安全修复：加固CSRF与凭证保护并修复越权风险

routes/api_accounts.py

@@ -164,11 +164,13 @@ def update_account(account_id):
             """
             UPDATE accounts
             SET password = ?, remember = ?
-            WHERE id = ?
+            WHERE id = ? AND user_id = ?
             """,
-            (encrypted_password, new_remember, account_id),
+            (encrypted_password, new_remember, account_id, user_id),
         )
         conn.commit()
+        if cursor.rowcount <= 0:
+            return jsonify({"error": "账号不存在或无权限"}), 404
 
     database.reset_account_login_status(account_id)
     logger.info(f"[账号更新] 用户 {user_id} 修改了账号 {account.username} 的密码，已重置登录状态")