From 17192440158c70060e1e84612164fa9ac5c3c887 Mon Sep 17 00:00:00 2001
From: CGD <3030332422@qq.com>
Date: Wed, 30 Apr 2025 18:11:46 +0800
Subject: [PATCH] =?UTF-8?q?update:=E4=BF=AE=E6=94=B9python=E9=83=A8?=
 =?UTF-8?q?=E5=88=86=E7=9A=84=E2=80=9C=E5=8A=A8=E6=80=81=E9=85=8D=E7=BD=AE?=
 =?UTF-8?q?=E6=9B=B4=E6=96=B0=E2=80=9D=E7=9A=84=E9=AA=8C=E8=AF=81=E9=80=BB?=
 =?UTF-8?q?=E8=BE=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 main/xiaozhi-server/core/connection.py        | 11 -----------
 main/xiaozhi-server/core/handle/textHandle.py | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/main/xiaozhi-server/core/connection.py b/main/xiaozhi-server/core/connection.py
index fbd3569e..a8259e34 100644
--- a/main/xiaozhi-server/core/connection.py
+++ b/main/xiaozhi-server/core/connection.py
@@ -222,19 +222,8 @@ class ConnectionHandler:
     async def handle_config_update(self, message):
         """处理配置更新请求"""
         content = message.get("content", {})
-        secret = content.pop("secret", None)
         new_config = content
 
-        # 密钥验证
-        if secret != "43c716ae-37c4-49ba-84ab-2f0fbfcd7115":
-            self.logger.bind(tag=TAG).warning("配置更新请求的密钥不正确")
-            await self.websocket.send(json.dumps({
-                "type": "config_update_response",
-                "status": "error",
-                "message": "密钥不正确"
-            }))
-            return
-
         # 遍历所有支持的配置模块
         updated_modules = []
         for config_model in ["tts", "llm", "vad", "asr", "memory", "intent"]:
diff --git a/main/xiaozhi-server/core/handle/textHandle.py b/main/xiaozhi-server/core/handle/textHandle.py
index a26f5bd9..9afe7b62 100644
--- a/main/xiaozhi-server/core/handle/textHandle.py
+++ b/main/xiaozhi-server/core/handle/textHandle.py
@@ -64,6 +64,22 @@ async def handleTextMessage(conn, message):
             if "states" in msg_json:
                 asyncio.create_task(handleIotStatus(conn, msg_json["states"]))
         elif msg_json["type"] == "server":
+            # 如果配置是从API读取的，则需要验证secret
+            read_config_from_api = conn.config.get("read_config_from_api", False)
+            if not read_config_from_api:
+                return
+            # 获取post请求的secret
+            post_secret = msg_json.get("content", {}).get("secret", "")
+            secret = conn.config["manager-api"].get("secret", "")
+            # 如果secret不匹配，则返回
+            if post_secret != secret:
+                await conn.websocket.send(json.dumps({
+                    "type": "config_update_response",
+                    "status": "error",
+                    "message": "服务器密钥验证失败"
+                }))
+                return
+            # 动态更新配置
             if msg_json["action"] == "update_config":
                 await conn.handle_config_update(msg_json)
     except json.JSONDecodeError: