MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、JS空集合保护、
会话过期体验优化（403 JSON）、display_errors 关闭、
固定 key 根治 Integrity check failed 等全部改动

注意：config.inc.php/.htaccess/.user.ini 含敏感信息，
通过 .gitignore 排除，勿推送到公开仓库。

upgrade/6/post.inc

@@ -0,0 +1,28 @@
+<?php
+namespace MRBS;
+
+global $auth;
+global $max_level;
+
+
+// If the 'level' field does not exist (as it won't if it was created pre-MRBS 1.4.2),
+// then create it and populate it with existing admins defined in the config file
+if (!$upgrade_handle->field_exists(_tbl('users'), 'level'))
+{
+  // Default is '0' because we want to play safe and give no rights.
+  // In a moment we will go through the table and add users and admins.
+  $upgrade_handle->command("ALTER TABLE " . _tbl('users') . " ADD COLUMN level smallint DEFAULT '0' NOT NULL ".
+    $upgrade_handle->syntax_addcolumn_after("id"));
+  
+  // Assuming that all existing entries in the users table are at least users, 
+  // make them all Level 1
+  $sql = "UPDATE " . _tbl('users') . " SET level=?";
+  $upgrade_handle->command($sql, array(1));
+  
+  // Now populate the table with the existing admins
+  foreach ($auth['admin'] as $admin_name)
+  {
+    $sql = "UPDATE " . _tbl('users') . " SET level=? WHERE name=?";
+    $upgrade_handle->command($sql, array($max_level, $admin_name));
+  }
+}