? photo_2026-07-26_02-19-37.jpg – 47.4 KB

photo_2026-07-26_02-19-37.jpg

47.4 KB

[Meisheng] [Xinghui] [MSH-Kaiyun Sports] Program point-theft BUG fix log for today (2026-07-29)

1. Server and Disk

• Issue: /dev/vda2 was 100% full, causing all endpoints such as api.app to return 500.
• Cause: /www/backup/site/ had accumulated 39G of full-site backups.
• Action: Kept the 2 most recent backups for each site, deleted old backups, freed about 32G, and reduced disk usage from 100% to 45%.
• Follow-up: Added /root/cleanup_disk.sh, scheduled to run daily at 03:40 via crontab. Policy: keep the 2 latest full-site backups, delete database backups older than 14 days, delete gzip logs older than 7 days, truncate access logs over 500MB, and delete panel logs older than 30 days.
• Verification: The script ran successfully manually, df -h showed 45%, and crontab is in effect.

2. API 500 and wap.cc redirect fix

• Fixed IndexController::getVisitUrl(): an error was thrown when $_SERVER[‘HTTP_ORIGIN’] was undefined; changed to $request->header(“Origin”) ?? “”.
• Dual-line sync: .com / .net both changed.
• Fixed wap.dajian168.cc incorrectly jumping to .com:
• Changed the API base address in the .net frontend JS back to https://api.dajian168.cc
• Added ?v=20260729 cache-busting to index.html
• Added domain-family recognition to the backend getVisitUrl(), forcing it to return .cc links to prevent old CDN cache from still pointing to .com
• Verification: /api/app, /api/game/list, and /api/getVisitUrl all returned 200 on both lines; browser testing of wap.cc confirmed it no longer jumps to .com.

3. Official security patch application

• Added Redis lock + DB transaction + lockForUpdate to Api/PayController::transfer and transAll.
• Added a same-type concurrency lock to Api/IndexController::allmz.
• Fixed the full-table update in uptransferstatus: changed $user->update($data) to update only transferstatus.
• Disabled the /api/userblance backdoor route: commented out the route in routes/api.php on both lines, returning 404.
• Retained the original four-layer risk control: no-deposit interception, 1-minute/hour/day frequency limits, 24h limit of 1000 for new accounts, and a single-transaction cap of 50000.
• Verification: php -l all passed; /api/userblance returned 404 on both lines; core endpoints returned 200; no residual locks in Redis.

4. Full-database mass assignment security audit

• Scanned update($data) / create($data) / suspicious write endpoints.
• Confirmed that Wap/IndexController::fillData, Member/MemberController::fillData / uptransferstatus, Member/PayController::editCard, and Api/PayController::bindCard / recharge have been whitelisted or have dangerous fields unset.
• Removed the leftover /api/autogetusermoney dead route (the method no longer exists, so calling it would always 500).
• Verification: bare update($data) calls across the entire codebase reduced to zero; php -l passed; core endpoint regression returned 200.

5. Backend .cc line remediation

• Cleaned up 3 passwordless login backdoors in the .net code: /admin/temp-autologin-656, /temp-autologin-admin-656, /autologin-656 (all using loginUsingId(1)).
• Fixed the missing try_files in the admin.dajian168.cc nginx rewrite, which caused all /admin/* routes to 404.
• Aligned VerifyCsrfToken: .net, which had exempted admin/auth/login; restored to the .com configuration.
• Aligned TrustProxies: .net from null to * to adapt to Cloudflare.
• Verification: backdoor URL 404; admin.cc login page returned 200; login with CSRF token returned 200, without token returned 419.

6. TgService.php synchronization

• Issue: .com‘s allRecords was the old 5-parameter version, while CrawGameRecord had already been changed to a 7-parameter call, which would eventually fatal.
• Action: Synced the new .net /ley/gamerecord implementation to .com.
• Verification: php -l passed on both lines; CrawGameRecord executed successfully on both lines, updated=661.

7. Userbalance backend balance adjustment form hardening

• Added a one-time _nonce to prevent replay/duplicate submission.
• Fixed the log amount bug: record the balance before adjustment before save(), then calculate the balance after adjustment.
• Synced on both lines.
• Verification: php -l passed; anonymous access to the edit page returned 302; core endpoint regression 200; admin.cc login page returned 200.