feat: update assessment portal

app/__init__.py

@@ -7,7 +7,7 @@ from flask import Flask, abort, jsonify, request
 
 from .config import Config, DATA_DIR, ensure_dirs
 from .extensions import db, login_manager
-from .models import User
+from .models import AppSetting, User
 from .prediction import FEATURES, load_model
 from .security import csrf_token, validate_csrf_token
 
@@ -95,7 +95,10 @@ def register_app_hooks(app: Flask) -> None:
             "feature_list": FEATURES,
             "now_year": now_year,
             "csrf_token": csrf_token,
-            "allow_registration": app.config["ALLOW_REGISTRATION"],
+            "allow_registration": AppSetting.get_bool(
+                "allow_registration",
+                app.config["ALLOW_REGISTRATION"],
+            ),
         }
 
     @app.errorhandler(413)
@@ -111,6 +114,6 @@ def register_app_hooks(app: Flask) -> None:
             return None
         if validate_csrf_token():
             return None
-        if request.path == "/predict":
+        if request.path == "/predict" or request.headers.get("X-Requested-With") == "XMLHttpRequest":
             return jsonify({"error": "CSRF 校验失败，请刷新页面后重试。"}), 400
         abort(400)