v12: PHP密码验证安全修复 + 任务间延迟6-14秒随机

安全修复:
- sync.php: 删除verify_web_password端点,禁止PHP自验证密码
- core.php: validateWebAccess大额交易密码验证改为检查web_login_verified(Java验证结果)
- 密码验证强制走web_login_request流程(Java端handleWebPasswordVerify)

锁库优化:
- 任务间随机延迟从10-12秒改为6-14秒(8秒变异范围)
- 增大随机性,避免周期性锁争用
This commit is contained in:
2026-06-25 14:13:31 +08:00
parent 6e24546a6c
commit 6d569fed23
+32 -32
View File
@@ -836,24 +836,24 @@ public class WebManager {
plugin.getLogger().info("[Web通信] 开始首次全量同步(通过DB队列串行化)...");
// 登录相关操作高优先级
submitDbTask("首次-syncUserRegistrations", () -> syncUserRegistrations());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("首次-pushWebLoginCredentials", () -> pushWebLoginCredentials());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
// 普通同步操作低优先级(每个任务间随机间隔2-4秒,避免PHP端DB锁)
submitNormalDbTask("首次-syncOnlinePlayers", () -> syncOnlinePlayers());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-syncShopData", () -> syncShopData());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-syncBondBalances", () -> syncBondBalances());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-syncBondTransactions", () -> syncBondTransactions());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-syncAllPlayerIps", () -> syncAllPlayerIps());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-syncServiceProviders", () -> syncServiceProviders());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-syncLandData", () -> syncLandData());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("首次-pollAdminChanges", () -> pollAdminChanges());
initialSyncComplete = true; // 首次全量同步提交完成,允许轮询器启动
}
@@ -1225,19 +1225,19 @@ public class WebManager {
plugin.getLogger().info("[Web通信] 收到即时同步请求: " + players.toString());
// 通过DB队列串行化执行(每个任务间错开800ms)
submitDbTask("即时-syncOnlinePlayers", () -> syncOnlinePlayers());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("即时-pushWebLoginCredentials", () -> pushWebLoginCredentials());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("即时-syncUserRegistrations", () -> syncUserRegistrations());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("即时-pullPendingTransactions", () -> pullPendingTransactions());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("即时-pullShopStock", () -> pullShopStock());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("即时-pullBondChanges", () -> pullBondChanges());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("即时-syncAllPlayerIps", () -> syncAllPlayerIps());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("即时-syncServiceProviders", () -> syncServiceProviders());
}
}
@@ -1260,17 +1260,17 @@ public class WebManager {
lastOnlineCheckTime = System.currentTimeMillis();
// 通过DB队列串行化执行最后一轮同步(每个任务间随机间隔2-4秒,避免与定时轮询冲突)
submitDbTask("末轮-syncOnlinePlayers", () -> syncOnlinePlayers());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("末轮-pushWebLoginCredentials", () -> pushWebLoginCredentials());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("末轮-syncUserRegistrations", () -> syncUserRegistrations());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("末轮-syncBondTransactions", () -> syncBondTransactions());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("末轮-pullPendingTransactions", () -> pullPendingTransactions());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("末轮-pullShopStock", () -> pullShopStock());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("末轮-pullBondChanges", () -> pullBondChanges());
plugin.getLogger().info("[Web通信] 检测到全员下线超60秒,执行最后一轮同步(通过DB队列),调度器继续运行(玩家上线自动恢复)");
plugin.getLogger().warning("\n" +
@@ -1321,28 +1321,28 @@ public class WebManager {
// 登录/注册相关(始终执行,随机间隔2-4秒避免PHP端DB锁)
submitDbTask("周期-pushWebLoginCredentials", () -> pushWebLoginCredentials());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("周期-syncUserRegistrations", () -> syncUserRegistrations());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
if (online) {
// 在线:执行全量同步(每个任务随机间隔2-4秒)
submitDbTask("周期-syncOnlinePlayers", () -> syncOnlinePlayers());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitDbTask("周期-syncBondTransactions", () -> syncBondTransactions());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-pullPendingTransactions", () -> pullPendingTransactions());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-pullShopStock", () -> pullShopStock());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-pullBondChanges", () -> pullBondChanges());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-syncAllPlayerIps", () -> syncAllPlayerIps());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-syncServiceProviders", () -> syncServiceProviders());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-syncLandData", () -> syncLandData());
try { Thread.sleep(10000 + (long)(Math.random() * 2000)); } catch (InterruptedException ignored) {}
try { Thread.sleep(6000 + (long)(Math.random() * 8000)); } catch (InterruptedException ignored) {}
submitNormalDbTask("周期-pollAdminChanges", () -> pollAdminChanges());
} else {
// ★ 不在线:跳过非必要同步任务