ahdoawhfo/netdisk-fast-download
1
0
Fork 0
mirror of https://github.com/qaiu/netdisk-fast-download.git synced 2026-08-26 11:32:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: 123网盘捐赠账号无需临时auth参数即可自动生效，修复token前缀与脏数据问题

Browse Source 
- 前端: getCurrentPanType() 补全123网盘域名匹配正则(share.123pan.cn等子域名)
- 前端: 临时认证弹窗补充123云盘(YE)选项及提示文案
- 前端: submitDonateAccount() 按当前authType只提交相关字段，避免切换认证方式后
  残留的用户名/密码脏数据被一并提交
- 后端: URLParamUtil.addParam() 不再无条件用静态yml配置覆盖已生效的临时认证/
  自动捐赠账号回退(增加 __TEMP_AUTH_ADDED 判断)
- 后端: CacheServiceImpl 新增 applyDonatedAccountFallback()，请求未带auth参数
  且无静态配置时自动从捐赠账号池随机取一个可用账号使用，并在解析失败时记录/
  自动禁用失败账号
- 后端: DbServiceImpl.getRandomDonatedAccount() 对非password类型账号强制丢弃
  历史遗留的username/password字段，避免被误当账号密码登录
- 解析器: Ye2Tool 清理token/authorization前缀中的"Bearer "，避免拼接成
  'Bearer Bearer xxx' 导致123接口返回 tokenstring should not contain bearer

已通过本地实测验证: 捐赠123账号后，不带auth参数直接请求
/json/parser?url=https://1815268665.share.123pan.cn/123pan/iaKtVv-r4aCd
可正常返回200及直链
This commit is contained in:
q
2026-07-18 23:21:56 +08:00
parent 5e20ed5050
commit 675d930f86
5 changed files with 211 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web-service/src/main/java/cn/qaiu/lz/common/util/URLParamUtil.java
+20 -14
View File
@@ -100,21 +100,27 @@ public class URLParamUtil {
}
}
if (localMap.containsKey(ConfigConstant.AUTHS)) {
JsonObject auths = (JsonObject) localMap.get(ConfigConstant.AUTHS);
if (auths.containsKey(type)) {
// 需要处理引号
MultiMap entries = MultiMap.caseInsensitiveMultiMap();
JsonObject jsonObject = auths.getJsonObject(type);
if (jsonObject != null) {
jsonObject.forEach(entity -> {
if (entity == null || entity.getValue() == null) {
return;
}
entries.set(entity.getKey(), entity.getValue().toString());
});
}
// 如果本次请求已经通过 auth 临时参数（个人配置/捐赠账号）设置过认证信息，
// 则不要再用后台 app-dev.yml 的静态配置覆盖，否则临时认证会被静默清空/替换为空配置。
boolean tempAuthAdded = Boolean.TRUE.equals(
parserCreate.getShareLinkInfo().getOtherParam().get("__TEMP_AUTH_ADDED"));
if (!tempAuthAdded) {
JsonObject auths = (JsonObject) localMap.get(ConfigConstant.AUTHS);
if (auths.containsKey(type)) {
// 需要处理引号
MultiMap entries = MultiMap.caseInsensitiveMultiMap();
JsonObject jsonObject = auths.getJsonObject(type);
if (jsonObject != null) {
jsonObject.forEach(entity -> {
if (entity == null || entity.getValue() == null) {
return;
}
entries.set(entity.getKey(), entity.getValue().toString());
});
}
parserCreate.getShareLinkInfo().getOtherParam().put(ConfigConstant.AUTHS, entries);
parserCreate.getShareLinkInfo().getOtherParam().put(ConfigConstant.AUTHS, entries);
}
}
}
web-service/src/main/java/cn/qaiu/lz/web/service/impl/CacheServiceImpl.java
+139 -4
View File
@@ -8,15 +8,22 @@ import cn.qaiu.lz.common.cache.CacheTotalField;
import cn.qaiu.lz.common.util.URLParamUtil;
import cn.qaiu.lz.web.model.CacheLinkInfo;
import cn.qaiu.lz.web.service.CacheService;
import cn.qaiu.lz.web.service.DbService;
import cn.qaiu.parser.IPanTool;
import cn.qaiu.parser.ParserCreate;
import cn.qaiu.parser.clientlink.ClientLinkGeneratorFactory;
import cn.qaiu.parser.clientlink.ClientLinkType;
import cn.qaiu.vx.core.annotaions.Service;
import cn.qaiu.vx.core.util.AsyncServiceUtil;
import cn.qaiu.vx.core.util.ConfigConstant;
import cn.qaiu.vx.core.util.VertxHolder;
import io.vertx.core.Future;
import io.vertx.core.MultiMap;
import io.vertx.core.Promise;
import io.vertx.core.json.JsonObject;
import io.vertx.core.shareddata.LocalMap;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.time.DateFormatUtils;
import java.util.Date;
@@ -28,8 +35,11 @@ import java.util.Map;
public class CacheServiceImpl implements CacheService {
private static final String SKIP_CLIENT_LINKS = "_skipClientLinks";
private static final String TEMP_AUTH_ADDED = "__TEMP_AUTH_ADDED";
private static final String DONATED_ACCOUNT_TOKEN = "__AUTO_DONATED_ACCOUNT_TOKEN";
private final CacheManager cacheManager = new CacheManager();
private final DbService dbService = AsyncServiceUtil.getAsyncServiceInstance(DbService.class);
static {
// 服务类加载时注册缓存定时清理任务
@@ -71,7 +81,9 @@ public class CacheServiceImpl implements CacheService {
promise.fail(cause);
return;
}
IPanTool.closeAfter(tool, tool::parse).onSuccess(redirectUrl -> {
IPanTool.closeAfter(tool, tool::parse).onFailure(err -> {
recordAutoDonatedFailureIfNeeded(shareLinkInfo, err);
}).onSuccess(redirectUrl -> {
// 使用 effectiveCacheDuration
long expires = System.currentTimeMillis() + effectiveCacheDuration * 60 * 1000L;
result.setDirectLink(redirectUrl);
@@ -141,6 +153,124 @@ public class CacheServiceImpl implements CacheService {
return DateFormatUtils.format(new Date(ts), "yyyy-MM-dd HH:mm:ss");
}
/**
* 当本次请求没有携带临时认证参数（auth=xxx），且该网盘类型在 app-dev.yml 中也没有配置可用的
* 静态账号密码/token 时，自动从捐赠账号池中随机挑选一个可用账号使用，
* 这样捐赠者捐赠账号后，普通请求（不带 auth 参数）也能直接受益，无需前端额外拼接参数。
*/
private Future<Void> applyDonatedAccountFallback(ParserCreate parserCreate) {
ShareLinkInfo shareLinkInfo = parserCreate.getShareLinkInfo();
Map<String, Object> otherParam = shareLinkInfo.getOtherParam();
if (Boolean.TRUE.equals(otherParam.get(TEMP_AUTH_ADDED))) {
// 请求已经携带了个人配置/捐赠账号的临时认证参数，无需再自动回退
return Future.succeededFuture();
}
String type = shareLinkInfo.getType();
if (StringUtils.isBlank(type) || hasUsableStaticAuthConfig(type)) {
return Future.succeededFuture();
}
return dbService.getRandomDonatedAccount(type.toUpperCase())
.compose(res -> {
if (!Integer.valueOf(200).equals(res.getInteger("code"))) {
return Future.succeededFuture();
}
JsonObject data = res.getJsonObject("data");
if (data == null || data.isEmpty()) {
return Future.succeededFuture();
}
String username = data.getString("username");
String password = data.getString("password");
String token = data.getString("token");
if (StringUtils.isBlank(username) && StringUtils.isBlank(password) && StringUtils.isBlank(token)) {
return Future.succeededFuture();
}
MultiMap tempAuth = MultiMap.caseInsensitiveMultiMap();
if (StringUtils.isNotBlank(username)) {
tempAuth.set("username", username);
}
if (StringUtils.isNotBlank(password)) {
tempAuth.set("password", password);
}
if (StringUtils.isNotBlank(token)) {
tempAuth.set("token", token);
}
otherParam.put(ConfigConstant.AUTHS, tempAuth);
otherParam.put(TEMP_AUTH_ADDED, true);
String donatedAccountToken = data.getString("donatedAccountToken");
if (StringUtils.isNotBlank(donatedAccountToken)) {
otherParam.put(DONATED_ACCOUNT_TOKEN, donatedAccountToken);
}
log.debug("已自动应用捐赠账号: type={}", type);
return Future.<Void>succeededFuture();
})
.recover(err -> {
log.warn("自动获取捐赠账号失败: type={}", type, err);
return Future.succeededFuture();
});
}
/**
* 检查 app-dev.yml 中该网盘类型是否已配置了可用的静态认证信息（非空的 username/password/token/authorization 等）。
* 如果已配置，则不需要再自动回退到捐赠账号池。
*/
private boolean hasUsableStaticAuthConfig(String type) {
LocalMap<Object, Object> localMap = VertxHolder.getVertxInstance().sharedData()
.getLocalMap(ConfigConstant.LOCAL);
if (!localMap.containsKey(ConfigConstant.AUTHS)) {
return false;
}
JsonObject auths = (JsonObject) localMap.get(ConfigConstant.AUTHS);
JsonObject cfg = auths.getJsonObject(type);
if (cfg == null) {
return false;
}
for (String key : cfg.fieldNames()) {
Object value = cfg.getValue(key);
if (value != null && StringUtils.isNotBlank(value.toString())) {
return true;
}
}
return false;
}
/**
* 自动回退使用的捐赠账号解析失败时，记录一次失败次数（达到阈值后台账号会被自动禁用）。
*/
private void recordAutoDonatedFailureIfNeeded(ShareLinkInfo shareLinkInfo, Throwable cause) {
Object tokenObj = shareLinkInfo.getOtherParam().get(DONATED_ACCOUNT_TOKEN);
if (!(tokenObj instanceof String) || StringUtils.isBlank((String) tokenObj)) {
return;
}
if (!isLikelyAuthFailure(cause)) {
return;
}
dbService.recordDonatedAccountFailureByToken((String) tokenObj)
.onFailure(e -> log.warn("记录自动捐赠账号失败次数失败", e));
}
private boolean isLikelyAuthFailure(Throwable cause) {
if (cause == null) {
return false;
}
String msg = cause.getMessage();
if (msg == null || msg.isBlank()) {
return false;
}
String lower = msg.toLowerCase();
return lower.contains("auth")
|| lower.contains("token")
|| lower.contains("cookie")
|| lower.contains("password")
|| lower.contains("credential")
|| lower.contains("401")
|| lower.contains("403")
|| lower.contains("unauthorized")
|| lower.contains("forbidden")
|| lower.contains("expired")
|| lower.contains("登录")
|| lower.contains("认证");
}
private boolean shouldGenerateClientLinks(ShareLinkInfo shareLinkInfo) {
if (shareLinkInfo == null || shareLinkInfo.getOtherParam() == null) {
return true;
@@ -279,7 +409,10 @@ public class CacheServiceImpl implements CacheService {
return Future.failedFuture(e);
}
parserCreate.getShareLinkInfo().getOtherParam().putAll(otherParam.getMap());
return getAndSaveCachedShareLink(parserCreate);
ParserCreate finalParserCreate = parserCreate;
return applyDonatedAccountFallback(finalParserCreate)
.compose(v -> getAndSaveCachedShareLink(finalParserCreate));
}
@Override
@@ -305,7 +438,9 @@ public class CacheServiceImpl implements CacheService {
otherParam.getString("authInfo4"),
otherParam.getString("authInfo5"));
}
return getAndSaveCachedShareLink(parserCreate);
ParserCreate finalParserCreate = parserCreate;
return applyDonatedAccountFallback(finalParserCreate)
.compose(v -> getAndSaveCachedShareLink(finalParserCreate));
}
}
web-service/src/main/java/cn/qaiu/lz/web/service/impl/DbServiceImpl.java
+18 -3
View File
@@ -325,9 +325,16 @@ public class DbServiceImpl implements DbService {
public Future<JsonObject> saveDonatedAccount(JsonObject account) {
JDBCPool client = JDBCPoolInit.instance().getPool();
Future<String> encryptedUsername = CryptoUtil.encrypt(account.getString("username"));
Future<String> encryptedPassword = CryptoUtil.encrypt(account.getString("password"));
Future<String> encryptedToken = CryptoUtil.encrypt(account.getString("token"));
// 只保留当前认证方式实际用到的字段，避免调用方切换认证类型后遗留的用户名/密码脏数据
// 被一并存入库中，导致后续解析时被误当作真实凭证使用（例如把废弃的用户名当手机号登录）。
boolean isPasswordAuth = "password".equalsIgnoreCase(account.getString("authType"));
String usernameToStore = isPasswordAuth ? account.getString("username") : null;
String passwordToStore = isPasswordAuth ? account.getString("password") : null;
String tokenToStore = isPasswordAuth ? null : account.getString("token");
Future<String> encryptedUsername = CryptoUtil.encrypt(usernameToStore);
Future<String> encryptedPassword = CryptoUtil.encrypt(passwordToStore);
Future<String> encryptedToken = CryptoUtil.encrypt(tokenToStore);
return ensureFailCountColumn(client).compose(v ->
Future.all(encryptedUsername, encryptedPassword, encryptedToken).compose(compositeFuture -> {
@@ -412,6 +419,14 @@ public class DbServiceImpl implements DbService {
String password = passwordFuture.result();
String token = tokenFuture.result();
// 历史脏数据兜底：非 password 认证类型的账号不应该带用户名/密码
// （例如切换认证类型前遗留的表单数据），否则会被解析器误当作真实账号密码去登录。
boolean isPasswordAuth = "password".equalsIgnoreCase(row.getString("auth_type"));
if (!isPasswordAuth) {
username = null;
password = null;
}
// 如果解密后没有任何可用凭证，返回空对象，避免把密文当作明文认证参数下发给前端
if (StringUtils.isBlank(username) && StringUtils.isBlank(password) && StringUtils.isBlank(token)) {
log.warn("random donated account has no usable credential after decrypt, accountId={}", row.getLong("id"));