diff --git a/internal/service/user/address_share.go b/internal/service/user/address_share.go index e3b4511..987a4df 100755 --- a/internal/service/user/address_share.go +++ b/internal/service/user/address_share.go @@ -570,10 +570,11 @@ func (s *service) RedeemInventoryToPoints(ctx context.Context, userID int64, inv } // 校验转赠来源:通过转赠获得的资产不允许兑换积分(防薅积分漏洞) - transferCnt, _ := s.readDB.UserInventoryTransfers.WithContext(ctx).Where( - s.readDB.UserInventoryTransfers.InventoryID.Eq(inventoryID), - s.readDB.UserInventoryTransfers.ToUserID.Eq(userID), - ).Count() + // 使用写库查询,避免主从延迟导致校验被绕过 + var transferCnt int64 + if err := s.repo.GetDbW().Raw("SELECT COUNT(*) FROM user_inventory_transfers WHERE inventory_id = ? AND to_user_id = ?", inventoryID, userID).Scan(&transferCnt).Error; err != nil { + return 0, err + } if transferCnt > 0 { return 0, fmt.Errorf("transfer_inventory_cannot_redeem") } @@ -659,14 +660,15 @@ func (s *service) RedeemInventoriesToPoints(ctx context.Context, userID int64, i } // 3.5 排除通过转赠获得的资产(防薅积分漏洞) + // 使用写库查询,避免主从延迟导致校验被绕过 invIDs := make([]int64, 0, len(invList)) for _, inv := range invList { invIDs = append(invIDs, inv.ID) } - transferredInvs, _ := s.readDB.UserInventoryTransfers.WithContext(ctx). - Where(s.readDB.UserInventoryTransfers.InventoryID.In(invIDs...)). - Where(s.readDB.UserInventoryTransfers.ToUserID.Eq(userID)). - Find() + var transferredInvs []*model.UserInventoryTransfers + if err := s.repo.GetDbW().Raw("SELECT * FROM user_inventory_transfers WHERE inventory_id IN ? AND to_user_id = ?", invIDs, userID).Scan(&transferredInvs).Error; err != nil { + return 0, err + } transferredSet := make(map[int64]struct{}, len(transferredInvs)) for _, t := range transferredInvs { transferredSet[t.InventoryID] = struct{}{}