From 9dcf5dcb934202d347485f4b93e0a0710b27406c Mon Sep 17 00:00:00 2001
From: ypsdf1 <nihaoshidifu@gitee.com>
Date: Thu, 22 Oct 2026 19:18:18 +0800
Subject: [PATCH] =?UTF-8?q?=E7=AC=AC45=E6=89=B9=EF=BC=9A=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E8=B4=A6=E5=8F=B7=E5=AE=89=E5=85=A8=E5=8D=A1=E6=8A=A5=E7=BC=BA?=
 =?UTF-8?q?=E5=B0=91web=5Ftoken=E5=8F=82=E6=95=B0(apiPost=E7=BB=9F?=
 =?UTF-8?q?=E4=B8=80=E6=B3=A8=E5=85=A5web=5Ftoken)+=E6=B8=B8=E5=AE=A2?=
 =?UTF-8?q?=E6=A8=A1=E5=BC=8F=E6=8F=90=E7=A4=BA=E5=85=88=E7=99=BB=E5=BD=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 player.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/player.php b/player.php
index 50c2a55..88507b5 100644
--- a/player.php
+++ b/player.php
@@ -2513,6 +2513,7 @@ if ($currentVersion !== $BUILD_VERSION) {
         if (!box) return;
         box.innerHTML = '<div style="color:var(--dim);font-size:13px;padding:12px 0">加载中...</div>';
         const retry = '<button class="btn" style="font-size:12px;padding:2px 8px;margin-left:6px" onclick="acctRefreshStatus()">重试</button>';
+        if (!TOKEN) { box.innerHTML = '<div style="color:var(--dim);font-size:13px;padding:12px 0">请先登录游戏后再查看账号安全信息</div>'; return; }
         try {
             const res = await apiPost('account.php', {action: 'status'});
             if (!res.success) {
@@ -2816,10 +2817,13 @@ if ($currentVersion !== $BUILD_VERSION) {
     // 流程：完整密码(第一层) → 邮箱码/动态码/恢复代码(第二层) → ticket(10分钟一次性) → 执行动作
     async function apiPost(endpoint, params = {}) {
         const url = new URL(API + endpoint, location.href);
+        // ★ 第44批修复：账号安全接口统一注入 web_token（游戏拿token登录时 TOKEN 有值）
+        const body = Object.assign({}, params);
+        if (!body.web_token && TOKEN) body.web_token = TOKEN;
         const res = await fetch(url, {
             method: 'POST',
             headers: {'Content-Type': 'application/json'},
-            body: JSON.stringify(params)
+            body: JSON.stringify(body)
         });
         return await res.json();
     }