1.修复上传漏洞和SQL注入漏洞-修复服务端无法启动的问题

app/process/AngpowImportJobs.php

@@ -23,20 +23,19 @@ class AngpowImportJobs
     private const BATCH_LIMIT = 100;
     private const MAX_RETRY = 3;
 
-    protected Client $http;
+    protected ?Client $http = null;
 
-    public function __construct()
+    public function onWorkerStart(Worker $worker): void
     {
-        // 确保定时任务只在一个 worker 上运行
-        if (!Worker::getAllWorkers()) {
-            return;
-        }
-
         $this->http = new Client($this->buildGuzzleOptions());
-
         Timer::add(self::TIMER_SECONDS, [$this, 'pushPendingOrders']);
     }
 
+    protected function getHttp(): ?Client
+    {
+        return $this->http;
+    }
+
     /**
      * Guzzle 默认校验 HTTPS；Windows 未配置 CA 时会出现 cURL error 60。
      * 优先使用 PLAYX_ANGPOW_IMPORT_CACERT 指向 cacert.pem；否则可按环境关闭校验（仅开发）。
@@ -70,6 +69,11 @@ class AngpowImportJobs
 
     public function pushPendingOrders(): void
     {
+        $http = $this->getHttp();
+        if ($http === null) {
+            return;
+        }
+
         $conf = config('playx.angpow_import');
         if (!is_array($conf)) {
             return;
@@ -165,7 +169,7 @@ class AngpowImportJobs
         $res = null;
         $body = '';
         try {
-            $res = $this->http->post($url, [
+            $res = $http->post($url, [
                 'headers' => [
                     'Content-Type' => 'application/json',
                     'X-Request-Signature' => $signature,