From 355f5860861644ee673c2cdbc2f33787962084cf Mon Sep 17 00:00:00 2001
From: mediabot-pt <295750538+mediabot-pt@users.noreply.github.com>
Date: Mon, 6 Jul 2026 12:55:32 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20WebConfig=20HMAC=20=E6=8B=A6=E6=88=AA?=
 =?UTF-8?q?=E5=99=A8=E6=8E=92=E9=99=A4=20GET=20pages/version=20=E7=AB=AF?=
 =?UTF-8?q?=E7=82=B9=E5=85=AC=E5=BC=80=E8=AE=BF=E9=97=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 par-core/src/main/java/com/par/core/config/WebConfig.java | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/par-core/src/main/java/com/par/core/config/WebConfig.java b/par-core/src/main/java/com/par/core/config/WebConfig.java
index d241dd0..fce9969 100644
--- a/par-core/src/main/java/com/par/core/config/WebConfig.java
+++ b/par-core/src/main/java/com/par/core/config/WebConfig.java
@@ -30,13 +30,15 @@ public class WebConfig implements WebMvcConfigurer {
         registry.addInterceptor(anonymousStatInterceptor)
                 .addPathPatterns("/api/v1/sites/**", "/api/v1/configs/**", "/api/v1/manifest");
 
-        // HMAC 鉴权拦截器：拦截所有写入端点
+        // HMAC 鉴权拦截器：拦截所有写入端点（仅 PUT/POST/DELETE）
         registry.addInterceptor(hmacAuthInterceptor)
                 .addPathPatterns("/api/v1/configs/*/submit", "/api/v1/sites/*/submit",
                         "/api/v1/sites/*/access-result", "/api/v1/sites/*/error-log",
                         "/api/v1/sites/*/pages",            // PUT 页面配置
                         "/api/v1/scripts/*",                // PUT 上传脚本
                         "/api/v1/risk-rules/*",             // POST 提交风险规则
-                        "/api/v1/admin/**", "/api/v1/account/**");
+                        "/api/v1/admin/**", "/api/v1/account/**")
+                .excludePathPatterns(
+                        "/api/v1/sites/*/pages/version");   // GET 版本号公开
     }
 }