diff --git a/admin.py b/admin.py index b23806c..79e22e4 100644 --- a/admin.py +++ b/admin.py @@ -191,7 +191,15 @@ def list_rows(table): page = max(1, int(request.args.get("page", 1))) size = min(100, max(1, int(request.args.get("size", 20)))) q = (request.args.get("q") or "").strip() + # 排序:字段白名单校验(防注入),默认 id 降序 cols = _columns(table) + valid_fields = {c["name"] for c in cols} + sort = request.args.get("sort", "") or "id" + if sort not in valid_fields: + sort = "id" + order = (request.args.get("order", "") or "desc").lower() + if order not in ("asc", "desc"): + order = "desc" where, args = "", [] if q: fields = SEARCHABLE.get(table) or () @@ -200,10 +208,11 @@ def list_rows(table): where = "WHERE " + " OR ".join(f"{f} LIKE ? ESCAPE '\\'" for f in fields) args = [like] * len(fields) total = query_one(f"SELECT COUNT(*) AS c FROM {table} {where}", args)["c"] - rows = query(f"SELECT * FROM {table} {where} ORDER BY id DESC LIMIT ? OFFSET ?", + rows = query(f"SELECT * FROM {table} {where} ORDER BY {sort} {order.upper()}, id {order.upper()} LIMIT ? OFFSET ?", args + [size, (page - 1) * size]) return jsonify({"table": table, "cn": TABLES[table], "columns": cols, - "total": total, "page": page, "size": size, "rows": rows}) + "total": total, "page": page, "size": size, "rows": rows, + "sort": sort, "order": order}) def get_row(table, rid): diff --git a/static/admin.html b/static/admin.html index f7267cf..dbd8219 100644 --- a/static/admin.html +++ b/static/admin.html @@ -46,6 +46,9 @@ body { background:var(--bg); color:var(--txt); font-family:"PingFang SC","Micros table { width:100%; border-collapse:collapse; } th, td { padding:9px 11px; text-align:left; font-size:13px; border-bottom:1px solid var(--line); white-space:nowrap; max-width:260px; overflow:hidden; text-overflow:ellipsis; } th { background:var(--bg2); color:var(--sub); font-weight:600; font-size:12px; position:sticky; top:0; } +th.sortable { cursor:pointer; user-select:none; transition:.15s; } +th.sortable:hover { color:var(--orange2); } +th.sort-active { color:var(--orange2); } tr:hover td { background:rgba(249,115,22,.05); } td.num { text-align:center; } .row-ops { display:flex; gap:6px; } diff --git a/static/admin.js b/static/admin.js index 07ff6bb..e773c12 100644 --- a/static/admin.js +++ b/static/admin.js @@ -4,7 +4,7 @@ const $$ = (s) => [...document.querySelectorAll(s)]; const esc = (s) => String(s ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&", "<": "<", ">": ">", '"': """, "'": "'" }[c])); let TOKEN = localStorage.getItem("nba_admin_token") || ""; -let CUR = { table: "", page: 1, q: "" }; +let CUR = { table: "", page: 1, q: "", sort: "id", order: "desc" }; let LOOKUPS = {}; // teams/players/leagues/sports → {id: name} /* 字段中文名 */ @@ -79,7 +79,7 @@ function switchPage(p) { $("#page-config").classList.toggle("hidden", p !== "config"); if (p === "stats") loadStats(); else if (p === "config") loadConfig(); - else { CUR = { table: p, page: 1, q: "" }; $("#tbl-search").value = ""; loadTable(); } + else { CUR = { table: p, page: 1, q: "", sort: "id", order: "desc" }; $("#tbl-search").value = ""; loadTable(); } } /* ================= 仪表盘 ================= */ @@ -108,11 +108,15 @@ async function loadLookups() { async function loadTable() { $("#table-title").textContent = TITLE_CN[CUR.table] || CUR.table; - const d = await api(`/api/admin/${CUR.table}?page=${CUR.page}&size=20&q=${encodeURIComponent(CUR.q)}`); + const d = await api(`/api/admin/${CUR.table}?page=${CUR.page}&size=20&q=${encodeURIComponent(CUR.q)}&sort=${encodeURIComponent(CUR.sort)}&order=${CUR.order}`); const cols = d.columns.filter((c) => c.name !== "created_at"); const rows = d.rows; if (!Object.keys(LOOKUPS).length) await loadLookups().catch(() => {}); - const thead = `