From 124536ef3d643ab9cffa7ab40dbb967959641949 Mon Sep 17 00:00:00 2001
From: PIKACHUIM <PIKACHUIM@users.noreply.github.com>
Date: Wed, 9 Sep 2026 23:46:45 +0800
Subject: [PATCH 1/3] feat(customize): runtime inject customize_head/body for
 static frontend

Go backend injects customize_head/body at server-side into index.html
placeholders; the TS/static frontend serves HTML without backend so
customization never applies. Inject them at runtime after /public/settings
loads, rebuilding <script> nodes so custom JS actually executes.
---
 src/app/App.tsx        |  7 ++++++-
 src/utils/customize.ts | 43 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 src/utils/customize.ts
diff --git a/src/app/App.tsx b/src/app/App.tsx
index eeda3821d..010fdc6b4 100644
--- a/src/app/App.tsx
+++ b/src/app/App.tsx
@@ -22,6 +22,7 @@ import {
   initPluginEngine,
   r,
 } from "~/utils"
+import { applyCustomize } from "~/utils/customize"
 import { MustUser, UserOrGuest } from "./MustUser"
 import "./index.css"
 import { globalStyles } from "./theme"
@@ -57,7 +58,11 @@ const App: Component = () => {
       (async () => {
         handleRespWithoutAuthAndNotify(
           (await r.get("/public/settings")) as Resp<Record<string, string>>,
-          setSettings,
+          (data) => {
+            setSettings(data)
+            // 注入自定义 CSS/JS（customize_head/body），对齐 Go 服务端注入语义
+            applyCustomize()
+          },
           (e) => setErr(err().concat(e)),
         )
       })(),
diff --git a/src/utils/customize.ts b/src/utils/customize.ts
new file mode 100644
index 000000000..2d905258f
--- /dev/null
+++ b/src/utils/customize.ts
@@ -0,0 +1,43 @@
+import { getSetting } from "~/store/settings"
+
+/**
+ * 运行时注入自定义内容（对齐 Go 后端服务端注入 index.html 的
+ * `<!-- customize head -->` / `<!-- customize body -->` 占位符）。
+ *
+ * Go 后端在返回 HTML 前完成占位符替换；TS/静态部署前端 HTML 不经后端，
+ * 因此无法走服务端注入，改由前端在 settings 加载完成后动态注入：
+ *   customize_head -> 注入到 <head> 末尾
+ *   customize_body -> 注入到 <body> 末尾
+ *
+ * 注意：insertAdjacentHTML / innerHTML 不会执行插入的 <script>，这里用
+ * <template> 解析后对 <script> 节点重建，确保自定义 JS 能真正执行。
+ */
+function injectFragment(target: ParentNode, html: string): void {
+  if (!html) return
+  const template = document.createElement("template")
+  template.innerHTML = html
+  const nodes = Array.from(template.content.childNodes)
+  for (const node of nodes) {
+    if (node.nodeType === Node.ELEMENT_NODE) {
+      const el = node as Element
+      if (el.tagName === "SCRIPT") {
+        const script = document.createElement("script")
+        for (const attr of Array.from(el.attributes)) {
+          script.setAttribute(attr.name, attr.value)
+        }
+        script.textContent = el.textContent || ""
+        target.appendChild(script)
+      } else {
+        target.appendChild(node.cloneNode(true))
+      }
+    } else {
+      target.appendChild(node.cloneNode(true))
+    }
+  }
+}
+
+/** 注入自定义 CSS/JS（customize_head + customize_body） */
+export const applyCustomize = (): void => {
+  injectFragment(document.head, getSetting("customize_head"))
+  injectFragment(document.body, getSetting("customize_body"))
+}

From a70d2921b5ac641271ef35b76b9cd2a0f69484b3 Mon Sep 17 00:00:00 2001
From: PIKACHUIM <PIKACHUIM@users.noreply.github.com>
Date: Wed, 9 Sep 2026 23:55:55 +0800
Subject: [PATCH 2/3] fix(customize): only inject at runtime for TS backend,
 avoid duplicate injection on Go

---
 src/app/App.tsx | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/app/App.tsx b/src/app/App.tsx
index 010fdc6b4..5d25939e6 100644
--- a/src/app/App.tsx
+++ b/src/app/App.tsx
@@ -23,6 +23,7 @@ import {
   r,
 } from "~/utils"
 import { applyCustomize } from "~/utils/customize"
+import { isTsWorker } from "~/utils/backend"
 import { MustUser, UserOrGuest } from "./MustUser"
 import "./index.css"
 import { globalStyles } from "./theme"
@@ -60,8 +61,11 @@ const App: Component = () => {
           (await r.get("/public/settings")) as Resp<Record<string, string>>,
           (data) => {
             setSettings(data)
-            // 注入自定义 CSS/JS（customize_head/body），对齐 Go 服务端注入语义
-            applyCustomize()
+            // 注入自定义 CSS/JS（customize_head/body）：仅 TS 模式前端运行时注入；
+            // Go 后端已在服务端完成注入，重复注入会导致自定义内容出现两次。
+            if (isTsWorker()) {
+              applyCustomize()
+            }
           },
           (e) => setErr(err().concat(e)),
         )

From 05b634c22e4d6dfaf12b6905b52e6bdc1192ec80 Mon Sep 17 00:00:00 2001
From: PIKACHUIM <PIKACHUIM@users.noreply.github.com>
Date: Thu, 10 Sep 2026 11:00:02 +0800
Subject: [PATCH 3/3] fix(backup): decrypt settings array on restore to avoid
 encrypted config

The restore logic used Object.values(data) and started decrypting from
length-4, which skips the settings array entirely. For password-protected
backups this left settings (customize_head/body, tokens, site title) as
ciphertext after restore. Decrypt all five arrays explicitly.
---
 src/pages/manage/backup-restore.tsx | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/pages/manage/backup-restore.tsx b/src/pages/manage/backup-restore.tsx
index 2e4589542..58682c9f3 100644
--- a/src/pages/manage/backup-restore.tsx
+++ b/src/pages/manage/backup-restore.tsx
@@ -300,12 +300,19 @@ const BackupRestore = () => {
             appendLog(t("br.wrong_encrypt_password"), "error")
             return
           }
-        const dataArray = Object.values(data)
-        for (let i = dataArray.length - 4; i < dataArray.length; i++) {
-          const obj = dataArray[i]
-          console.log(obj)
-          for (let a = 0; a < obj.length; a++) {
-            const obj1 = obj[a]
+        // 解密 settings + users/storages/metas/shares（备份时这 5 个数组均被加密）。
+        // 原实现用 Object.values(data) 从 length-4 开始解密，会漏掉 settings
+        // （加密备份恢复后 settings 仍是密文，导致 customize_head/body 等配置失效）。
+        for (const name of [
+          "settings",
+          "users",
+          "storages",
+          "metas",
+          "shares",
+        ] as const) {
+          const arr = (data as any)[name]
+          if (!Array.isArray(arr)) continue
+          for (const obj1 of arr) {
             for (const key in obj1) {
               obj1[key] = decrypt(obj1[key], password(), false, encrypted)
             }
