MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、JS空集合保护、
会话过期体验优化（403 JSON）、display_errors 关闭、
固定 key 根治 Integrity check failed 等全部改动

注意：config.inc.php/.htaccess/.user.ini 含敏感信息，
通过 .gitignore 排除，勿推送到公开仓库。

auth/cms/joomla.inc

@@ -0,0 +1,19 @@
+<?php
+
+global $auth;
+
+define('_JEXEC', 1);
+
+$joomla_path = realpath(MRBS_ROOT . '/' . $auth['joomla']['rel_path']);
+
+if ($joomla_path === false)
+{
+  $message = MRBS_ROOT . '/' . $auth['joomla']['rel_path'] . ' does not exist.  Check the setting ' .
+             'of $auth["joomla"]["rel_path"] in your config file.';
+  die($message);  // Too early for Errors::fatalError()
+}
+
+define('JPATH_BASE', $joomla_path);
+
+require_once JPATH_BASE . '/includes/defines.php';
+require_once JPATH_BASE . '/includes/framework.php';

auth/cms/wordpress.inc

@@ -0,0 +1,10 @@
+<?php
+
+global $theme, $auth;
+
+define('WP_USE_THEMES', false);
+
+// WordPress unsets the $theme variable so we need to save it and restore it afterwards.
+$mrbs_theme = $theme;
+require_once MRBS_ROOT . '/'. $auth['wordpress']['rel_path'] . '/wp-load.php';
+$theme = $mrbs_theme;