fix: 修复多个安全缺陷和功能问题

- 移除加密相关代码（服务端和所有客户端）
- 修复 JWT 验证未检查签名算法的问题
- 修复重置密码使用不安全随机数的问题
- 实现 Logout 服务端失效机制
- 修复历史版本对比 diff 颜色标记错误
- 修复占位符解析循环引用风险
- 添加用户禁用状态检查
- 更新 bug 清单文档

kenaito-conf-lua-client/client.lua

@@ -1,7 +1,6 @@
 local http = require("socket.http")
 local ltn12 = require("ltn12")
 local cjson = require("cjson")
-local openssl = require("openssl")
 
 local ConfigClient = {}
 ConfigClient.__index = ConfigClient
@@ -17,10 +16,8 @@ function ConfigClient.new(config)
     self.config.syncInterval = self.config.syncInterval or 60
     self.config.ignoreGlobal = self.config.ignoreGlobal or false
     self.config.cacheDir = self.config.cacheDir or "."
-    
+
     self.configs = {}
-    self.secret = ""
-    self.globalSecret = ""
     self.lastTime = 0
     self.handlers = {}
     return self
@@ -38,30 +35,6 @@ function ConfigClient:get_all()
     return self.configs
 end
 
-local function decrypt_config(secret, data)
-    local prefix = "{Cipher}"
-    if string.sub(data, 1, #prefix) ~= prefix then
-        return data
-    end
-    local encrypted = string.sub(data, #prefix + 1)
-    
-    -- MD5 hash
-    local md5_hash = openssl.digest("md5", secret)
-    local aes_key = string.sub(md5_hash, 17)
-    
-    -- Base64 decode
-    local cipher_text = openssl.base64(encrypted, false)
-    
-    -- AES-128-CBC decrypt
-    local iv = string.rep("\0", 16)
-    local cipher = openssl.cipher.new("aes-128-cbc")
-    local plain_text = cipher:decrypt(cipher_text, aes_key, iv)
-    
-    -- Remove PKCS7 padding
-    local padding = string.byte(plain_text, -1)
-    return string.sub(plain_text, 1, -padding - 1)
-end
-
 function ConfigClient:start()
     -- Fetch all configs
     local url = self.config.baseUrl .. "/api/fetchAllConfigs"
@@ -87,28 +60,19 @@ function ConfigClient:start()
     
     if code == 200 then
         local data = cjson.decode(table.concat(response_body))
-        
-        if data["kenaito.config.encrypt-secret"] then
-            self.secret = data["kenaito.config.encrypt-secret"]
-        end
-        if data["kenaito.config.global-encrypt-secret"] then
-            self.globalSecret = data["kenaito.config.global-encrypt-secret"]
-        end
+
         if data["latest.fetch.timestamp"] then
             self.lastTime = tonumber(data["latest.fetch.timestamp"])
         end
-        
+
         for k, v in pairs(data) do
             if not string.match(k, "^kenaito%.") and k ~= "latest.fetch.timestamp" then
                 if type(v) == "string" then
-                    self.configs[k] = decrypt_config(self.secret, v)
-                    if self.configs[k] == v and self.globalSecret ~= "" then
-                        self.configs[k] = decrypt_config(self.globalSecret, v)
-                    end
+                    self.configs[k] = v
                 end
             end
         end
-        
+
         print("[ConfigClient] fetched " .. #self.configs .. " configs")
     end
 end