Merge branch 'dev' into dev-sxb

.gitignore

@@ -2,4 +2,5 @@ public/
 .idea/
 .env
 runtime/
-nohup.out
+nohup.out
+*.pem

app/common/middleware/RateLimitMiddleware.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace app\common\middleware;
+
+use think\facade\Cache;
+use think\Response;
+
+class RateLimitMiddleware
+{
+    // 频率限制配置（单位：秒）
+    protected $rules = [
+        'ip' => ['limit' => 10, 'window' => 60],    // 每IP每分钟10次
+        'mobile' => ['limit' => 5, 'window' => 3600] // 每手机号每小时5次
+    ];
+
+    public function handle($request, \Closure $next)
+    {
+        $mobile = $request->param('mobile');
+        $ip = $request->ip();
+
+        // IP频率检查
+        $ipKey = "rate:ip:{$ip}";
+        if (!$this->checkRate($ipKey, $this->rules['ip'])) {
+            return $this->tooManyRequests('IP请求过于频繁');
+        }
+
+        // 手机号频率检查
+        $mobileKey = "rate:mobile:{$mobile}";
+        if (!$this->checkRate($mobileKey, $this->rules['mobile'])) {
+            return $this->tooManyRequests('该手机号请求过于频繁');
+        }
+
+        return $next($request);
+    }
+
+    protected function checkRate(string $key, array $rule): bool
+    {
+        $count = Cache::get($key, 0);
+
+        if ($count >= $rule['limit']) {
+            return false;
+        }
+
+        Cache::inc($key);
+        if ($count === 0) {
+            Cache::expire($key, $rule['window']);
+        }
+
+        return true;
+    }
+
+    protected function tooManyRequests(string $message): Response
+    {
+        return json([
+            'code' => 429,
+            'msg' => $message,
+            'data' => null
+        ])->code(429);
+    }
+}

app/common/middleware/SignatureMiddleware.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace app\common\middleware;
+
+use think\facade\Cache;
+use think\facade\Log;
+use think\Request;
+use think\Response;
+
+class SignatureMiddleware
+{
+    public function handle(Request $request, \Closure $next)
+    {
+        // 获取必要参数
+        $essential = $request->only(['timestamp', 'nonce', 'signature']);
+
+        // 验证必要参数
+        if (count(array_filter($essential)) !== 3) {
+            return $this->errorResponse('参数不完整', 400);
+        }
+
+        // 验证时间戳（5分钟内有效）
+        if (abs(time() - (int)$essential['timestamp']) > 300) {
+            return $this->errorResponse('请求已过期', 400);
+        }
+
+        // 验证nonce唯一性
+        $nonceKey = 'nonce:' . $essential['nonce'];
+        if (Cache::has($nonceKey)) {
+            return $this->errorResponse('重复请求', 400);
+        }
+
+        // 构造签名数据（与前端完全一致）
+        $signData = $request->param();
+        unset($signData['signature']);
+
+        // 按键名排序
+        ksort($signData);
+
+        // 生成签名字符串（与前端相同格式）
+        $signContent = '';
+        foreach ($signData as $key => $value) {
+            $signContent .= "{$key}={$value}&";
+        }
+        $signContent = rtrim($signContent, '&');
+
+        // 记录原始签名内容（用于调试）
+        Log::debug("Sign Content: " . $signContent);
+
+        // 获取公钥
+        $publicKey = openssl_pkey_get_public(
+            file_get_contents(env('RSA_PUBLIC_KEY_PATH'))
+        );
+
+        if (!$publicKey) {
+            Log::error("公钥加载失败");
+            return $this->errorResponse('系统错误', 500);
+        }
+
+        // 计算签名的MD5值（与前端一致）
+        $md5Hash = md5($signContent);
+        Log::debug("MD5 Hash: " . $md5Hash);
+
+        // 解码前端签名（前端使用公钥加密）
+        $signature = base64_decode($essential['signature']);
+
+        // 使用公钥解密签名
+        $decrypted = '';
+        $success = openssl_public_decrypt($signature, $decrypted, $publicKey);
+
+        if (!$success) {
+            Log::error("签名解密失败: " . openssl_error_string());
+            return $this->errorResponse('签名验证失败', 403);
+        }
+
+        Log::debug("解密结果: " . $decrypted);
+
+        // 比较解密后的值与MD5哈希
+        if ($decrypted !== $md5Hash) {
+            Log::error("签名验证失败: 期望 {$md5Hash}, 实际 {$decrypted}");
+            return $this->errorResponse('签名验证失败', 403);
+        }
+
+        // 记录已使用的nonce（5分钟过期）
+        Cache::set($nonceKey, 1, 300);
+
+        return $next($request);
+    }
+
+    private function errorResponse(string $message, int $code): Response
+    {
+        return json([
+            'code' => $code,
+            'msg' => $message,
+            'data' => null
+        ])->code($code);
+    }
+}

app/common/repositories/user/UserRepository.php

@@ -1085,6 +1085,7 @@ class UserRepository extends BaseRepository
                     'commission_type' => $commission_type,
                     'mark' => empty($mark) ?'管理员调整收益':$mark ,
                     'create_time' => date('Y-m-d H:i:s'),
+                    'take_time' => time()
                 ];
                 if($commission_type != 5){
                     $isert_data['balance'] = $user['brokerage_price'];

app/controller/api/Auth.php

@@ -48,12 +48,14 @@ use think\App;
 use think\db\exception\DataNotFoundException;
 use think\db\exception\DbException;
 use think\db\exception\ModelNotFoundException;
+use think\Env;
 use think\Exception;
 use think\exception\HttpResponseException;
 use think\facade\Cache;
 use think\facade\Db;
 use think\facade\Log;
 use think\Filesystem;
+use think\Response;
 
 /**
  * Class Auth
@@ -1322,6 +1324,41 @@ class Auth extends BaseController
         return $res;
     }
 
+
+    /**
+     * 获取验签公钥
+     * @return Response
+     */
+    public function getPublicKey(): Response
+    {
+        $path = env('RSA_PUBLIC_KEY_PATH');
+
+        if (empty($path)) {
+            return json([
+                'code' => 500,
+                'msg' => '公钥路径未配置',
+                'data' => null
+            ]);
+        }
+
+        if (!file_exists($path)) {
+            return json([
+                'code' => 500,
+                'msg' => '公钥文件不存在: ' . $path,
+                'data' => null
+            ]);
+        }
+
+        $publicKey = file_get_contents($path);
+        return json([
+            'code' => 200,
+            'msg' => 'success',
+            'data' => [
+                'public_key' => $publicKey
+            ]
+        ]);
+    }
+
     public function verify(UserAuthValidate $validate)
     {
         $data = $this->request->params(['phone', 'code', 'key',"type"]);
@@ -1464,30 +1501,32 @@ class Auth extends BaseController
 
         $domain = $this->request->domain();
 
-        if (!$this->checkSmsCode($data['phone'], $data['sms_code'])) {
-            if (($data['sms_code'] != '6865')) {
-                $uid= Db::name('user')->where("phone", $data["phone"])->value('uid');
-                if($uid){
-                    $allTeams = Db::name('user_zero_line')->field('team_uid,custom_code')->select()->toArray();
-                    $hasTeam = false;
-                    foreach ($allTeams as $team) {
-                        $sql = "select getUserLevelId({$team['team_uid']}) as uids";
-                        $spread_user_list = Db::query($sql);
-                        $member_uids = explode(",", trim($spread_user_list[0]['uids'], '$,'));
-                        if (in_array($uid, $member_uids)){
-                            $hasTeam = true;
-                            if ($data['sms_code'] != $team['custom_code']) {
-                                return app('json')->fail('验证码不正确');
-                            }
-                            break;
+        //如果手机验证码错误并且验证码不是6865,进入查验团队验证码环节
+        if (!$this->checkSmsCode($data['phone'], $data['sms_code']) && $data['sms_code'] !== '6865') {
+            $uid= Db::name('user')->where("phone", $data["phone"])->value('uid');//通过输入的手机号查询用户的uid
+            if($uid){
+                $allTeams = Db::name('user_zero_line')->field('team_uid,custom_code')->select()->toArray();//去user_zero_line表查询团队team_uid和团队自定义的验证码
+                $hasTeam = false;  //先将用户设成不为团队成员
+                foreach ($allTeams as $team) {
+                    $cacheKey = 'team_members_' . $team['team_uid'];
+                    $member_uids = Cache::get($cacheKey);
+                    $sql = "select getUserLevelId({$team['team_uid']}) as uids";  //查询所有团队下成员的uid
+                    $spread_user_list = Db::query($sql);
+                    $member_uids = explode(",", trim($spread_user_list[0]['uids'], '$,'));
+                    Cache::set($cacheKey, $member_uids, 300);  //结果缓存5分钟
+                    if (in_array($uid, $member_uids)){
+                        $hasTeam = true;   //若用户属于团队,将其设为团队成员
+                        if ($data['sms_code'] != $team['custom_code']) {
+                            return app('json')->fail('验证码不正确');  //如果与用户所属团队的验证码不一致,返回验证码不正确
                         }
+                        break;
                     }
-                    if (!$hasTeam) {
-                        return app('json')->fail('验证码不正确');
-                    }
-                } else {
+                }
+                if (!$hasTeam) {
                     return app('json')->fail('验证码不正确');
                 }
+                } else {
+                return app('json')->fail('验证码不正确');
             }
         }
 

app/controller/api/Notify.php

@@ -506,7 +506,7 @@ class Notify
 
 
                                         //Db::name('user')->where('uid',$spread_data['uid'])->update(['contribute'=> $gx_jf,'score'=> $gx_jf,'brokerage_price'=> $yj_amount,'fugou'=>$fgj_amount]);
-                                        $this->con_log($spread_data['uid'],round($pv * 0.3,2),$store_order_data['order_id'],0,"推广会员专区商品赠送贡献值",1);
+                                        $this->con_log($spread_data['uid'],round($gx_jf * 0.3,2),$store_order_data['order_id'],0,"推广会员专区商品赠送贡献值",1);
                                         $this->score_log($spread_data['uid'],bcmul($gx_jf, $rate, 2),$store_order_data['order_id'],0,"推广会员专区商品赠送积分",1);
                                         //推广佣金
                                         $this->bill_user_log($spread_data['uid'],$yj_amount_90,$store_order_data['order_id'],3,$store_order_data['order_sn'],'推广获得佣金',$store_order_data['mer_id']);

route/api.php

@@ -6,6 +6,8 @@
  * Copyright (c) http://crmeb.net
  */
 
+use app\common\middleware\RateLimitMiddleware;
+use app\common\middleware\SignatureMiddleware;
 use think\facade\Route;
 Route::miss(function () {
     $DB = DIRECTORY_SEPARATOR;
@@ -970,8 +972,16 @@ Route::group('api/', function () {
     Route::get('auth/wechat', 'api.Auth/auth');
     //小程序授权
     Route::post('auth/mp', 'api.Auth/mpAuth');
+
+    // 获取验签公钥
+    // openssl genrsa -out request_private_key.pem 2048
+    // openssl rsa -in request_private_key.pem -pubout -out request_public_key.pem
+    Route::get('auth/getPublicKey', 'api.Auth/getPublicKey');
+
     //验证码
-    Route::post('auth/verify', 'api.Auth/verify');
+    Route::post('auth/verify', 'api.Auth/verify')
+        ->middleware(SignatureMiddleware::class)
+        ->middleware(RateLimitMiddleware::class);
     //微信配置
     Route::get('wechat/config', 'api.Wechat/jsConfig');
     //图片验证码