.avatar_hint')}</div>
@@ -100,7 +100,7 @@ export function createSettingsForm(initialUserData, onCancelCallback, onSaveSucc
 
             <div style="background: var(--comfy-input-bg); padding: 10px; border-radius: 6px; border: 1px dashed #555;">
                 <div style="font-size: 12px; color: #aaa; margin-bottom: 8px;">🇺️ ${t('settings_form.banner_title')}</div>
-                <div id="setting-banner-preview" style="width: 100%; height: 80px; border-radius: 4px; background: ${userData.bannerUrl ? `url(${userData.bannerUrl})` : '#1a1a1a'}; background-size: cover; background-position: center; margin-bottom: 8px; border: 1px solid #444;"></div>
+                <div id="setting-banner-preview" style="width: 100%; height: 80px; border-radius: 4px; background: ${userData.bannerUrl ? `url(${String(userData.bannerUrl).replace(/['"()\\]/g, '')})` : '#1a1a1a'}; background-size: cover; background-position: center; margin-bottom: 8px; border: 1px solid #444;"></div>
                 <div style="display: flex; gap: 8px;">
                     <button id="btn-trigger-banner" style="flex: 1; padding: 6px 12px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; cursor: pointer; font-size: 12px;">📷 ${t('settings_form.banner_upload')}</button>
                     <button id="btn-clear-banner" style="padding: 6px 12px; background: transparent; border: 1px solid #555; color: #888; border-radius: 4px; cursor: pointer; font-size: 12px;">🗑️ ${t('settings_form.banner_clear')}</button>
@@ -120,7 +120,7 @@ export function createSettingsForm(initialUserData, onCancelCallback, onSaveSucc
                 <input type="file" id="setting-ui-bg" accept="image/*" style="display: none;">
             </div>
 
-            <div><label style="display: block; margin-bottom: 5px; font-size: 12px; color: #aaa;">${t('settings_form.display_name')}</label><input type="text" id="setting-name" value="${userData.name || ''}" style="width: 100%; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; box-sizing: border-box;"></div>
+            <div><label style="display: block; margin-bottom: 5px; font-size: 12px; color: #aaa;">${t('settings_form.display_name')}</label><input type="text" id="setting-name" value="${escapeHtml(userData.name || '')}" style="width: 100%; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; box-sizing: border-box;"></div>
             
             <div style="display: flex; gap: 10px;">
                 <div style="flex: 1;"><label style="display: block; margin-bottom: 5px; font-size: 12px; color: #aaa;">${t('settings_form.gender')}</label>
@@ -133,7 +133,7 @@ export function createSettingsForm(initialUserData, onCancelCallback, onSaveSucc
                 <div style="flex: 1;">
                     <label style="display: block; margin-bottom: 5px; font-size: 12px; color: #aaa;">${t('settings_form.birthday')}</label>
                     <div style="display: flex; align-items: center; gap: 8px;">
-                        <input type="date" id="setting-birthday" value="${userData.birthday || ''}" style="flex: 1; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; box-sizing: border-box;">
+                        <input type="date" id="setting-birthday" value="${escapeHtml(userData.birthday || '')}" style="flex: 1; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; box-sizing: border-box;">
                         <span id="setting-age-display" style="color: #888; font-size: 12px; white-space: nowrap;">${userData.age ? userData.age + ' ' + t('profile.age_years') : ''}</span>
                     </div>
                 </div>
@@ -145,11 +145,11 @@ export function createSettingsForm(initialUserData, onCancelCallback, onSaveSucc
                     ${countryOptions}
                 </select>
                 <select id="setting-region" style="width: 100%; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px;">
-                    <option value="${userData.region || ''}">${userData.region || t('settings_form.select_country_first')}</option>
+                    <option value="${escapeHtml(userData.region || '')}">${escapeHtml(userData.region || t('settings_form.select_country_first'))}</option>
                 </select>
             </div>
 
-            <div><label style="display: block; margin-bottom: 5px; font-size: 12px; color: #aaa;">${t('settings_form.intro')}</label><textarea id="setting-intro" rows="3" placeholder="${t('settings_form.intro_placeholder')}" style="width: 100%; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; box-sizing: border-box; resize: vertical;">${userData.intro || ''}</textarea></div>
+            <div><label style="display: block; margin-bottom: 5px; font-size: 12px; color: #aaa;">${t('settings_form.intro')}</label><textarea id="setting-intro" rows="3" placeholder="${t('settings_form.intro_placeholder')}" style="width: 100%; padding: 8px; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; border-radius: 4px; box-sizing: border-box; resize: vertical;">${escapeHtml(userData.intro || '')}</textarea></div>
             
             <div style="margin-top: 15px; border-top: 1px solid #444; padding-top: 15px;">
                 <div style="font-size: 14px; font-weight: bold; margin-bottom: 10px; color: #4CAF50;">🛡️ ${t('settings_form.privacy_title')}</div>

前端页面/prompt/发布提示词组件.js

@@ -13,21 +13,19 @@
 import { api } from "../core/网络请求API.js";
 import { showToast, showConfirm } from "../components/UI交互提示组件.js";
 import { t, tIfExists } from "../components/用户体验增强.js";
-import { removeCache } from "../components/性能优化工具.js";
+import { removeCacheByPrefix } from "../components/性能优化工具.js";
 import { API } from "../core/全局配置.js";
 import { escapeHtml } from "../components/互动工具函数.js";  // 🧹 P2归一：局部副本已移除
 
 // 📦 清除提示词列表缓存（前缀扫描，覆盖全部 类型/分类/排序 组合）
 function clearPromptsListCache() {
-    try {
-        const keysToRemove = [];
-        for (let i = 0; i < localStorage.length; i++) {
-            const k = localStorage.key(i);
-            if (k && k.includes('PromptsCache')) keysToRemove.push(k);
-        }
-        keysToRemove.forEach(k => localStorage.removeItem(k));
-    } catch (e) {}
-    removeCache('api_/api/prompts');
+    // 🔧 改用缓存模块的前缀删除原语：原先手写的 localStorage 扫描 + removeCache 组合
+    // 与 removeCacheByPrefix 等价（同样内存 + localStorage 两级清除，且同样能匹配不带
+    // CACHE.PREFIX 的裸键），统一收口避免各发布组件各写一遍易漏清内存的遍历
+    removeCacheByPrefix('PromptsCache');
+    // 🔧 修复：API 层缓存键带完整查询串（api_/api/prompts?type=..&category=..&sort=..），
+    // 原先的 removeCache 精确删除命中不到（no-op），改用前缀删除
+    removeCacheByPrefix('api_/api/prompts');
     console.log('🗑️ 已清除提示词列表缓存');
 }
 

前端页面/prompt/提示词组件.js

@@ -16,7 +16,9 @@
 
 import { api, proxyImages } from "../core/网络请求API.js";
 import { showToast } from "../components/UI交互提示组件.js";
-import { setCache, getCacheWithMeta, createPaginationLoader, lazyLoadImages } from "../components/性能优化工具.js";
+// 📦 列表缓存走 readListCache/writeListCache 统一口径；分类缓存形态不同（空数组也是
+// 有效缓存态），仍用底层 setCache/getCacheWithMeta
+import { setCache, getCacheWithMeta, readListCache, writeListCache, createPaginationLoader, lazyLoadImages } from "../components/性能优化工具.js";
 import { applyViewportAnimations } from "../components/动画音效引擎.js";
 import { t, tIfExists } from "../components/用户体验增强.js";
 import { getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
@@ -92,11 +94,12 @@ function _renderEmptyState() {
  */
 function _generateAvatarHtml(avatar, name, size) {
     const initial = (name || 'U')[0].toUpperCase();
+    // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
-        return `<img class="swr-avatar" src="${avatar}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; border: 1px solid #444; background: #333;">`;
+        return `<img class="swr-avatar" src="${escapeHtml(avatar)}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; border: 1px solid #444; background: #333;">`;
     }
     const fontSize = Math.max(9, Math.round(size * 0.5));
-    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${initial}</div>`;
+    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${escapeHtml(initial)}</div>`;
 }
 
 /**
@@ -437,8 +440,8 @@ export function createPromptsView(currentUser, keyword = "") {
 
         // ✅ 优先从本地缓存读取（含过期缓存：离线容灾，与插件榜/工作流/推荐榜策略一致）
         if (!append && page === 1) {
-            const { value: cachedData, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
-            if (hasCacheData && cachedData && cachedData.length > 0) {
+            const cachedData = readListCache(cacheKey);
+            if (cachedData) {
                 allPromptsData = proxyImages(cachedData);
                 renderPromptsFromCache(allPromptsData);
                 // 后台静默更新
@@ -461,7 +464,7 @@ export function createPromptsView(currentUser, keyword = "") {
             // 缓存第一页数据
             if (page === 1) {
                 allPromptsData = proxyImages(prompts);
-                setCache(cacheKey, prompts, getCacheTTL(), true);
+                writeListCache(cacheKey, prompts, getCacheTTL());  // 存原始数据，离线时经图片代理后可展示
             } else {
                 allPromptsData = [...allPromptsData, ...proxyImages(prompts)];
             }
@@ -512,8 +515,8 @@ export function createPromptsView(currentUser, keyword = "") {
             isLoadingFromNetwork = false;
             // 网络失败时尝试从缓存读取（包括过期缓存，离线容灾）
             if (!append) {
-                const { value: cachedData, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
-                if (hasCacheData && cachedData && cachedData.length > 0) {
+                const cachedData = readListCache(cacheKey);
+                if (cachedData) {
                     allPromptsData = proxyImages(cachedData);
                     renderPromptsFromCache(allPromptsData);
                     showToast(t('prompt.network_cache'), "warning");
@@ -580,7 +583,7 @@ export function createPromptsView(currentUser, keyword = "") {
 
             // 更新缓存
             const cacheKey = getCacheKey();
-            setCache(cacheKey, prompts, getCacheTTL(), true);
+            writeListCache(cacheKey, prompts, getCacheTTL());
 
             // 对比新旧数据，有变化时重新渲染
             if (_promptsDataChanged(allPromptsData, prompts)) {

前端页面/prompt/提示词详情组件.js

@@ -27,11 +27,12 @@ import { recordView, handleToggleLike, handleToggleFavorite, renderTipBoardHTML
  */
 function _generateAvatarHtml(avatar, name, size, extraStyle = '') {
     const initial = (name || 'U')[0].toUpperCase();
+    // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
-        return `<img class="swr-avatar" src="${avatar}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
+        return `<img class="swr-avatar" src="${escapeHtml(avatar)}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
     }
     const fontSize = Math.max(9, Math.round(size * 0.4));
-    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${initial}</div>`;
+    return `<div class="swr-avatar" style="width: ${size}px; height: ${size}px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: ${fontSize}px; font-weight: bold;">${escapeHtml(initial)}</div>`;
 }
 
 /**
@@ -42,7 +43,7 @@ function _updateAvatarElement(avatarEl, profile, size, extraStyle = '') {
     if (avatarEl.tagName === 'IMG') {
         avatarEl.src = profile.avatar;
     } else {
-        avatarEl.outerHTML = `<img class="swr-avatar" src="${profile.avatar}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
+        avatarEl.outerHTML = `<img class="swr-avatar" src="${escapeHtml(profile.avatar)}" style="width: ${size}px; height: ${size}px; border-radius: 50%; object-fit: cover; ${extraStyle}">`;
     }
 }
 
@@ -464,7 +465,7 @@ async function showPurchaseConfirmDialog(contentArea, prompt, currentUser) {
         <div style="text-align: center;">
             <div style="font-size: 36px; margin-bottom: 12px;">💎</div>
             <div style="font-size: 15px; font-weight: bold; color: #fff; margin-bottom: 10px;">${t('prompt.purchase_confirm_title')}</div>
-            <div style="font-size: 13px; color: #aaa; margin-bottom: 15px; line-height: 1.6;">${t('prompt.purchase_confirm_desc', { price: prompt.price, title: prompt.title })}</div>
+            <div style="font-size: 13px; color: #aaa; margin-bottom: 15px; line-height: 1.6;">${t('prompt.purchase_confirm_desc', { price: prompt.price, title: escapeHtml(prompt.title) })}</div>
             <div style="margin-bottom: 15px; background: rgba(255,152,0,0.1); padding: 10px; border-radius: 4px; border: 1px solid #FF9800;">
                 ${t('prompt.purchase_balance')}: <strong style="color:#FF9800;">${balance}</strong>
             </div>
@@ -593,7 +594,7 @@ async function showTipDialog(prompt, currentUser, container) {
 
             // 本地前置余额校验
             if ((currentUser.balance || 0) < amount) {
-                showToast(t('wallet.insufficient_balance') || "余额不足，请前往充值", "warning");
+                showToast(t('wallet.insufficient_balance'), "warning");
                 return;
             }
 
@@ -686,7 +687,7 @@ async function loadComments(container, promptId, currentUser) {
         }
         try {
             sendBtn.disabled = true;
-            sendBtn.textContent = t('common.sending') || '...';
+            sendBtn.textContent = t('common.sending');
             await api.addPromptComment(promptId, content);
             commentInput.value = "";
             showToast(t('prompt.comment_success'), "success");

前端页面/social/私信聊天组件.js

@@ -26,12 +26,14 @@ const formatRelativeTime = (timestamp) => {
     const minutes = Math.floor(diff / 60000);
     const hours = Math.floor(diff / 3600000);
     const days = Math.floor(diff / 86400000);
-    if (minutes < 1) return t('chat.time_just_now') || '刚刚';
-    if (minutes < 60) return `${minutes}${t('chat.time_min_ago') || '分钟前'}`;
-    if (hours < 24) return `${hours}${t('chat.time_hour_ago') || '小时前'}`;
-    if (days < 7) return `${days}${t('chat.time_day_ago') || '天前'}`;
+    if (minutes < 1) return t('chat.time_just_now');
+    if (minutes < 60) return `${minutes}${t('chat.time_min_ago')}`;
+    if (hours < 24) return `${hours}${t('chat.time_hour_ago')}`;
+    if (days < 7) return `${days}${t('chat.time_day_ago')}`;
     const date = new Date(msgTime);
-    return `${date.getMonth() + 1}${t('chat.date_month') || '月'}${date.getDate()}${t('chat.date_day') || '日'} ${String(date.getHours()).padStart(2,'0')}:${String(date.getMinutes()).padStart(2,'0')}`;
+    // 🔧 去掉 || '月' / || '日' 兜底：这两个词条的英文值是刻意留空的（中文 9月8日 → 英文 9/8），
+    // 加了兜底反而会把中文量词引回英文界面（同文件下方的 chat.chatting_suffix 同理）
+    return `${date.getMonth() + 1}${t('chat.date_month')}${date.getDate()}${t('chat.date_day')} ${String(date.getHours()).padStart(2,'0')}:${String(date.getMinutes()).padStart(2,'0')}`;
 };
 // 🚀 P1-5: 超过5分钟则显示时间分隔符
 const TIME_GAP_THRESHOLD = 5 * 60; // 秒
@@ -109,7 +111,7 @@ export function openChatModal(currentUser, targetAccount = null) {
         resize: "none", maxHeight: "100px", minHeight: "40px", overflow: "auto",
         lineHeight: "1.4", boxSizing: "border-box"
     });
-    inputField.placeholder = t('chat.input_placeholder') || '输入消息...';
+    inputField.placeholder = t('chat.input_placeholder');
     // 🚀 P1-2: 自适应高度
     const adjustHeight = () => {
         inputField.style.height = "auto";
@@ -194,7 +196,7 @@ export function openChatModal(currentUser, targetAccount = null) {
             }
             
             chatItem.innerHTML = `
-                <img src="${avatar}" style="width: 40px; height: 40px; border-radius: 50%; object-fit: cover; border: 1px solid #555; flex-shrink: 0;">
+                <img src="${escapeHtml(avatar)}" style="width: 40px; height: 40px; border-radius: 50%; object-fit: cover; border: 1px solid #555; flex-shrink: 0;">
                 <div style="flex: 1; min-width: 0;">
                     <div style="display: flex; justify-content: space-between; align-items: center;">
                         <div style="font-weight: bold; font-size: 13px; color: #fff;">${escapeHtml(name)}</div>
@@ -233,7 +235,7 @@ export function openChatModal(currentUser, targetAccount = null) {
         } catch(e) {
             // 🚀 P1-7: loadChatList 错误处理
             console.error('[私信] 加载对话列表失败:', e);
-            showToast(t('chat.load_list_failed') || '加载对话列表失败', 'error');
+            showToast(t('chat.load_list_failed'), 'error');
         }
     };
 
@@ -254,7 +256,7 @@ export function openChatModal(currentUser, targetAccount = null) {
                 textAlign: "center", padding: "10px", cursor: "pointer",
                 color: "#888", fontSize: "12px", transition: "0.2s"
             });
-            loadMoreBtn.textContent = t('chat.load_more') || `加载更早的消息（剩余${startIdx}条）`;
+            loadMoreBtn.textContent = t('chat.load_more');
             loadMoreBtn.onmouseover = () => { loadMoreBtn.style.color = "#2196F3"; };
             loadMoreBtn.onmouseout = () => { loadMoreBtn.style.color = "#888"; };
             loadMoreBtn.onclick = () => {
@@ -378,9 +380,9 @@ export function openChatModal(currentUser, targetAccount = null) {
         localStorage.setItem(getLastChatKey(currentUser.account), JSON.stringify(currentTargetInfo));
 
         chatHeader.innerHTML = `
-            <img id="chat-target-avatar" src="${avatar}" style="width: 36px; height: 36px; border-radius: 50%; object-fit: cover; border: 1px solid #555; cursor: pointer; margin-right: 10px; transition: 0.2s;" title="${t('chat.view_profile') || '点击查看个人资料'}">
+            <img id="chat-target-avatar" src="${escapeHtml(avatar)}" style="width: 36px; height: 36px; border-radius: 50%; object-fit: cover; border: 1px solid #555; cursor: pointer; margin-right: 10px; transition: 0.2s;" title="${t('chat.view_profile')}">
             <div style="flex: 1;">
-                <div style="font-weight: bold; font-size: 14px; color: #fff;">${t('chat.chatting_with') || '与'} ${escapeHtml(displayName)} ${t('chat.chatting_suffix') || '聊天'}</div>
+                <div style="font-weight: bold; font-size: 14px; color: #fff;">${t('chat.chatting_with')} ${escapeHtml(displayName)} ${t('chat.chatting_suffix')}</div>
                 <div style="font-size: 11px; color: #888;">@${escapeHtml(targetAccount)}</div>
             </div>
         `;
@@ -442,11 +444,11 @@ export function openChatModal(currentUser, targetAccount = null) {
         } catch(e) {
             // 🚀 P1-7: loadChatHistory 错误处理
             console.error('[私信] 加载消息失败:', e);
-            showToast(t('chat.load_history_failed') || '加载消息记录失败', 'error');
+            showToast(t('chat.load_history_failed'), 'error');
             messagesArea.innerHTML = `<div style="text-align:center; padding:40px; color:#888;">
-                <div style="margin-bottom:10px;">${t('chat.load_failed_hint') || '消息加载失败'}</div>
+                <div style="margin-bottom:10px;">${t('chat.load_failed_hint')}</div>
                 <button id="btn-retry-chat" style="padding:6px 16px; border-radius:4px; border:1px solid #555; background:var(--comfy-input-bg); color:#fff; cursor:pointer;">
-                    ${t('chat.retry') || '重试'}
+                    ${t('chat.retry')}
                 </button>
             </div>`;
             const retryBtn = messagesArea.querySelector('#btn-retry-chat');
@@ -455,11 +457,11 @@ export function openChatModal(currentUser, targetAccount = null) {
 
         // 🚀 绑定顶部清空消息按钮事件
         clearBtnTop.onclick = async () => {
-            if (await showConfirm(t('chat.confirm_clear') || '确定要清空与该用户的本地聊天记录吗？')) {
+            if (await showConfirm(t('chat.confirm_clear'))) {
                 localStorage.setItem(clearKey, Date.now().toString());
                 localStorage.setItem(cacheKey, "[]");
                 renderMsgs([], avatar);
-                showToast(t('chat.cleared') || '消息已清空', "success");
+                showToast(t('chat.cleared'), "success");
             }
         };
     }
@@ -469,7 +471,7 @@ export function openChatModal(currentUser, targetAccount = null) {
         const txt = inputField.value.trim();
         if (!txt) return;
         if (txt.length > MAX_MSG_LENGTH) {
-            showToast(t('chat.msg_too_long') || `消息不能超过${MAX_MSG_LENGTH}字`, "warning");
+            showToast(t('chat.msg_too_long'), "warning");
             return;
         }
         if (!currentChatTarget) return;
@@ -481,8 +483,8 @@ export function openChatModal(currentUser, targetAccount = null) {
             clearDraft(); // 🚀 P1-4: 发送成功后清除草稿
             loadChatHistory(currentChatTarget, currentTargetInfo?.name, currentTargetInfo?.avatar); 
             loadChatList(); 
-        } catch(e) { showToast(t('chat.send_failed') || `发送失败: ${e.message}`, "error"); }
-        sendBtn.disabled = false; sendBtn.innerText = t('common.send') || "发送";
+        } catch(e) { showToast(t('chat.send_failed', { msg: e.message }), "error"); }
+        sendBtn.disabled = false; sendBtn.innerText = t('common.send');
     };
     
     // 🚀 P1-2: Enter 发送，Shift+Enter 换行

前端页面/social/评论与互动组件.js

@@ -108,7 +108,7 @@ export function createCommentSection(itemId, commentsData, currentUser, onCountC
             const avatarSrc = avatar || DEFAULT_AVATAR_SVG;
 
             itemDiv.innerHTML = `
-                <img class="swr-avatar" src="${avatarSrc}" style="width: ${avatarSize}; height: ${avatarSize}; border-radius: 50%; object-fit: cover; background: var(--comfy-input-bg);">
+                <img class="swr-avatar" src="${escapeHtml(avatarSrc)}" style="width: ${avatarSize}; height: ${avatarSize}; border-radius: 50%; object-fit: cover; background: var(--comfy-input-bg);">
                 <div style="flex: 1;">
                     <div style="display: flex; justify-content: space-between; margin-bottom: 2px;">
                         <span class="swr-name" style="color: #aaa; font-weight: bold; font-size: 11px;">${escapeHtml(comment.authorName || comment.author)}</span>
@@ -144,7 +144,7 @@ export function createCommentSection(itemId, commentsData, currentUser, onCountC
             if (canDelete) {
                 itemDiv.querySelector(".delete-btn").onclick = async () => {
                     const confirmed = await showConfirm(t('social.delete_comment_confirm'), {
-                        title: t('social.delete_comment_title') || t('common.confirm'),
+                        title: t('social.delete_comment_title'),
                         confirmText: t('common.confirm'),
                         cancelText: t('common.cancel'),
                         type: 'danger'
@@ -156,7 +156,7 @@ export function createCommentSection(itemId, commentsData, currentUser, onCountC
                         comment.isDeleted = true;
                         renderList(); 
                         triggerCountUpdate();
-                    } catch(e) { showToast(t('feedback.delete_failed') + t('feedback.retry_suffix', '，请重试'), "error"); }
+                    } catch(e) { showToast(t('feedback.delete_failed') + t('feedback.retry_suffix'), "error"); }
                 };
             }
         }

前端页面/social/通知中心组件.js

@@ -155,15 +155,17 @@ export async function openNotificationCenter(currentUser, bellBtn) {
             } else if (isAnonymous) {
                 nameLabel = `<strong style="color: #fff;">${escapeHtml(msg.from_name || msg.from_user)}</strong>`;
             } else {
-                nameLabel = `<span class="notif-user-link" data-account="${msg.from_user}" 
+                // 🔒 XSS防护：from_user 是他人账号，写入 HTML 属性前必须转义
+                // （dataset.account 经浏览器解码后仍是原始值，下方跳转行为不变）
+                nameLabel = `<span class="notif-user-link" data-account="${escapeHtml(msg.from_user)}" 
                     style="color:#4FC3F7; cursor:pointer; text-decoration:underline dotted; font-weight:bold;">
                     ${escapeHtml(msg.from_name || msg.from_user)}
                 </span>`;
             }
             
             html += `
-                <div class="notif-item" data-account="${msg.from_user}" data-type="${msg.type}" data-item-id="${msg.target_item_id || ''}" style="padding: 12px; border-radius: 8px; background: ${bg}; border: ${border}; display: flex; gap: 12px; align-items: flex-start; cursor: pointer; transition: 0.2s;" onmouseover="this.style.transform='scale(1.01)'" onmouseout="this.style.transform='scale(1)'">
-                    <img src="${msg.from_avatar || PLACEHOLDERS.AVATAR}" style="width: 40px; height: 40px; border-radius: 50%; object-fit: cover; flex-shrink: 0; border: 1px solid #555;">
+                <div class="notif-item" data-account="${escapeHtml(msg.from_user)}" data-type="${escapeHtml(msg.type)}" data-item-id="${escapeHtml(msg.target_item_id || '')}" style="padding: 12px; border-radius: 8px; background: ${bg}; border: ${border}; display: flex; gap: 12px; align-items: flex-start; cursor: pointer; transition: 0.2s;" onmouseover="this.style.transform='scale(1.01)'" onmouseout="this.style.transform='scale(1)'">
+                    <img src="${escapeHtml(msg.from_avatar || PLACEHOLDERS.AVATAR)}" style="width: 40px; height: 40px; border-radius: 50%; object-fit: cover; flex-shrink: 0; border: 1px solid #555;">
                     <div style="flex: 1; min-width: 0;">
                         <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px;">
                             ${nameLabel}

前端页面/task/任务榜组件.js

@@ -18,7 +18,7 @@
 import { api } from "../core/网络请求API.js";
 import { proxyImages } from "../core/网络请求API.js";
 import { showToast } from "../components/UI交互提示组件.js";
-import { setCache, getCacheWithMeta, createSkeleton, createPaginationLoader, lazyLoadImages } from "../components/性能优化工具.js";
+import { readListCache, writeListCache, createSkeleton, createPaginationLoader, lazyLoadImages } from "../components/性能优化工具.js";
 import { applyViewportAnimations } from "../components/动画音效引擎.js";
 import { t } from "../components/用户体验增强.js";
 import { getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
@@ -221,8 +221,8 @@ export function createTasksView(currentUser, keyword = "") {
         
         // ✅ 优先从本地缓存读取（含过期缓存：离线容灾，与插件榜/工作流/推荐榜策略一致）
         if (!append && page === 1) {
-            const { value: cachedData, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
-            if (hasCacheData && cachedData && cachedData.length > 0) {
+            const cachedData = readListCache(cacheKey);
+            if (cachedData) {
                 // 🚀 缓存数据也需要过一遍图片代理，确保新字段也被处理
                 allTasksData = proxyImages(cachedData);
                 renderTasksFromCache(allTasksData);
@@ -247,7 +247,7 @@ export function createTasksView(currentUser, keyword = "") {
             // 缓存第一页数据
             if (page === 1) {
                 allTasksData = tasks;
-                setCache(cacheKey, tasks, getCacheTTL(), true);  // 持久化到localStorage
+                writeListCache(cacheKey, tasks, getCacheTTL());  // 持久化到 localStorage，供离线容灾
             } else {
                 allTasksData = [...allTasksData, ...tasks];
             }
@@ -293,8 +293,8 @@ export function createTasksView(currentUser, keyword = "") {
             isLoadingFromNetwork = false;
             // 网络失败时尝试从缓存读取（包括过期缓存，离线容灾）
             if (!append) {
-                const { value: cachedData, found: hasCacheData } = getCacheWithMeta(cacheKey, true);
-                if (hasCacheData && cachedData && cachedData.length > 0) {
+                const cachedData = readListCache(cacheKey);
+                if (cachedData) {
                     // 🚀 缓存数据也需要过一遍图片代理
                     allTasksData = proxyImages(cachedData);
                     renderTasksFromCache(allTasksData);
@@ -359,7 +359,7 @@ export function createTasksView(currentUser, keyword = "") {
             
             // 更新缓存
             const cacheKey = getCacheKey();
-            setCache(cacheKey, tasks, getCacheTTL(), true);
+            writeListCache(cacheKey, tasks, getCacheTTL());
             
             // 对比新旧数据，有变化时重新渲染
             if (_tasksDataChanged(allTasksData, tasks)) {
@@ -559,7 +559,8 @@ function createTaskCard(task) {
         
         // 渲染头像（始终使用 img 标签）
         const avatarSrc = avatar || DEFAULT_AVATAR_SVG;
-        const avatarHtml = `<img class="swr-avatar" src="${avatarSrc}" style="width: 18px; height: 18px; border-radius: 50%; object-fit: cover; border: 1px solid #444; background: var(--comfy-input-bg);">`;
+        // 🔒 XSS防护：头像 URL 来自他人可修改的资料，写入 HTML 属性前必须转义
+        const avatarHtml = `<img class="swr-avatar" src="${escapeHtml(avatarSrc)}" style="width: 18px; height: 18px; border-radius: 50%; object-fit: cover; border: 1px solid #444; background: var(--comfy-input-bg);">`;
         
         authorContainer.innerHTML = `${avatarHtml}<span class="swr-name">${escapeHtml(name)}</span>`;
         

前端页面/task/任务详情组件.js

@@ -103,11 +103,9 @@ async function loadTaskDetail(container, taskId, currentUser) {
     renderTaskDetail(contentEl, task, currentUser);
     
     if (fromCache) {
-        const toast = document.createElement('div');
-        toast.style.cssText = 'position:fixed; top:20px; left:50%; transform:translateX(-50%); background:#FF9800; color:white; padding:10px 20px; border-radius:4px; z-index:10000; font-size:14px;';
-        toast.textContent = t('feedback.cache_fallback');
-        document.body.appendChild(toast);
-        setTimeout(() => toast.remove(), 3000);
+        // 🔧 改用统一提示组件：原为手写 div（无动画、不排队、不避重叠，样式与其他提示不一致）；
+        // warning 类型的背景色与原手写值同为 #FF9800，视觉保持一致
+        showToast(t('feedback.cache_fallback'), 'warning');
     } else {
         // 只有在线加载成功时才记录浏览量
         recordTaskView(contentEl, taskId);
@@ -188,7 +186,7 @@ function renderTaskDetail(contentEl, task, currentUser) {
         
         <!-- 发布者信息 -->
         <div style="display: flex; align-items: center; gap: 10px; margin-bottom: 15px; padding: 10px; background: var(--comfy-menu-bg); border-radius: 8px;">
-            <img src="${task.publisher_avatar || PLACEHOLDERS.AVATAR_SMALL}"
+            <img src="${escapeHtml(task.publisher_avatar || PLACEHOLDERS.AVATAR_SMALL)}"
                  style="width: 40px; height: 40px; border-radius: 50%; object-fit: cover; border: 2px solid var(--border-color, #333); cursor: pointer;" id="publisher-avatar">
             <div style="flex: 1;">
                 <div style="color: #fff; font-size: 14px; font-weight: 500;">${escapeHtml(task.publisher_name || task.publisher)}</div>
@@ -296,7 +294,7 @@ ${escapeHtml(task.description)}</div>
             <div style="margin-bottom: 20px; padding: 12px; background: rgba(33,150,243,0.1); border: 1px solid rgba(33,150,243,0.3); border-radius: 8px;">
                 <div style="font-size: 13px; font-weight: bold; color: #2196F3; margin-bottom: 8px;">👷 ${t('task.assignee')}</div>
                 <div style="display: flex; align-items: center; gap: 10px;">
-                    <img src="${task.assignee_avatar || PLACEHOLDERS.AVATAR_SMALL}"
+                    <img src="${escapeHtml(task.assignee_avatar || PLACEHOLDERS.AVATAR_SMALL)}"
                          style="width: 32px; height: 32px; border-radius: 50%; object-fit: cover;">
                     <span style="color: #fff;">${escapeHtml(task.assignee_name || task.assignee)}</span>
                 </div>
@@ -321,7 +319,7 @@ ${escapeHtml(task.description)}</div>
                 <div id="applicants-list" style="display: flex; flex-direction: column; gap: 8px;">
                     ${task.applicants.map(app => `
                         <div style="display: flex; align-items: center; gap: 10px; padding: 10px; background: var(--comfy-menu-bg); border-radius: 8px;">
-                            <img src="${app.avatar || PLACEHOLDERS.AVATAR_SMALL}"
+                            <img src="${escapeHtml(app.avatar || PLACEHOLDERS.AVATAR_SMALL)}"
                                  style="width: 32px; height: 32px; border-radius: 50%; object-fit: cover;">
                             <div style="flex: 1;">
                                 <div style="color: #fff; font-size: 13px;">${escapeHtml(app.name || app.account)}</div>
@@ -383,14 +381,17 @@ ${escapeHtml(task.description)}</div>
 function _showConfirmDialog({ title, icon, message, description, confirmText, confirmStyle, loadingText, errorText, width, onConfirm }) {
     const content = document.createElement("div");
     content.style.color = "#ccc";
+    // 🔒 XSS防护：message/description 可能嵌入其他用户的账号或昵称
+    // （如 t('task.confirm_assign', { assignee })），写入 innerHTML 前必须转义。
+    // 本函数的 4 个调用方传的都是词典文本/emoji/数字，转义不改变现有显示效果。
     content.innerHTML = `
         <div style="text-align: center;">
             <div style="font-size: 40px; margin-bottom: 15px;">${icon}</div>
-            <div style="color: #fff; font-size: 14px; margin-bottom: 8px;">${message}</div>
-            <div style="color: #888; font-size: 12px; margin-bottom: 20px;">${description}</div>
+            <div style="color: #fff; font-size: 14px; margin-bottom: 8px;">${escapeHtml(message)}</div>
+            <div style="color: #888; font-size: 12px; margin-bottom: 20px;">${escapeHtml(description)}</div>
             <div style="display: flex; gap: 10px;">
                 <button id="dialog-cancel" style="flex: 1; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer;">${t('common.cancel')}</button>
-                <button id="dialog-confirm" style="flex: 1; ${confirmStyle}; border: none; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer; font-weight: bold;">${confirmText}</button>
+                <button id="dialog-confirm" style="flex: 1; ${confirmStyle}; border: none; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer; font-weight: bold;">${escapeHtml(confirmText)}</button>
             </div>
         </div>
     `;
@@ -444,7 +445,7 @@ function showApplyDialog(task, currentUser) {
     content.innerHTML = `
         <div style="margin-bottom: 15px;">
             <div style="color: #888; font-size: 12px; margin-bottom: 8px;">${t('task.apply_message_prompt')}</div>
-            <textarea id="apply-message" rows="4" placeholder="${t('task.apply_message_placeholder') || ''}" style="width: 100%; padding: 10px; background: var(--comfy-input-bg); border: 1px solid #444; border-radius: 6px; color: #fff; resize: none; box-sizing: border-box; font-size: 13px;"></textarea>
+            <textarea id="apply-message" rows="4" placeholder="${t('task.apply_message_placeholder')}" style="width: 100%; padding: 10px; background: var(--comfy-input-bg); border: 1px solid #444; border-radius: 6px; color: #fff; resize: none; box-sizing: border-box; font-size: 13px;"></textarea>
         </div>
         <div style="display: flex; gap: 10px;">
             <button id="apply-cancel" style="flex: 1; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer;">${t('common.cancel')}</button>
@@ -487,7 +488,7 @@ function showCancelApplyConfirmDialog(task, currentUser) {
         title: t('task.cancel_apply'),
         icon: '↩️',
         message: t('task.confirm_cancel_apply'),
-        description: t('task.cancel_apply_warning') || '',
+        description: t('task.cancel_apply_warning'),
         confirmText: t('common.confirm'),
         confirmStyle: 'background: #FF9800',
         errorText: t('task.cancel_apply_failed'),
@@ -511,7 +512,7 @@ function showCancelTaskConfirmDialog(task) {
         title: t('task.cancel_task'),
         icon: '⚠️',
         message: t('task.confirm_cancel_task'),
-        description: t('task.cancel_task_warning') || '',
+        description: t('task.cancel_task_warning'),
         confirmText: t('task.cancel_task'),
         confirmStyle: 'background: #F44336',
         loadingText: `⏳ ${t('common.cancelling')}...`,
@@ -558,7 +559,7 @@ function showRejectDialog(task, currentUser) {
     content.innerHTML = `
         <div style="margin-bottom: 15px;">
             <div style="color: #888; font-size: 12px; margin-bottom: 8px;">${t('task.reject_reason_prompt')}</div>
-            <textarea id="reject-feedback" rows="4" placeholder="${t('task.reject_reason_placeholder') || ''}" style="width: 100%; padding: 10px; background: var(--comfy-input-bg); border: 1px solid #444; border-radius: 6px; color: #fff; resize: none; box-sizing: border-box; font-size: 13px;"></textarea>
+            <textarea id="reject-feedback" rows="4" placeholder="${t('task.reject_reason_placeholder')}" style="width: 100%; padding: 10px; background: var(--comfy-input-bg); border: 1px solid #444; border-radius: 6px; color: #fff; resize: none; box-sizing: border-box; font-size: 13px;"></textarea>
         </div>
         <div style="display: flex; gap: 10px;">
             <button id="reject-cancel" style="flex: 1; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer;">${t('common.cancel')}</button>
@@ -571,7 +572,7 @@ function showRejectDialog(task, currentUser) {
     content.querySelector("#reject-confirm").onclick = async () => {
         const feedback = content.querySelector("#reject-feedback").value.trim();
         if (!feedback) {
-            showToast(t('task.reject_reason_required') || '请输入拒绝原因', "warning");
+            showToast(t('task.reject_reason_required'), "warning");
             return;
         }
         
@@ -607,8 +608,8 @@ function showDeleteCommentConfirmDialog(taskId, comment, container, currentUser)
     content.innerHTML = `
         <div style="text-align: center;">
             <div style="font-size: 40px; margin-bottom: 15px;">⚠️</div>
-            <div style="color: #fff; font-size: 14px; margin-bottom: 8px;">${t('post.delete_comment_confirm') || '确定删除这条评论吗？'}</div>
-            <div style="color: #888; font-size: 12px; margin-bottom: 20px;">${t('post.delete_comment_warning') || '删除后无法恢复'}</div>
+            <div style="color: #fff; font-size: 14px; margin-bottom: 8px;">${t('post.delete_comment_confirm')}</div>
+            <div style="color: #888; font-size: 12px; margin-bottom: 20px;">${t('post.delete_comment_warning')}</div>
             <div style="display: flex; gap: 10px;">
                 <button id="delete-comment-cancel" style="flex: 1; background: var(--comfy-input-bg); border: 1px solid #555; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer;">${t('common.cancel')}</button>
                 <button id="delete-comment-confirm" style="flex: 1; background: #F44336; border: none; color: #fff; padding: 10px; border-radius: 6px; cursor: pointer; font-weight: bold;">${t('common.delete')}</button>
@@ -625,11 +626,11 @@ function showDeleteCommentConfirmDialog(taskId, comment, container, currentUser)
         
         try {
             await api.deleteComment(taskId, comment.id);
-            showToast(t('post.delete_comment_success') || '评论已删除', "success");
+            showToast(t('post.delete_comment_success'), "success");
             globalModal.closeTopModal();
             loadTaskComments(container, taskId, currentUser);
         } catch (err) {
-            showToast((t('post.delete_comment_failed') || '删除失败') + ": " + err.message, "error");
+            showToast(t('post.delete_comment_failed') + ": " + err.message, "error");
             confirmBtn.disabled = false;
             confirmBtn.textContent = t('common.delete');
         }
@@ -935,9 +936,10 @@ function renderTipBoard(tipBoard) {
  */
 function _renderCommentAvatar(name, avatarUrl) {
     const initial = (name || 'U')[0].toUpperCase();
+    // 🔒 XSS防护：评论者昵称与头像均来自他人可修改的资料，写入 HTML 前必须转义
     return avatarUrl 
-        ? `<img class="swr-avatar" src="${avatarUrl}" style="width: 24px; height: 24px; border-radius: 50%; object-fit: cover; background: var(--comfy-input-bg);">` 
-        : `<div class="swr-avatar" style="width: 24px; height: 24px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: 10px; font-weight: bold;">${initial}</div>`;
+        ? `<img class="swr-avatar" src="${escapeHtml(avatarUrl)}" style="width: 24px; height: 24px; border-radius: 50%; object-fit: cover; background: var(--comfy-input-bg);">` 
+        : `<div class="swr-avatar" style="width: 24px; height: 24px; border-radius: 50%; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); display: flex; align-items: center; justify-content: center; color: white; font-size: 10px; font-weight: bold;">${escapeHtml(initial)}</div>`;
 }
 
 /**

前端页面/task/发布任务组件.js

@@ -8,14 +8,17 @@
 import { api } from "../core/网络请求API.js";
 import { showToast, showConfirm } from "../components/UI交互提示组件.js";
 import { t } from "../components/用户体验增强.js";
-import { removeCache } from "../components/性能优化工具.js";
+import { removeCache, removeCacheByPrefix } from "../components/性能优化工具.js";
 import { compressImageForUpload } from "../market/发布内容_提交引擎.js";
+import { escapeHtml } from "../core/全局配置.js";
 
 /**
  * 🚀 清除任务列表缓存
  */
 function clearTaskListCache() {
-    removeCache('api_/api/tasks');
+    // 🔧 修复：API 层缓存键带完整查询串（api_/api/tasks?status=..&sort=..），
+    // removeCache 精确删除命中不到（no-op），发任务后任务榜仍会从旧缓存返回，改用前缀删除
+    removeCacheByPrefix('api_/api/tasks');
     // 🔧 P1修复：任务榜组件实际使用 TasksCache_${status}_${sort} 键（非 ListCache_*），按真实键格式精准清除
     const statuses = ['', 'open', 'in_progress', 'submitted', 'completed', 'disputed'];
     // 任务榜排序值：latest, price, deadline, views, daily_views, likes, favorites
@@ -102,7 +105,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
             <button id="btn-back" style="background: rgba(51,51,51,0.8); border: 1px solid rgba(85,85,85,0.8); color: #fff; padding: 6px 14px; border-radius: 6px; cursor: pointer; font-size: 13px; font-weight: bold; display: flex; align-items: center; gap: 6px;" onmouseover="this.style.background='#4CAF50'" onmouseout="this.style.background='rgba(51,51,51,0.8)'">
                 ⬅ ${t('common.back')}
             </button>
-            <span style="flex: 1; text-align: center; font-size: 15px; font-weight: bold; color: #fff;">📝 ${isEditMode ? (t('task.edit_task') || '编辑任务') : t('task.publish')}</span>
+            <span style="flex: 1; text-align: center; font-size: 15px; font-weight: bold; color: #fff;">📝 ${isEditMode ? t('task.edit_task') : t('task.publish')}</span>
             <div style="width: 60px;"></div>
         </div>
         
@@ -114,7 +117,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
                 <label style="display: block; color: #fff; font-size: 13px; font-weight: bold; margin-bottom: 6px;">
                     📌 ${t('task.task_title')} <span style="color: #F44336;">*</span>
                 </label>
-                <input type="text" id="task-title" maxlength="50" placeholder="${t('task.title_placeholder')}" value="${editTitle}" 
+                <input type="text" id="task-title" maxlength="50" placeholder="${t('task.title_placeholder')}" value="${escapeHtml(editTitle)}" 
                        style="width: 100%; padding: 10px 12px; background: var(--comfy-menu-bg); border: 1px solid var(--border-color, #333); border-radius: 8px; color: #fff; font-size: 14px; box-sizing: border-box;">
             </div>
             
@@ -124,7 +127,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
                     📄 ${t('task.description')} <span style="color: #F44336;">*</span>
                 </label>
                 <textarea id="task-description" rows="6" maxlength="2000" placeholder="${t('task.description_placeholder')}"
-                          style="width: 100%; padding: 10px 12px; background: var(--comfy-menu-bg); border: 1px solid var(--border-color, #333); border-radius: 8px; color: #fff; font-size: 14px; resize: none; box-sizing: border-box; line-height: 1.5;">${editDescription}</textarea>
+                          style="width: 100%; padding: 10px 12px; background: var(--comfy-menu-bg); border: 1px solid var(--border-color, #333); border-radius: 8px; color: #fff; font-size: 14px; resize: none; box-sizing: border-box; line-height: 1.5;">${escapeHtml(editDescription)}</textarea>
                 <div style="text-align: right; font-size: 11px; color: #666; margin-top: 4px;">
                     <span id="desc-count">${editDescription.length}</span>/2000
                 </div>
@@ -148,7 +151,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
                 <label style="display: block; color: #fff; font-size: 13px; font-weight: bold; margin-bottom: 6px;">
                     🔗 ${t('task.reference_link_optional')}
                 </label>
-                <input type="url" id="ref-link" placeholder="https://..." value="${editRefLink}" 
+                <input type="url" id="ref-link" placeholder="https://..." value="${escapeHtml(editRefLink)}" 
                        style="width: 100%; padding: 10px 12px; background: var(--comfy-menu-bg); border: 1px solid var(--border-color, #333); border-radius: 8px; color: #fff; font-size: 14px; box-sizing: border-box;">
             </div>
             
@@ -308,7 +311,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
     const renderImagePreview = () => {
         imagePreview.innerHTML = selectedImages.map((img, i) => `
             <div style="position: relative; padding-top: 100%; background: var(--comfy-menu-bg); border-radius: 8px; overflow: hidden;">
-                <img src="${img.dataUrl}" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; object-fit: cover;">
+                <img src="${escapeHtml(img.dataUrl)}" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; object-fit: cover;">
                 <button class="btn-remove-img" data-index="${i}" style="position: absolute; top: 4px; right: 4px; width: 20px; height: 20px; background: rgba(244,67,54,0.9); border: none; border-radius: 50%; color: #fff; font-size: 12px; cursor: pointer; display: flex; align-items: center; justify-content: center;">×</button>
             </div>
         `).join("");
@@ -383,7 +386,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
                 
                 await api.updateTask(editTaskData.id, updateData);
                 
-                showToast(t('task.edit_success') || '任务修改成功', "success");
+                showToast(t('task.edit_success'), "success");
             } else {
                 // 新建模式：创建任务
                 publishBtn.textContent = `⏳ ${t('task.publishing')}...`;
@@ -411,7 +414,7 @@ export function createPublishTaskView(currentUser, editTaskData = null) {
             
         } catch (err) {
             console.error(isEditMode ? "修改任务失败:" : "发布任务失败:", err);
-            showToast(err.message || (isEditMode ? t('task.edit_failed') || '修改失败' : t('task.publish_failed')), "error");
+            showToast(err.message || (isEditMode ? t('task.edit_failed') : t('task.publish_failed')), "error");
         } finally {
             const publishBtn = container.querySelector("#btn-publish");
             publishBtn.disabled = false;

前端页面/task/申诉详情组件.js

@@ -8,7 +8,7 @@
 import { api } from "../core/网络请求API.js";
 import { showToast } from "../components/UI交互提示组件.js";
 import { t, getLanguage } from "../components/用户体验增强.js";
-import { isAdmin, IS_WEB_MODE } from "../core/全局配置.js";
+import { isAdmin, IS_WEB_MODE, escapeHtml } from "../core/全局配置.js";
 
 /**
  * 创建申诉详情视图
@@ -37,7 +37,7 @@ async function loadDisputeDetail(container, disputeId, currentUser, onBack) {
         const dispute = res.data;
         renderDisputeDetail(container, dispute, currentUser, onBack);
     } catch (err) {
-        container.innerHTML = `<div style="text-align: center; padding: 40px; color: #f44;">❌ ${err.message}</div>`;
+        container.innerHTML = `<div style="text-align: center; padding: 40px; color: #f44;">❌ ${escapeHtml(err.message)}</div>`;
     }
 }
 
@@ -110,7 +110,7 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
         <!-- 任务信息 -->
         <div class="dispute-section">
             <div class="dispute-section-title"><span class="icon">📋</span> ${t('dispute.related_task')}</div>
-            <div style="color: var(--input-text); font-size: 15px;">${dispute.task_title || t('common.unknown_task')}</div>
+            <div style="color: var(--input-text); font-size: 15px;">${escapeHtml(dispute.task_title || t('common.unknown_task'))}</div>
             <div style="font-size: 12px; color: #888; margin-top: 4px;">${t('dispute.task_id')}: ${dispute.task_id}</div>
         </div>
         
@@ -118,16 +118,16 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
         <div class="dispute-section">
             <div class="dispute-section-title"><span class="icon">👥</span> ${t('dispute.parties')}</div>
             <div class="dispute-party">
-                <img class="dispute-party-avatar" src="${dispute.publisher_avatar || (IS_WEB_MODE ? 'https://api.dicebear.com/7.x/avataaars/svg' : '/community_hub/image?url=https://api.dicebear.com/7.x/avataaars/svg')}" alt="">
+                <img class="dispute-party-avatar" src="${escapeHtml(dispute.publisher_avatar || (IS_WEB_MODE ? 'https://api.dicebear.com/7.x/avataaars/svg' : '/community_hub/image?url=https://api.dicebear.com/7.x/avataaars/svg'))}" alt="">
                 <div class="dispute-party-info">
-                    <div class="dispute-party-name">${dispute.publisher_name || dispute.publisher}</div>
+                    <div class="dispute-party-name">${escapeHtml(dispute.publisher_name || dispute.publisher)}</div>
                     <div class="dispute-party-role">${t('dispute.publisher')} ${dispute.initiator_role === "publisher" ? `（${t('dispute.initiator')}）` : `（${t('dispute.respondent')}）`}</div>
                 </div>
             </div>
             <div class="dispute-party">
-                <img class="dispute-party-avatar" src="${dispute.assignee_avatar || (IS_WEB_MODE ? 'https://api.dicebear.com/7.x/avataaars/svg' : '/community_hub/image?url=https://api.dicebear.com/7.x/avataaars/svg')}" alt="">
+                <img class="dispute-party-avatar" src="${escapeHtml(dispute.assignee_avatar || (IS_WEB_MODE ? 'https://api.dicebear.com/7.x/avataaars/svg' : '/community_hub/image?url=https://api.dicebear.com/7.x/avataaars/svg'))}" alt="">
                 <div class="dispute-party-info">
-                    <div class="dispute-party-name">${dispute.assignee_name || dispute.assignee}</div>
+                    <div class="dispute-party-name">${escapeHtml(dispute.assignee_name || dispute.assignee)}</div>
                     <div class="dispute-party-role">${t('task.assignee')} ${dispute.initiator_role === "assignee" ? `（${t('dispute.initiator')}）` : `（${t('dispute.respondent')}）`}</div>
                 </div>
             </div>
@@ -137,7 +137,7 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
         <div class="dispute-section">
             <div class="dispute-section-title"><span class="icon">📝</span> ${t('dispute.initiator_statement')}</div>
             <div class="dispute-content initiator">
-                <div style="color: var(--input-text);">${dispute.reason || t('common.none')}</div>
+                <div style="color: var(--input-text);">${escapeHtml(dispute.reason || t('common.none'))}</div>
                 ${_renderEvidenceGallery(dispute.evidence)}
                 <div class="dispute-time">${t('dispute.submitted_at')} ${formatTime(dispute.created_at)}</div>
             </div>
@@ -148,7 +148,7 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
             <div class="dispute-section-title"><span class="icon">💬</span> ${t('dispute.respondent_response')}</div>
             ${dispute.response ? `
                 <div class="dispute-content respondent">
-                    <div style="color: var(--input-text);">${dispute.response}</div>
+                    <div style="color: var(--input-text);">${escapeHtml(dispute.response)}</div>
                     ${_renderEvidenceGallery(dispute.response_evidence)}
                     <div class="dispute-time">${t('dispute.responded_at')} ${formatTime(dispute.responded_at)}</div>
                 </div>
@@ -156,7 +156,7 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
                 <div style="color: #888; padding: 12px; text-align: center;">${t('dispute.no_response')}</div>
                 ${canRespond ? `
                     <div class="dispute-respond-form">
-                        <textarea id="respondText" placeholder="${t('dispute.response_placeholder')}"></textarea>
+                        <textarea id="respondText" placeholder="${t('dispute.respond_placeholder')}"></textarea>
                         <div class="dispute-upload-area" id="uploadArea">📷 ${t('dispute.click_upload_evidence_optional')}</div>
                         <input type="file" id="fileInput" accept="image/*" multiple style="display: none;">
                         <div class="dispute-uploaded-images" id="uploadedImages"></div>
@@ -174,7 +174,7 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
                 <div class="dispute-resolution-title">⚖️ ${t('dispute.resolution_result')}</div>
                 <div class="dispute-resolution-result">${getResolutionText(dispute.resolution, dispute.resolution_ratio)}</div>
                 ${dispute.resolution_note ? `
-                    <div class="dispute-resolution-note">${dispute.resolution_note}</div>
+                    <div class="dispute-resolution-note">${escapeHtml(dispute.resolution_note)}</div>
                 ` : ""}
                 <div class="dispute-time">${t('dispute.resolved_at')} ${formatTime(dispute.resolved_at)}</div>
             </div>
@@ -184,6 +184,13 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
     // 返回按钮
     container.querySelector("#backBtn").onclick = () => onBack && onBack();
 
+    // 🔒 XSS防护：证据图片的点击放大改为 DOM 事件绑定
+    // （原内联 onclick="window.open('${img}')" 中的引号即使转义，也会被浏览器先还原
+    //  再交给 JS 解析，依然能被注入；data-full 经 HTML 解码后仍是原始 URL，行为不变）
+    container.querySelectorAll(".dispute-evidence-img").forEach(imgEl => {
+        imgEl.onclick = () => window.open(imgEl.dataset.full, '_blank');
+    });
+
     // 回应表单逻辑
     if (canRespond) {
         const uploadedEvidence = [];
@@ -212,7 +219,7 @@ function renderDisputeDetail(container, dispute, currentUser, onBack) {
         function renderUploadedImages() {
             uploadedImages.innerHTML = uploadedEvidence.map((url, idx) => `
                 <div class="img-wrapper">
-                    <img src="${url}">
+                    <img src="${escapeHtml(url)}">
                     <button class="remove-btn" data-idx="${idx}">×</button>
                 </div>
             `).join("");
@@ -266,6 +273,6 @@ function formatTime(timestamp) {
 function _renderEvidenceGallery(images) {
     if (!images || images.length === 0) return "";
     return `<div class="dispute-evidence">
-        ${images.map(img => `<img src="${img}" onclick="window.open('${img}')">`).join("")}
+        ${images.map(img => `<img class="dispute-evidence-img" src="${escapeHtml(img)}" data-full="${escapeHtml(img)}">`).join("")}
     </div>`;
 }