1

backend/api/dp.py

@@ -19,15 +19,17 @@ RedisDep = Annotated[Redis, Depends(get_redis)]
 def alterToken(redis: RedisDep, alter_token: str | None = Header(None)):
     if alter_token is not None:
         try:
-            decoded_bytes = base64.b64decode(alter_token)
+            decoded_bytes = base64.urlsafe_b64decode(alter_token)
             decoded_str = decoded_bytes.decode('utf-8')
             alter = json.loads(decoded_str)
             # 6小时过期
             if (int(time.time() * 1000) - alter['time']) / (60 * 60 * 1000) > 6:
                 raise ResponseException('登录过期或无效Token，请刷新后重试')
             alterData = get_redis_info(redis, f'dcalc:adventure:{alter["alter"]}', lambda: get_adv_info(alter['alter']))
+            if alterData is None:
+                raise ResponseException('登录过期或无效Token，请刷新后重试')
             return AlterState(alterData['class'], alter_token, {}, alter.get('equVersion', '0'), alter['time'])
-        except (base64.binascii.Error, json.JSONDecodeError):
+        except (base64.binascii.Error, json.JSONDecodeError, KeyError, TypeError, UnicodeDecodeError):
             raise ResponseException('登录过期或无效Token，请刷新后重试')
     else:
         raise ResponseException('登录过期或无效Token，请刷新后重试')

backend/api/routes/info.py

@@ -6,7 +6,7 @@ from api.core.Response import response
 from api.core.Redis import get_redis_info, get_redis_info_async
 from api.dp import RedisDep, AltersDep
 from core.basic.equipment import get_equipment
-from core.character.adventure import get_adv_list
+from core.character.adventure import get_adv_info, get_adv_list
 from core.basic.character import createCharacter
 from core.open.helper import get_user_info_by_id, get_user_info_by_role_id, get_user_list_by_id, getRoleJobCode
 from core.open.skillTree import get_skill_tree_info
@@ -30,6 +30,8 @@ async def get_adventure_info(request: Request, redis: RedisDep, name: str = None
 
 @router.get('/token/get/{alter}')
 async def getToken(redis: RedisDep, alter: str, request: Request, version: str = None, equVersion: str = '0'):
+    if get_adv_info(alter) is None:
+        raise ResponseException('无效的职业')
     token = createToken(alter, equVersion, redis)
     return response(data=token)
 

backend/core/character/GF/priest_male/crusader_male_carry.py

@@ -1677,11 +1677,6 @@ class Skill45(ActiveSkill):
     # 3层信仰效果时神圣之力持续时间 : {value6}秒
     data6 = get_data(f'{prefix}/{uuid}', 6)
 
-    def skillInfo(self,mode=""):
-        prep = self.char.BuffSkill.skillInfo()
-        ratio = self.data2[self.lv] * 5 / 100
-        return prep[0] * ratio, [prep[1][0] * ratio, prep[1][1], prep[1][2] * ratio], [prep[2][0] * ratio, prep[2][1], prep[2][2] * ratio], 0, self.getSkillCD()
-
 
 # 信仰之翼 : 裁决
 # priest_male/crusader_male/481348575c1e141925c836b59c5db3ca

backend/core/character/adventure.py

@@ -1,4 +1,5 @@
 import base64
+import binascii
 from copy import deepcopy
 
 adv = [
@@ -246,7 +247,12 @@ def get_adv_list():
 
 
 def get_adv_info(value):
-    value = base64.b64decode(value).decode()
+    try:
+        value = base64.b64decode(value, validate=True).decode()
+    except (binascii.Error, TypeError, UnicodeDecodeError):
+        return None
+    if len(value) != 6 or not value.isdigit():
+        return None
     parent_id, child_id, option_id = map(int, (value[:2], value[2:4], value[4:6]))
     parent = next((p for p in adv if p['id'] == parent_id), None)
     if not parent: