Auth now require timestamp

src/server/context.rs

@@ -90,6 +90,13 @@ impl ServerContext {
             Some(sign) => sign,
             None => return Err(PixivDownloaderError::from(gettext("Sign not found."))),
         };
+        let time = params
+            .get_u64_mult(&["time", "t"])?
+            .ok_or(gettext("Time not found."))?;
+        let now = chrono::Utc::now().timestamp() as u64;
+        if time < now - 300 || time > now + 300 {
+            return Err(PixivDownloaderError::from(gettext("Time out of range.")));
+        }
         let token = self
             .db
             .get_token(token_id)

src/server/params.rs

@@ -31,6 +31,22 @@ impl RequestParams {
         }
     }
 
+    /// Get parameter.
+    /// * `name` - A list of the parameter name.
+    /// # Note
+    /// It will return the first existed parameter's value.
+    pub fn get_mult<S: AsRef<str> + ?Sized>(&self, names: &[&S]) -> Option<&str> {
+        for name in names {
+            match self.get(name.as_ref()) {
+                Some(v) => {
+                    return Some(v);
+                }
+                None => {}
+            }
+        }
+        None
+    }
+
     /// Get parameter and return it as boolean.
     /// * `name` - Parameter name.
     pub fn get_bool<S: AsRef<str> + ?Sized>(

src/server/unittest/mod.rs

@@ -117,6 +117,10 @@ impl UnitTestContext {
         token_id: u64,
     ) -> Result<Option<JsonValue>, PixivDownloaderError> {
         let mut par = BTreeMap::new();
+        par.insert(
+            "t".to_string(),
+            vec![chrono::Utc::now().timestamp().to_string()],
+        );
         for (key, obj) in params.entries() {
             if !par.contains_key(key) {
                 par.insert(key.to_string(), Vec::new());