fix 人机校验

netflix-service/src/main/java/com/cyksj/service/user/BadIntentionOpService.java

@@ -3,7 +3,7 @@ package com.cyksj.service.user;
 import javax.servlet.http.HttpServletRequest;
 
 public interface BadIntentionOpService {
-    void checkHandleBadUserOp(String phone);
+    void checkHandleBadUserOp(String phone, String verifyCode);
 
     void isBadOpLoginPhone(HttpServletRequest request, String phone);
 }

netflix-service/src/main/java/com/cyksj/service/user/impl/BadIntentionOpServiceImpl.java

@@ -1,20 +1,30 @@
 package com.cyksj.service.user.impl;
 
 import cn.hutool.extra.servlet.ServletUtil;
+import cn.hutool.http.HttpUtil;
+import cn.hutool.json.JSONObject;
 import com.cyksj.common.exception.BusinessRuntimeException;
 import com.cyksj.common.util.StringUtil;
 import com.cyksj.redis.RedisService;
 import com.cyksj.service.user.BadIntentionOpService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
 import javax.servlet.http.HttpServletRequest;
+import java.util.HashMap;
+import java.util.Map;
 
 @Service
 @RequiredArgsConstructor
 @Slf4j
 public class BadIntentionOpServiceImpl implements BadIntentionOpService {
+
+    @Value("${smsVerify.apiKey}")
+    String apiKey;
+
     private final RedisService redisService;
 
     private static final int PHONE_CODE_GET_NUM_DAY_LIMIT = 30;
@@ -22,11 +32,26 @@ public class BadIntentionOpServiceImpl implements BadIntentionOpService {
 
     private static final int PHONE_LOGIN_CODE_RETRY = 10;
 
+    private static final String VERIFY_URL =  "https://captcha.luosimao.com/api/site_verify";
+
     @Override
-    public void checkHandleBadUserOp(String phone) {
+    public void checkHandleBadUserOp(String phone, String verifyCode) {
         if ("13662979985".equals(phone)) {
             throw BusinessRuntimeException.getInstance("异常手机号");
         }
+        if (StringUtils.isBlank(verifyCode)) {
+            throw BusinessRuntimeException.getInstance("人机校验不通过");
+        }else {
+            Map<String, Object> parmas = new HashMap<>();
+            parmas.put("api_key", apiKey);
+            parmas.put("response", verifyCode);
+            String post = HttpUtil.post(VERIFY_URL, parmas);
+            JSONObject res = new JSONObject(post);
+            if (!res.getStr("res").equals("success")) {
+                log.error("手机号:{}验证码校验不通过 res:{}", phone, res);
+                throw BusinessRuntimeException.getInstance("人机校验不通过");
+            }
+        }
         String dayKey = RedisService.key.PHONE_CODE_USER_NUM_KEY_DAY.getName() + phone;
         if (redisService.hasKey(RedisService.key.PHONE_CODE_BALCK_KEY.getName() + phone)) {
             throw BusinessRuntimeException.getInstance("异常手机号");
@@ -45,11 +70,13 @@ public class BadIntentionOpServiceImpl implements BadIntentionOpService {
             return;
         }
         redisService.set(dayKey, 1, RedisService.key.PHONE_CODE_USER_NUM_KEY_DAY.getTimeout());
+
     }
 
     @Override
     public void isBadOpLoginPhone(HttpServletRequest request, String phone) {
         String ip = StringUtil.getInternalAddressByIP(ServletUtil.getClientIP(request));
+        log.info("--------------校验ip 是否黑名单------- ip:{}", ip);
         String blackIpKey = RedisService.key.BALCK_USER_IP_KEY + ip;
         if (redisService.hasKey(blackIpKey)) {
             throw BusinessRuntimeException.getInstance("检测到您操作异常，请联系客服");

netflix-web/src/main/java/com/cyksj/web/controller/user/AuthorizationController.java

@@ -365,7 +365,7 @@ public class AuthorizationController {
      */
     @GetMapping("/get/phone/code")
     @NoSubmit
-    public Result<String> getPhoneCode(String phone, Integer digit, @RequestParam(defaultValue = "0") Boolean isFree, Integer cid) throws Exception {
+    public Result<String> getPhoneCode(String phone, Integer digit, @RequestParam(defaultValue = "0") Boolean isFree, Integer cid, String verifyCode) throws Exception {
         if (cid == null) cid = 86;
         if (StrUtil.isBlank(phone) || (86 == cid && !Validator.isMobile(phone))) {
             throw BusinessRuntimeException.getInstance("请输入正确的手机号");
@@ -379,7 +379,7 @@ public class AuthorizationController {
             throw BusinessRuntimeException.getInstance("短信验证码未失效");
         }
         //是否是恶意用户
-        badIntentionOpService.checkHandleBadUserOp(phone);
+        badIntentionOpService.checkHandleBadUserOp(phone, verifyCode);
         String code = StringUtil.getRandomCodeStr(digit);
         Boolean isFlag;
         if (!isFree) {

netflix-web/src/main/resources/application-pre.yml

@@ -178,4 +178,7 @@ advertisementwxapp:
   notify: https://xue.niupian.com.cn/8081/api/
 
 chatgpt:
-  domain: "https://gpt.claudeplus.com.cn"
+  domain: "https://gpt.claudeplus.com.cn"
+
+smsVerify:
+  apikey: bc0737b7339ab0f275f954a161fdb313