From a28083f4caf8cd462c28dc7ecbc7a709d45b2b26 Mon Sep 17 00:00:00 2001
From: ypsdf1 <nihaoshidifu@gitee.com>
Date: Fri, 10 Jul 2026 22:51:04 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DPHP=E4=B8=A4=E4=B8=AAbug?=
 =?UTF-8?q?=EF=BC=9A1.land=5Fapi.php=E7=8E=A9=E5=AE=B6=E7=AB=AFtoken?=
 =?UTF-8?q?=E9=AA=8C=E8=AF=81=E5=85=BC=E5=AE=B9POST=EF=BC=88changeVisitorR?=
 =?UTF-8?q?ole=E7=AD=89POST=E8=AF=B7=E6=B1=82=E4=B8=8D=E5=86=8D=E8=AF=AF?=
 =?UTF-8?q?=E6=8A=A5=E9=9C=80=E8=A6=81=E7=99=BB=E5=BD=95=EF=BC=89=EF=BC=9B?=
 =?UTF-8?q?2.player.php=E6=88=90=E5=91=98=E6=9D=83=E9=99=90toggle=E6=A3=80?=
 =?UTF-8?q?=E6=B5=8B=E9=80=BB=E8=BE=91=E4=BF=AE=E6=AD=A3=EF=BC=88isCustom?=
 =?UTF-8?q?=E5=8E=9F=E6=9C=AC=E6=9F=A5span=E4=BD=86=E8=87=AA=E5=AE=9A?=
 =?UTF-8?q?=E4=B9=89=E6=96=87=E5=AD=97=E5=9C=A8div=E9=87=8C=EF=BC=8C?=
 =?UTF-8?q?=E5=AF=BC=E8=87=B4=E6=B0=B8=E8=BF=9C=E8=B5=B0=E6=97=A0=E8=87=AA?=
 =?UTF-8?q?=E5=AE=9A=E4=B9=89=E5=88=86=E6=94=AF=E5=8F=AA=E8=83=BD=E7=BB=99?=
 =?UTF-8?q?=E4=B8=8D=E8=83=BD=E6=92=A4=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 api/land_api.php |  4 ++--
 player.php       | 11 ++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/api/land_api.php b/api/land_api.php
index f01ba8d..f73c9a1 100644
--- a/api/land_api.php
+++ b/api/land_api.php
@@ -133,8 +133,8 @@ try {
             $isAdmin = true;
         }
     } elseif (in_array($action, $playerActions) || in_array($action, $playerPermActions) || in_array($action, $memberPermActions) || in_array($action, $playerFieldActions)) {
-        // 玩家端：需要token
-        $token = $_GET['token'] ?? '';
+        // 玩家端：需要token（兼容 GET 和 POST）
+        $token = $_GET['token'] ?? $_POST['token'] ?? '';
         if (empty($token)) {
             echo json_encode(['success' => false, 'error' => '需要登录', 'needLogin' => true]);
             exit;
diff --git a/player.php b/player.php
index 38f21fe..1bbcd9f 100644
--- a/player.php
+++ b/player.php
@@ -3483,9 +3483,14 @@ async function toggleMemberPerm(landName, targetPlayer, permKey, el) {
         body.set('perm', permKey);
 
         // 从元素中获取当前状态
-        const statusSpan = el.querySelector('span:last-child');
-        const isCustom = statusSpan.textContent.includes('自定义');
-        const isEnabled = statusSpan.textContent.includes('启用');
+        // 状态文字在 flex div 的最后一个 span 里（✓ 启用 / ✗ 禁用 / 默认）
+        const spans = el.querySelectorAll('span');
+        const statusSpan = spans[spans.length - 1]; // 第二个 span 是状态
+        const statusText = statusSpan ? statusSpan.textContent : '';
+        const isEnabled = statusText.includes('启用');
+        // "★ 自定义" 在第二个 div 里
+        const divs = el.querySelectorAll('div');
+        const isCustom = divs.length > 1 && divs[divs.length - 1].textContent.includes('自定义');
 
         if (isCustom) {
             // 已有自定义：切换启用/禁用