fix: P0 安全加固（移除硬编码弱默认 + 占位符替换修正）

- backend/db.py：db() 的 DB_PASSWORD 改用 _require_env 强制读取，删除弱默认兜底
- backend/db.py：新增 _convert_placeholders 状态机替换 ? 占位符（跳过字符串字面量），并校验占位符/参数数量，替换原 sql.replace 全局替换脆弱点
- backend/flask_app.py：secret_key 改用 _require_env 强制读取，删除可预测弱默认，防止 session 伪造
- .gitea/workflows/deploy.yml：新增 2.5 步，发布时若线上 shared/.env 缺 DB_PASSWORD/SECRET_KEY 则从 CI secrets 自动补齐（已存在则保留），确保 P0 改动上线后可正常启动

.gitea/workflows/deploy.yml

@@ -38,6 +38,28 @@ jobs:
             --exclude='.gitea' \
             "${CLONE_DIR}/" "${RELEASE_DIR}/"
 
+          echo "=== 2.5 Ensure .env secrets ==="
+          # .env 不随 git 走，线上凭据由服务器本地 shared/.env 提供。
+          # 若缺失则从 CI secrets 自动补齐；已存在的变量保留，避免覆盖线上配置/导致 session 失效。
+          mkdir -p "${DEPLOY_BASE}/shared"
+          SHARED_ENV="${DEPLOY_BASE}/shared/.env"
+          touch "${SHARED_ENV}"
+          ensure_env_var() {
+            key="$1"; val="$2"
+            if [ -z "$val" ]; then
+              echo "  ! ${key} 未提供(CI secret 为空)，跳过写入"
+              return
+            fi
+            if ! grep -q "^${key}=" "${SHARED_ENV}"; then
+              echo "${key}=${val}" >> "${SHARED_ENV}"
+              echo "  + 已写入 ${key}"
+            else
+              echo "  = ${key} 已存在，保留原值"
+            fi
+          }
+          ensure_env_var "DB_PASSWORD" "${{ secrets.OPC_DB_PASSWORD }}"
+          ensure_env_var "SECRET_KEY"  "${{ secrets.OPC_SECRET_KEY }}"
+
           echo "=== 3. Link shared resources ==="
           mkdir -p "${RELEASE_DIR}/data"
           # .env from shared dir (not in git)

backend/db.py

@@ -39,12 +39,22 @@ UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
 
 
 # ---------- 数据库连接 ----------
+def _require_env(name):
+    """强制读取必需环境变量，缺失即抛出清晰错误（禁止弱默认降级）"""
+    val = os.environ.get(name)
+    if not val:
+        raise RuntimeError(
+            f"缺少必需的环境变量 {name}，请在 .env 中显式配置（关键凭据禁止硬编码兜底）"
+        )
+    return val
+
+
 def db():
     return mysql.connector.connect(
         host=os.environ.get("DB_HOST", "127.0.0.1"),
         port=int(os.environ.get("DB_PORT", "3306")),
         user=os.environ.get("DB_USER", "opc"),
-        password=os.environ.get("DB_PASSWORD", "opc123456"),
+        password=_require_env("DB_PASSWORD"),
         database=os.environ.get("DB_NAME", "opc"),
         charset="utf8mb4",
         collation="utf8mb4_unicode_ci",
@@ -55,10 +65,44 @@ def now():
     return datetime.utcnow().isoformat()
 
 
+def _convert_placeholders(sql):
+    """将 ? 占位符转为 MySQL 的 %s，仅替换字符串字面量之外的 ?。
+
+    避免 `sql.replace('?', '%s')` 的全局替换缺陷：当 SQL 字面量或 LIKE 模式
+    中恰好含 `?` 时会误替换、导致参数错位。这里用状态机跳过单/双引号内的内容。
+    """
+    out = []
+    in_single = in_double = False
+    i, n = 0, len(sql)
+    while i < n:
+        ch = sql[i]
+        if ch == "\\" and i + 1 < n:  # 跳过转义序列
+            out.append(ch)
+            out.append(sql[i + 1])
+            i += 2
+            continue
+        if ch == "'" and not in_double:
+            in_single = not in_single
+        elif ch == '"' and not in_single:
+            in_double = not in_double
+        out.append("%s" if (ch == "?" and not in_single and not in_double) else ch)
+        i += 1
+    return "".join(out)
+
+
 def _exec(conn, sql, args=()):
-    """执行 SQL，自动将 ? 转为 MySQL 的 %s"""
+    """执行 SQL，将 ? 占位符安全地转为 MySQL 的 %s。
+
+    占位符数量与参数数量必须一致，否则立即报错，防止静默错位。
+    """
+    converted = _convert_placeholders(sql)
+    n_ph = converted.count("%s")
+    if n_ph != len(args):
+        raise ValueError(
+            f"SQL 占位符数量({n_ph})与参数数量({len(args)})不匹配，请检查 SQL 与传参: {sql}"
+        )
     cur = conn.cursor(dictionary=True)
-    cur.execute(sql.replace("?", "%s"), args)
+    cur.execute(converted, args)
     return cur
 
 

backend/flask_app.py

@@ -19,7 +19,14 @@ app = Flask(
     template_folder=str(ROOT / "templates"),
     static_folder=str(ROOT / "static"),
 )
-app.secret_key = os.environ.get("SECRET_KEY", "opc-dev-secret-2026")
+# secret_key 必须从环境变量注入，禁止硬编码兜底——否则 session 可被伪造。
+_secret_key = os.environ.get("SECRET_KEY")
+if not _secret_key:
+    raise RuntimeError(
+        "缺少必需的环境变量 SECRET_KEY，请在 .env 中配置（建议: "
+        "python3 -c 'import secrets;print(secrets.token_hex(32))'）"
+    )
+app.secret_key = _secret_key
 app.config["TEMPLATES_AUTO_RELOAD"] = True
 app.register_blueprint(bp)
 

static/modules/plan.js

@@ -298,9 +298,9 @@ function renderPlan() {
         { key: 'payment', label: '回款' },
         { key: 'pending', label: '应收' },
         { key: 'pay_rate', label: '回款率' },
+        { key: 'cost', label: '成本' },
+        { key: 'paid', label: '支出' },
         { key: 'payable', label: '应付' },
-        { key: 'cost', label: '当期成本' },
-        { key: 'paid', label: '当期流出' },
         { key: 'cashflow', label: '现金流' },
       ];
       const UNSIGNED_COLS = [
@@ -310,7 +310,7 @@ function renderPlan() {
         { key: 'sign_amount', label: '签约金额' },
         { key: 'sign_month', label: '签约月份' },
         { key: 'gross', label: '毛利' },
-        { key: 'cost', label: '当期成本' },
+        { key: 'cost', label: '成本' },
         { key: 'profit', label: '项目利润' },
       ];
 
@@ -396,7 +396,7 @@ function renderPlan() {
           var bCf = bPay - ePaid;
           return '<tr class="bg-slate-50"><td class="px-2 py-px"></td><td class="px-2 py-px text-center text-xs text-slate-600">' + m + '</td><td class="px-2 py-px text-center text-xs text-blue-600">' + (bRev ? money(bRev) : '—') + '</td><td class="px-2 py-px text-center text-xs text-green-600">' + (bGross ? money(bGross) : '—') + '</td><td class="px-2 py-px"></td><td class="px-2 py-px text-center text-xs text-amber-600">' + (bPay ? money(bPay) : '—') + '</td><td class="px-2 py-px"></td><td class="px-2 py-px text-center text-xs text-rose-600">' + (eCost ? money(eCost) : '—') + '</td><td class="px-2 py-px text-center text-xs text-purple-600">' + (ePaid ? money(ePaid) : '—') + '</td><td class="px-2 py-px"></td><td class="px-2 py-px text-center text-xs ' + (bCf >= 0 ? 'text-green-600' : 'text-red-600') + '">' + (bCf ? money(bCf) : '—') + '</td><td class="px-2 py-px text-center text-xs ' + (bRev - bPay > 0 ? 'text-red-600' : bRev - bPay < 0 ? 'text-green-600' : 'text-slate-300') + '">' + (bRev - bPay ? money(bRev - bPay) : '—') + '</td></tr>';
         }).join('');
-        return `<tr class="border-b ${state._pmMarks.red[pf.id] ? 'bg-red-50' : 'border-slate-100'} hover:bg-slate-50 cursor-pointer" oncontextmenu="planShowCtx(event, ${pf.id})" onclick="planOpenPfEditModal(${pf.id})"><td class="px-2 py-px text-center align-middle text-sm" onclick="event.stopPropagation();planToggleExpand(${pf.id})"><i data-lucide="chevron-right" style="width:14px;height:14px;color:#94a3b8" id="plan_expand_icon_${pf.id}"></i></td><td class="px-2 py-px text-sm  font-medium text-center align-middle truncate" style="min-width:300px;max-width:300px;width:300px" title="${esc(pf.customer_name)}">${esc(pf.customer_name)}</td><td class="px-2 py-px text-center  align-middle text-sm" onclick="event.stopPropagation()">${planInlineSelect('weight', pf.id, 'weight', pf.weight || '20%', ['20%','40%','60%','80%','100%'])}</td><td class="px-2 py-px text-center  align-middle text-sm" onclick="event.stopPropagation()">${planInlineSelect('ptype', pf.id, 'project_type', pf.project_type || '待签约', ['待签约','已签约'])}</td><td class="px-2 py-px text-center  align-middle text-sm font-medium">${money(pf.sign_amount)}</td><td class="px-2 py-px text-center  text-blue-700 align-middle">${fmtNoUnit(rev)}</td><td class="px-2 py-px text-center  align-middle text-sm font-medium">${fmtNoUnit(gross)}</td><td class="px-2 py-px text-center  align-middle text-sm">${grossR}</td><td class="px-2 py-px text-center  text-amber-700 align-middle">${fmtNoUnit(payment)}</td><td class="px-2 py-px text-center align-middle text-sm font-semibold ${pendingCls}">${pendingVal}</td><td class="px-2 py-px text-center  align-middle text-sm">${payR}</td><td class="px-2 py-px text-center align-middle text-sm font-semibold ${payableCls}">${payableVal}</td><td class="px-2 py-px text-center  text-rose-700 align-middle">${fmtNoUnit(cost)}</td><td class="px-2 py-px text-center  text-purple-700 align-middle">${fmtNoUnit(paid)}</td><td class="px-2 py-px text-center font-semibold align-middle ${cfCls}">${cf}</td></tr><tr class="hidden" id="plan_expand_${pf.id}"><td colspan="15"><table class="w-full"><thead><tr class="border-b border-slate-200"><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">月份</th><th class="px-2 py-1 text-center text-xs text-slate-600">确收</th><th class="px-2 py-1 text-center text-xs text-slate-600">毛利</th><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">回款</th><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">当期成本</th><th class="px-2 py-1 text-center text-xs text-slate-600">当期流出</th><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">现金流</th><th class="px-2 py-1 text-center text-xs text-slate-600">应收</th></tr></thead><tbody>${detailRows}</tbody></table></td></tr>`;
+        return `<tr class="border-b ${state._pmMarks.red[pf.id] ? 'bg-red-50' : 'border-slate-100'} hover:bg-slate-50 cursor-pointer" oncontextmenu="planShowCtx(event, ${pf.id})" onclick="planOpenPfEditModal(${pf.id})"><td class="px-2 py-px text-center align-middle text-sm" onclick="event.stopPropagation();planToggleExpand(${pf.id})"><i data-lucide="chevron-right" style="width:14px;height:14px;color:#94a3b8" id="plan_expand_icon_${pf.id}"></i></td><td class="px-2 py-px text-sm  font-medium text-center align-middle truncate" style="min-width:300px;max-width:300px;width:300px" title="${esc(pf.customer_name)}">${esc(pf.customer_name)}</td><td class="px-2 py-px text-center  align-middle text-sm" onclick="event.stopPropagation()">${planInlineSelect('weight', pf.id, 'weight', pf.weight || '20%', ['20%','40%','60%','80%','100%'])}</td><td class="px-2 py-px text-center  align-middle text-sm" onclick="event.stopPropagation()">${planInlineSelect('ptype', pf.id, 'project_type', pf.project_type || '待签约', ['待签约','已签约'])}</td><td class="px-2 py-px text-center  align-middle text-sm font-medium">${money(pf.sign_amount)}</td><td class="px-2 py-px text-center  text-blue-700 align-middle">${fmtNoUnit(rev)}</td><td class="px-2 py-px text-center  align-middle text-sm font-medium">${fmtNoUnit(gross)}</td><td class="px-2 py-px text-center  align-middle text-sm">${grossR}</td><td class="px-2 py-px text-center  text-amber-700 align-middle">${fmtNoUnit(payment)}</td><td class="px-2 py-px text-center align-middle text-sm font-semibold ${pendingCls}">${pendingVal}</td><td class="px-2 py-px text-center  align-middle text-sm">${payR}</td><td class="px-2 py-px text-center align-middle text-sm font-semibold ${payableCls}">${fmtNoUnit(cost)}</td><td class="px-2 py-px text-center  text-purple-700 align-middle">${fmtNoUnit(paid)}</td><td class="px-2 py-px text-center align-middle text-sm font-semibold ${payableCls}">${payableVal}</td><td class="px-2 py-px text-center font-semibold align-middle ${cfCls}">${cf}</td></tr><tr class="hidden" id="plan_expand_${pf.id}"><td colspan="15"><table class="w-full"><thead><tr class="border-b border-slate-200"><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">月份</th><th class="px-2 py-1 text-center text-xs text-slate-600">确收</th><th class="px-2 py-1 text-center text-xs text-slate-600">毛利</th><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">回款</th><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">成本</th><th class="px-2 py-1 text-center text-xs text-slate-600">支出</th><th class="px-2 py-1"></th><th class="px-2 py-1 text-center text-xs text-slate-600">现金流</th><th class="px-2 py-1 text-center text-xs text-slate-600">应收</th></tr></thead><tbody>${detailRows}</tbody></table></td></tr>`;
       };
       // 待签约简版行
       const tdRowUnsigned = (pf, cost, gross) => {
@@ -1179,7 +1179,7 @@ function renderPlanOverview() {
   document.querySelector("#planOverview").innerHTML = '<div class="grid gap-2.5">' +
     deptCard +
     cfCard +
-    card('<h3 class="text-base font-bold text-slate-700 mb-3">项目经营详情 <span class="text-sm text-slate-500 font-normal ml-3">所有项目产生的签单，确收，毛利，回款，当期成本，当期流出，现金流</span></h3><div class="overflow-x-auto"><table class="w-full text-sm"><thead>' + thead + '</thead><tbody>' + tbody + '</tbody></table></div>', 'p-4') +
+    card('<h3 class="text-base font-bold text-slate-700 mb-3">项目经营详情 <span class="text-sm text-slate-500 font-normal ml-3">所有项目产生的签单，确收，毛利，回款，成本，支出，现金流</span></h3><div class="overflow-x-auto"><table class="w-full text-sm"><thead>' + thead + '</thead><tbody>' + tbody + '</tbody></table></div>', 'p-4') +
     '<div class="grid grid-cols-3 gap-2.5">' +
       card('<div class="mb-3 flex items-center justify-between"><h2 class="text-sm font-bold text-slate-600">月度签约趋势</h2><span class="text-xs text-slate-600">2026</span></div><div style="position:relative;height:200px"><canvas id="planChartSign"></canvas></div>', 'p-4') +
       card('<div class="mb-3 flex items-center justify-between"><h2 class="text-sm font-bold text-slate-600">月度确收与毛利</h2><span class="text-xs text-slate-600">2026</span></div><div style="position:relative;height:200px"><canvas id="planChartRev"></canvas></div>', 'p-4') +
@@ -1316,7 +1316,7 @@ function renderPlanQuarterlyOverview() {
   document.querySelector("#planQuarterlyOverview").innerHTML = '<div class="grid gap-2.5">' +
     card('<h3 class="text-base font-bold text-slate-700 mb-3">部门损益情况 <span class="text-sm text-slate-500 font-normal ml-3">部门利润 = 所有项目产生的毛利 - 部门 1 级产生的人力成本，研发成本，差旅和其他支出</span></h3><div class="overflow-x-auto"><table class="w-full text-sm"><thead>' + deptThead + '</thead><tbody>' + deptTbody + '</tbody></table></div>', 'p-4') +
     card('<h3 class="text-base font-bold text-slate-700 mb-3">部门现金流 <span class="text-sm text-slate-500 font-normal ml-3">部门现金流=所有项目产生的现金流 - 部门一级因费用产生的现金流出或流入</span></h3><div class="overflow-x-auto"><table class="w-full text-sm"><thead>' + deptThead + '</thead><tbody>' + cfTbody + '</tbody></table></div>', 'p-4') +
-    card('<h3 class="text-base font-bold text-slate-700 mb-3">项目经营详情 <span class="text-sm text-slate-500 font-normal ml-3">所有项目产生的签单，确收，毛利，回款，当期成本，当期流出，现金流</span></h3><div class="overflow-x-auto"><table class="w-full text-sm"><thead>' + thead + '</thead><tbody>' + tbody + '</tbody></table></div>', 'p-4') +
+    card('<h3 class="text-base font-bold text-slate-700 mb-3">项目经营详情 <span class="text-sm text-slate-500 font-normal ml-3">所有项目产生的签单，确收，毛利，回款，成本，支出，现金流</span></h3><div class="overflow-x-auto"><table class="w-full text-sm"><thead>' + thead + '</thead><tbody>' + tbody + '</tbody></table></div>', 'p-4') +
     '</div>';
   if (window.lucide) window.lucide.createIcons();
 }

templates/index.html

@@ -84,7 +84,7 @@
     <header class="topbar border-b border-slate-200 bg-white px-8 py-5">
       <div class="flex items-center gap-3 w-full">
         <div class="flex-1">
-          <p class="eyebrow text-xs font-semibold uppercase tracking-[0.18em] text-blue-700">OPC Manager <span class="ml-2 text-xs font-normal text-slate-400 tracking-normal">v1.2.0.40</span></p>
+          <p class="eyebrow text-xs font-semibold uppercase tracking-[0.18em] text-blue-700">OPC Manager <span class="ml-2 text-xs font-normal text-slate-400 tracking-normal">v1.2.0.41</span></p>
           <div class="flex items-center gap-4 mt-1">
             <h1 class="text-2xl font-semibold" id="workspaceTitle">科普 OPC 工作台</h1>
             <div class="hidden sm:flex items-center gap-1.5 bg-gradient-to-r from-blue-50 to-indigo-50 border border-blue-100 rounded-full px-4 py-1.5">