From 2342cc2cab2e95d3fd88b80dab6c1c04688994ca Mon Sep 17 00:00:00 2001
From: ypsdf1 <nihaoshidifu@gitee.com>
Date: Sun, 28 Jun 2026 15:16:36 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=94=A8=E6=88=B7=E7=BB=84=E6=88=90?=
 =?UTF-8?q?=E5=91=98=E6=B7=BB=E5=8A=A0=E6=A0=A1=E9=AA=8C(=E7=8E=A9?=
 =?UTF-8?q?=E5=AE=B6=E5=90=8D=E6=A0=BC=E5=BC=8F+login.db=E5=AD=98=E5=9C=A8?=
 =?UTF-8?q?=E6=80=A7=E6=A3=80=E6=9F=A5)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 api/land_api.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/api/land_api.php b/api/land_api.php
index 2736056..51923aa 100644
--- a/api/land_api.php
+++ b/api/land_api.php
@@ -1658,6 +1658,24 @@ function handleAddGroupMember($db, $data) {
         echo json_encode(['success' => false, 'error' => 'missing player or group']);
         return;
     }
+    // ★ 玩家名格式校验：3-16位，仅字母数字下划线
+    if (!preg_match('/^[a-zA-Z0-9_]{3,16}$/', $player)) {
+        echo json_encode(['success' => false, 'error' => "玩家名格式无效: {$player}（需要3-16位字母/数字/下划线）"]);
+        return;
+    }
+    // ★ 校验玩家是否存在（查login.db）
+    $loginDbPath = dirname(__DIR__) . '/db/login.db';
+    if (file_exists($loginDbPath)) {
+        $loginDb = new SQLite3($loginDbPath);
+        $stmt = $loginDb->prepare("SELECT 1 FROM users WHERE player_name = :name");
+        $stmt->bindValue(':name', $player, SQLITE3_TEXT);
+        $exists = $stmt->execute()->fetchArray();
+        $loginDb->close();
+        if (!$exists) {
+            echo json_encode(['success' => false, 'error' => "玩家 {$player} 不存在于login.db"]);
+            return;
+        }
+    }
     $db->exec("CREATE TABLE IF NOT EXISTS web_user_group_members (
         player_name TEXT NOT NULL,
         group_name TEXT NOT NULL,