1.修复上传漏洞和SQL注入漏洞-修复服务端无法启动的问题

app/process/AngpowImportJobs.php

@@ -23,20 +23,19 @@ class AngpowImportJobs
     private const BATCH_LIMIT = 100;
     private const MAX_RETRY = 3;
 
-    protected Client $http;
+    protected ?Client $http = null;
 
-    public function __construct()
+    public function onWorkerStart(Worker $worker): void
     {
-        // 确保定时任务只在一个 worker 上运行
-        if (!Worker::getAllWorkers()) {
-            return;
-        }
-
         $this->http = new Client($this->buildGuzzleOptions());
-
         Timer::add(self::TIMER_SECONDS, [$this, 'pushPendingOrders']);
     }
 
+    protected function getHttp(): ?Client
+    {
+        return $this->http;
+    }
+
     /**
      * Guzzle 默认校验 HTTPS；Windows 未配置 CA 时会出现 cURL error 60。
      * 优先使用 PLAYX_ANGPOW_IMPORT_CACERT 指向 cacert.pem；否则可按环境关闭校验（仅开发）。
@@ -70,6 +69,11 @@ class AngpowImportJobs
 
     public function pushPendingOrders(): void
     {
+        $http = $this->getHttp();
+        if ($http === null) {
+            return;
+        }
+
         $conf = config('playx.angpow_import');
         if (!is_array($conf)) {
             return;
@@ -165,7 +169,7 @@ class AngpowImportJobs
         $res = null;
         $body = '';
         try {
-            $res = $this->http->post($url, [
+            $res = $http->post($url, [
                 'headers' => [
                     'Content-Type' => 'application/json',
                     'X-Request-Signature' => $signature,

app/process/PlayxJobs.php

@@ -16,15 +16,10 @@ use Workerman\Worker;
  */
 class PlayxJobs
 {
-    protected Client $http;
+    protected ?Client $http = null;
 
-    public function __construct()
+    public function onWorkerStart(Worker $worker): void
     {
-        // 确保定时任务只在一个 worker 上运行
-        if (!Worker::getAllWorkers()) {
-            return;
-        }
-
         $this->http = new Client([
             'timeout' => 20,
             'http_errors' => false,
@@ -34,11 +29,21 @@ class PlayxJobs
         Timer::add(60, [$this, 'retryFailedGrants']);
     }
 
+    protected function getHttp(): ?Client
+    {
+        return $this->http;
+    }
+
     /**
      * 轮询：已 accepted 的订单，查询终态
      */
     public function pollTransactionStatus(): void
     {
+        $http = $this->getHttp();
+        if ($http === null) {
+            return;
+        }
+
         $baseUrl = strval(config('playx.api.base_url', ''));
         if ($baseUrl === '') {
             return;
@@ -57,7 +62,7 @@ class PlayxJobs
         foreach ($list as $order) {
             /** @var MallOrder $order */
             try {
-                $res = $this->http->get($url, [
+                $res = $http->get($url, [
                     'query' => [
                         'externalTransactionId' => $order->external_transaction_id,
                     ],