From f655f519d0bc72539e3aa6b45782a5f158d12f4e Mon Sep 17 00:00:00 2001
From: "heavyrain.lee" <heavyrain.lee@gmail.com>
Date: Mon, 20 May 2019 19:33:22 +0800
Subject: [PATCH] =?UTF-8?q?server=20api=E6=97=B6=E9=97=B4=E6=88=B3?=
 =?UTF-8?q?=E6=A3=80=E6=9F=A5=E5=BC=80=E5=85=B3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 broker/config/wildfirechat.conf                     |  4 ++++
 .../loServer/action/admin/AdminAction.java          | 13 +++++++++++--
 .../src/main/java/io/moquette/BrokerConstants.java  |  2 ++
 broker/src/main/java/io/moquette/server/Server.java |  2 ++
 4 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/broker/config/wildfirechat.conf b/broker/config/wildfirechat.conf
index f178ac81..bc380bad 100755
--- a/broker/config/wildfirechat.conf
+++ b/broker/config/wildfirechat.conf
@@ -32,6 +32,10 @@ embed.db 1
 ##服务器管理接口密钥
 http.admin.secret_key 123456
 
+##服务器API接口参数是否检查时间。当设置为false时，所有的请求会检查时间的有效性；当设置为true时，可以在http.admin.secret_key保持不变的情况下，使用固定的服务API签名
+##nonce = "76616", timestamp = "1558350862502", sign = "b98f9b0717f59febccf1440067a7f50d9b31bdde"
+http.admin.no_check_time true
+
 ##客户端协议栈密钥，需要与客户端协议栈文件libemqq.cc文件中的aes_key值保持一致，16进制byte用逗号分割。这个密钥对安全性帮助不大，客户不要修改
 client.proto.secret_key 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x78,0x79,0x7A,0x7B,0x7C,0x7D,0x7E,0x7F
 
diff --git a/broker/src/main/java/com/xiaoleilu/loServer/action/admin/AdminAction.java b/broker/src/main/java/com/xiaoleilu/loServer/action/admin/AdminAction.java
index 97904fb0..24f742d4 100644
--- a/broker/src/main/java/com/xiaoleilu/loServer/action/admin/AdminAction.java
+++ b/broker/src/main/java/com/xiaoleilu/loServer/action/admin/AdminAction.java
@@ -26,11 +26,20 @@ import win.liyufan.im.RateLimiter;
 
 abstract public class AdminAction extends Action {
     private static String SECRET_KEY = "123456";
+    private static boolean NO_CHECK_TIME = false;
     private final RateLimiter mLimitCounter = new RateLimiter(10, 500);
     public static void setSecretKey(String secretKey) {
         SECRET_KEY = secretKey;
     }
 
+    public static void setNoCheckTime(String noCheckTime) {
+        try {
+            NO_CHECK_TIME = Boolean.parseBoolean(noCheckTime);
+        } catch (Exception e) {
+
+        }
+    }
+
     @Override
     public ErrorCode preAction(Request request, Response response) {
         if (!mLimitCounter.isGranted("admin")) {
@@ -51,8 +60,8 @@ abstract public class AdminAction extends Action {
             return ErrorCode.INVALID_PARAMETER;
         }
 
-        if (System.currentTimeMillis() - ts > 2 * 60 * 60 * 1000) {
-//            return ErrorCode.ERROR_CODE_SIGN_EXPIRED;
+        if (!NO_CHECK_TIME && System.currentTimeMillis() - ts > 2 * 60 * 60 * 1000) {
+            return ErrorCode.ERROR_CODE_SIGN_EXPIRED;
         }
 
         String str = nonce + "|" + SECRET_KEY + "|" + timestamp;
diff --git a/broker/src/main/java/io/moquette/BrokerConstants.java b/broker/src/main/java/io/moquette/BrokerConstants.java
index 0bc8a0a5..3d13b9b5 100755
--- a/broker/src/main/java/io/moquette/BrokerConstants.java
+++ b/broker/src/main/java/io/moquette/BrokerConstants.java
@@ -100,6 +100,8 @@ public final class BrokerConstants {
     public static final String HZ_Cluster_Node_External_Short_Port = "node_external_short_port";
     public static final String HZ_Cluster_Node_ID = "node_id";
     public static final String HTTP_SERVER_SECRET_KEY = "http.admin.secret_key";
+    public static final String HTTP_SERVER_API_NO_CHECK_TIME = "http.admin.no_check_time";
+
     public static final String CLIENT_PROTO_SECRET_KEY = "client.proto.secret_key";
     public static final String TOKEN_SECRET_KEY = "token.key ";
 
diff --git a/broker/src/main/java/io/moquette/server/Server.java b/broker/src/main/java/io/moquette/server/Server.java
index 0598cfcd..352e7658 100755
--- a/broker/src/main/java/io/moquette/server/Server.java
+++ b/broker/src/main/java/io/moquette/server/Server.java
@@ -112,6 +112,8 @@ public class Server {
         int httpAdminPort = Integer.parseInt(config.getProperty(BrokerConstants.HTTP_ADMIN_PORT));
 
         AdminAction.setSecretKey(config.getProperty(HTTP_SERVER_SECRET_KEY));
+        AdminAction.setNoCheckTime(config.getProperty(HTTP_SERVER_API_NO_CHECK_TIME));
+
         final LoServer httpServer = new LoServer(httpLocalPort, httpAdminPort, instance.m_processor.getMessagesStore(), instance.m_store.sessionsStore());
         try {
             httpServer.start();