fix: bug scan - fix 10 bugs across backend (search field names, missing import, file handle leak, None guard, race condition, hardcoded secrets)

article/views.py

@@ -417,8 +417,9 @@ class ArticleLikeToggleView(APIView):
         like, created = ArticleLike.objects.get_or_create(user=request.user, article=article)
         if not created:
             like.delete()
-            article.likes = max(0, article.likes - 1)
-            article.save(update_fields=['likes'])
+            Article.objects.filter(pk=pk).update(likes=F("likes") - 1)
+            article.refresh_from_db()
+            article.likes = max(0, article.likes)
             return create_standardized_response(
                 data={'liked': False, 'likes_count': article.likes},
                 code=ResponseCode.SUCCESS
@@ -498,8 +499,9 @@ class ArticleCommentLikeToggleView(APIView):
         like, created = ArticleCommentLike.objects.get_or_create(user=request.user, comment=comment)
         if not created:
             like.delete()
-            comment.likes = max(0, comment.likes - 1)
-            comment.save(update_fields=['likes'])
+            ArticleComment.objects.filter(pk=pk).update(likes=F("likes") - 1)
+            comment.refresh_from_db()
+            comment.likes = max(0, comment.likes)
             return create_standardized_response(
                 data={'liked': False, 'likes_count': comment.likes},
                 code=ResponseCode.SUCCESS
@@ -626,4 +628,4 @@ class ArticleToggleTopView(APIView):
             data={'is_top': article.is_top},
             code=ResponseCode.SUCCESS,
             message='置顶状态已更新'
-        )
+        )