update:修改python部分的“动态配置更新”的验证逻辑

main/xiaozhi-server/core/handle/textHandle.py

@@ -64,6 +64,22 @@ async def handleTextMessage(conn, message):
             if "states" in msg_json:
                 asyncio.create_task(handleIotStatus(conn, msg_json["states"]))
         elif msg_json["type"] == "server":
+            # 如果配置是从API读取的，则需要验证secret
+            read_config_from_api = conn.config.get("read_config_from_api", False)
+            if not read_config_from_api:
+                return
+            # 获取post请求的secret
+            post_secret = msg_json.get("content", {}).get("secret", "")
+            secret = conn.config["manager-api"].get("secret", "")
+            # 如果secret不匹配，则返回
+            if post_secret != secret:
+                await conn.websocket.send(json.dumps({
+                    "type": "config_update_response",
+                    "status": "error",
+                    "message": "服务器密钥验证失败"
+                }))
+                return
+            # 动态更新配置
             if msg_json["action"] == "update_config":
                 await conn.handle_config_update(msg_json)
     except json.JSONDecodeError: