Hass/xiaozhi-esp32-server
1
0
Fork 0
mirror of https://github.com/xinnan-tech/xiaozhi-esp32-server.git synced 2026-07-23 23:53:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复并发漏洞，获取和设置短信发送间隔时间，不是原子性的，并发请求过来会导致验证有漏洞被通过

Browse Source 
--CaptchaServiceImpl.java 设置获取和设置发现间隔的方法为原子性
This commit is contained in:
剑雨
2025-05-19 10:51:39 +08:00
parent 2761e97c6a
commit c19084b7b4
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/CaptchaServiceImpl.java
+4 -4
View File
@@ -79,7 +79,10 @@ public class CaptchaServiceImpl implements CaptchaService {
public void sendSMSValidateCode(String phone) { public void sendSMSValidateCode(String phone) {
// 检查发送间隔 // 检查发送间隔
String lastSendTimeKey = RedisKeys.getSMSLastSendTimeKey(phone); String lastSendTimeKey = RedisKeys.getSMSLastSendTimeKey(phone);
String lastSendTime = (String) redisUtils.get(lastSendTimeKey); // 获取是否发送过，如果没有设置最后发送时间（60秒）
String lastSendTime = redisUtils
.getKeyOrCreate(lastSendTimeKey,
String.valueOf(System.currentTimeMillis()), 60L);
if (lastSendTime != null) { if (lastSendTime != null) {
long lastSendTimeLong = Long.parseLong(lastSendTime); long lastSendTimeLong = Long.parseLong(lastSendTime);
long currentTime = System.currentTimeMillis(); long currentTime = System.currentTimeMillis();
@@ -114,9 +117,6 @@ public class CaptchaServiceImpl implements CaptchaService {
// 设置验证码 // 设置验证码
setCache(key, validateCodes); setCache(key, validateCodes);
// 设置最后发送时间（60秒）
redisUtils.set(lastSendTimeKey, String.valueOf(System.currentTimeMillis()), 60);
// 更新今日发送次数 // 更新今日发送次数
if (todayCount == 0) { if (todayCount == 0) {
// 如果是今天第一次发送，设置24小时过期 // 如果是今天第一次发送，设置24小时过期