fix(security): 移除 core.User 默认密码哈希后门，异常堆栈改 logging 落盘

- UserPassword 默认值改为空串（防默认口令，须经注册/重置流程设置）
- exception_handler print→logging（日志可审计）
- ip_filter 默认 disabled 语义注释（生产需显式配置并挂载）

gvsds/apps/core/models.py

@@ -125,7 +125,7 @@ class User(QModel):
 
     UserUUID = UUIDField(primary_key=True, verbose_name='用户UUID')
     UserName = models.CharField(max_length=256, unique=True, verbose_name='用户名')
-    UserPassword = models.CharField(max_length=60, default='$2b$12$f4aPWFkTnL60G28TANMEHef7d3Qzp2/AycY0gVK30ufgRrahwygEGS', verbose_name='密码')
+    UserPassword = models.CharField(max_length=60, default='', verbose_name='密码')  # 无默认密码（防默认口令后门），须经注册/重置流程设置
     UserPositionStatus = models.SmallIntegerField(default=0, verbose_name='职位状态')
     UserPersonalSignature = models.CharField(max_length=1024, default='尚未及提笔自叙，浅墨先勾鹤影', verbose_name='个人签名')
     UserEmail = models.CharField(max_length=256, default='', verbose_name='邮箱')

gvsds/exception_handler.py

@@ -1,16 +1,17 @@
-import traceback
+import logging
 from rest_framework.views import exception_handler
 from rest_framework.response import Response
 from rest_framework import status
 from django.conf import settings
 
+logger = logging.getLogger(__name__)
+
 
 def custom_exception_handler(exc, context):
-    # 始终打印异常堆栈，便于排查问题
+    # 始终记录异常堆栈（走 logging，日志落盘可审计，替代 print）
     view = context.get('view', None) if context else None
     view_name = view.__class__.__name__ if view else 'Unknown'
-    print(f"[EXCEPTION] {view_name}: {exc}")
-    traceback.print_exc()
+    logger.error('[EXCEPTION] %s: %s', view_name, exc, exc_info=True)
 
     response = exception_handler(exc, context)
 

gvsds/ip_filter.py

@@ -66,6 +66,8 @@ class IPFilterMiddleware:
 
     def __init__(self, get_response):
         self.get_response = get_response
+        # 默认 disabled（安全默认值权衡：避免漏配即拒绝服务）。
+        # 生产环境应显式配置 MODE=production/whitelist 并挂载中间件（见 app.ini [middleware]）。
         self.mode = _app_get('ip_filter', 'MODE', fallback='disabled').lower()
         self.whitelist = _ParseIPList(_app_getlist('ip_filter', 'WHITELIST', fallback=[]))
         self.blacklist = _ParseIPList(_app_getlist('ip_filter', 'BLACKLIST', fallback=[]))