Unauthenticated admin access via path normalization gap

Authentication bypass in the WinterChenS web application through commit 6c79286 allows remote attackers to publish articles via a crafted admin URL. BaseInterceptor.preHandle normalizes request paths but fails to account for semicolon traversal such as /..;/, so a login-prefixed path returns true before the protected admin handler is reached. No account or token is required; the demonstrated request reaches the article-publishing endpoint with administrator-level application access.