From 486390917cd03666f3d4b44c7cbafe49365aed5c Mon Sep 17 00:00:00 2001
From: cnliucheng <brokenway@163.com>
Date: Wed, 8 Jul 2026 14:11:07 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=8B=92=E7=BB=9D=E4=BF=9D=E5=AD=98?=
 =?UTF-8?q?=E6=9C=AA=E6=9D=A5=E6=97=A5=E6=9C=9F=E7=9A=84=E8=AE=B0=E5=BD=95?=
 =?UTF-8?q?(=E9=98=B2=E6=AD=A2=E6=94=B9=E6=89=8B=E6=9C=BA=E6=97=B6?=
 =?UTF-8?q?=E9=97=B4=E6=B1=A1=E6=9F=93=E6=95=B0=E6=8D=AE)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

用户改手机时间到未来,record.date 就会变成未来时间,
推上云后污染排行榜统计。saveRecord 增加 1 分钟宽容度的
未来时间校验,触发时 toast 提示 + 静默拒绝保存。
---
 utils/storage.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/utils/storage.js b/utils/storage.js
index 7f5a401..358bfcd 100644
--- a/utils/storage.js
+++ b/utils/storage.js
@@ -49,6 +49,18 @@ const getRecords = () => {
 
 const saveRecord = (record) => {
   record.id = String(Date.now()) + '_' + (++_idSeq)
+
+  // Defensive: reject records with a future date. Indicates the user has
+  // changed their phone clock, which would otherwise poison the cloud
+  // leaderboard (and their own stats) with impossible timestamps. Allow
+  // a 1-minute tolerance for normal clock skew.
+  const recordTime = new Date(record.date.replace(/-/g, '/')).getTime()
+  if (recordTime > Date.now() + 60 * 1000) {
+    console.warn('[storage] saveRecord rejected: future date', record.date)
+    wx.showToast({ title: '系统时间异常,请检查', icon: 'none' })
+    return
+  }
+
   const records = getRecords()
   const month = record.date.substring(0, 7)
   if (!records[month]) records[month] = []