diff --git a/api/land_api.php b/api/land_api.php
index f01ba8d..f73c9a1 100644
--- a/api/land_api.php
+++ b/api/land_api.php
@@ -133,8 +133,8 @@ try {
             $isAdmin = true;
         }
     } elseif (in_array($action, $playerActions) || in_array($action, $playerPermActions) || in_array($action, $memberPermActions) || in_array($action, $playerFieldActions)) {
-        // 玩家端：需要token
-        $token = $_GET['token'] ?? '';
+        // 玩家端：需要token（兼容 GET 和 POST）
+        $token = $_GET['token'] ?? $_POST['token'] ?? '';
         if (empty($token)) {
             echo json_encode(['success' => false, 'error' => '需要登录', 'needLogin' => true]);
             exit;
diff --git a/player.php b/player.php
index 38f21fe..1bbcd9f 100644
--- a/player.php
+++ b/player.php
@@ -3483,9 +3483,14 @@ async function toggleMemberPerm(landName, targetPlayer, permKey, el) {
         body.set('perm', permKey);
 
         // 从元素中获取当前状态
-        const statusSpan = el.querySelector('span:last-child');
-        const isCustom = statusSpan.textContent.includes('自定义');
-        const isEnabled = statusSpan.textContent.includes('启用');
+        // 状态文字在 flex div 的最后一个 span 里（✓ 启用 / ✗ 禁用 / 默认）
+        const spans = el.querySelectorAll('span');
+        const statusSpan = spans[spans.length - 1]; // 第二个 span 是状态
+        const statusText = statusSpan ? statusSpan.textContent : '';
+        const isEnabled = statusText.includes('启用');
+        // "★ 自定义" 在第二个 div 里
+        const divs = el.querySelectorAll('div');
+        const isCustom = divs.length > 1 && divs[divs.length - 1].textContent.includes('自定义');
 
         if (isCustom) {
             // 已有自定义：切换启用/禁用