diff --git a/apps/server/src/controller/user.controller.ts b/apps/server/src/controller/user.controller.ts index 863ce55..b4107e4 100644 --- a/apps/server/src/controller/user.controller.ts +++ b/apps/server/src/controller/user.controller.ts @@ -14,6 +14,7 @@ import { createToken, decodeToken } from '../util/encrypt'; import { SmsService } from '../service/sms.service'; import { SmsDTO } from '../dto/sms.dto'; import { RedisService } from '@midwayjs/redis'; +import * as CryptoJS from 'crypto-js'; @Controller('/user') export class UserController { @@ -100,7 +101,10 @@ export class UserController { @Post('/web/sms') async verifyCode(@Body() params: SmsDTO) { try { - const { phoneNumber: phoneNumbers } = params; + const { phoneNumber: phoneNumbers, sign } = params; + const decrypted = CryptoJS.AES.decrypt(sign, phoneNumbers); + const hackAction = decrypted.toString(CryptoJS.enc.Utf8) !== phoneNumbers; + if (hackAction) return { code: BizCode.ERROR, msg: 'fuck u' }; const code = Math.floor(Math.random() * 9000 + 1000); await this.redisService.set('' + phoneNumbers, code, 'EX', 60); await this.smsService.send({ code, phoneNumbers }); diff --git a/apps/server/src/dto/sms.dto.ts b/apps/server/src/dto/sms.dto.ts index a65436f..f6b7be7 100644 --- a/apps/server/src/dto/sms.dto.ts +++ b/apps/server/src/dto/sms.dto.ts @@ -4,5 +4,7 @@ export class SmsDTO { @Rule( RuleType.string().required().length(11).error(new Error('手机号格式错误')) ) - phoneNumber?: string | number; + phoneNumber?: string; + @Rule(RuleType.string().required()) + sign?: string; } diff --git a/apps/web/src/api/index.ts b/apps/web/src/api/index.ts index 4f27c15..a7d21a3 100644 --- a/apps/web/src/api/index.ts +++ b/apps/web/src/api/index.ts @@ -1,5 +1,6 @@ import { ILoginRequest } from "./dto"; import R from "./axios"; +import * as CryptoJS from "crypto-js"; export const getCourseList = () => R.post("/api/course/select/all"); @@ -11,5 +12,8 @@ export const userLogin = (p: ILoginRequest) => export const userState = () => R.get("/api/user/web/state"); -export const sms = (phoneNumber: string | number) => - R.post("/api/user/web/sms", { phoneNumber }); +export const sms = (phoneNumber: string | number) => { + const payload = "" + phoneNumber; + const sign = "" + CryptoJS.AES.encrypt(payload, payload); + return R.post("/api/user/web/sms", { sign, phoneNumber }); +}; diff --git a/apps/web/stats.html b/apps/web/stats.html index b3d409e..1e62447 100644 --- a/apps/web/stats.html +++ b/apps/web/stats.html @@ -6157,7 +6157,7 @@ var drawChart = (function (exports) {