mirror of
https://github.com/xinnan-tech/xiaozhi-esp32-server.git
synced 2026-07-22 15:13:55 +08:00
修复并发漏洞,获取和设置短信发送间隔时间,不是原子性的,并发请求过来会导致验证有漏洞被通过
--CaptchaServiceImpl.java 设置获取和设置发现间隔的方法为原子性
This commit is contained in:
+4
-4
@@ -79,7 +79,10 @@ public class CaptchaServiceImpl implements CaptchaService {
|
||||
public void sendSMSValidateCode(String phone) {
|
||||
// 检查发送间隔
|
||||
String lastSendTimeKey = RedisKeys.getSMSLastSendTimeKey(phone);
|
||||
String lastSendTime = (String) redisUtils.get(lastSendTimeKey);
|
||||
// 获取是否发送过,如果没有设置最后发送时间(60秒)
|
||||
String lastSendTime = redisUtils
|
||||
.getKeyOrCreate(lastSendTimeKey,
|
||||
String.valueOf(System.currentTimeMillis()), 60L);
|
||||
if (lastSendTime != null) {
|
||||
long lastSendTimeLong = Long.parseLong(lastSendTime);
|
||||
long currentTime = System.currentTimeMillis();
|
||||
@@ -114,9 +117,6 @@ public class CaptchaServiceImpl implements CaptchaService {
|
||||
// 设置验证码
|
||||
setCache(key, validateCodes);
|
||||
|
||||
// 设置最后发送时间(60秒)
|
||||
redisUtils.set(lastSendTimeKey, String.valueOf(System.currentTimeMillis()), 60);
|
||||
|
||||
// 更新今日发送次数
|
||||
if (todayCount == 0) {
|
||||
// 如果是今天第一次发送,设置24小时过期
|
||||
|
||||
Reference in New Issue
Block a user