增强后台登录安全与密码策略

admin/dashboard/templates/login.html

@@ -312,7 +312,7 @@
                         password: [{ required: true, message: '请输入密码', trigger: 'blur' }]
                     },
                     loading: false,
-                    errorMessage: ''
+                    errorMessage: {{ (error or '')|tojson }}
                 }
             },
             methods: {
@@ -323,23 +323,32 @@
                             const formData = new FormData();
                             formData.append('username', this.loginForm.username);
                             formData.append('password', this.loginForm.password);
-                            fetch('/login', { method: 'POST', body: formData })
+                            axios.post('/login', formData, {
+                                headers: {
+                                    'X-Requested-With': 'XMLHttpRequest',
+                                    'Accept': 'application/json'
+                                }
+                            })
                                 .then(response => {
-                                    if (response.redirected) {
-                                        window.location.href = response.url;
-                                    } else {
-                                        return response.text();
-                                    }
-                                })
-                                .then(html => {
-                                    if (html) {
-                                        this.errorMessage = '用户名或密码错误';
-                                        this.loading = false;
+                                    const data = response.data || {};
+                                    if (data.success && data.redirect_url) {
+                                        window.location.href = data.redirect_url;
+                                        return;
                                     }
+                                    this.errorMessage = data.error || '登录失败，请稍后重试';
+                                    this.loading = false;
                                 })
                                 .catch(error => {
                                     console.error('登录出错:', error);
-                                    this.errorMessage = '登录请求失败，请稍后重试';
+                                    let errorMsg = '登录请求失败，请稍后重试';
+                                    try {
+                                        if (error && error.response && error.response.data && error.response.data.error) {
+                                            errorMsg = error.response.data.error;
+                                        }
+                                    } catch (e) {
+                                        // 读取错误详情失败时保留默认提示即可。
+                                    }
+                                    this.errorMessage = errorMsg;
                                     this.loading = false;
                                 });
                         }