diff --git a/doc/Avatar.py b/doc/Avatar.py
index 62ef3855..09ebab18 100644
--- a/doc/Avatar.py
+++ b/doc/Avatar.py
@@ -45,10 +45,10 @@ class Avatar(object):
                     ['property_chg', _common.PropertyChg(), '属性变更'],
                 ]
             },{
-                'name': 'buyAvatar',
+                'name': 'buyAvatarS',
                 'desc': '购买装饰物品',
                 'group': 'Avatar',
-                'url': 'webapp/index.php?c=Avatar&a=buyAvatar',
+                'surl': 'webapp/index.php?c=Avatar&a=buyAvatarS',
                 'params': [
                     _common.ReqHead(),
                     ['item_id', '', '装饰物品itemId'],
diff --git a/doc/Bag.py b/doc/Bag.py
index c7d84ddd..a74d6073 100644
--- a/doc/Bag.py
+++ b/doc/Bag.py
@@ -54,10 +54,10 @@ class Bag(object):
                 ]
             },
             {
-                'name': 'buyItem',
+                'name': 'buyItemS',
                 'desc': '购买道具(目前只一次购买改名卡)',
                 'group': 'Bag',
-                'url': 'webapp/index.php?c=Bag&a=buyItem',
+                'surl': 'webapp/index.php?c=Bag&a=buyItemS',
                 'params': [
                     _common.ReqHead(),
                     ['item_id', '', '道具id'],
diff --git a/doc/Chip.py b/doc/Chip.py
index 6ec5af66..2381e553 100644
--- a/doc/Chip.py
+++ b/doc/Chip.py
@@ -45,10 +45,10 @@ class Chip(object):
                     ['!data', [AttrChange()], '属性变化信息']
                 ]
             },{
-                'name': 'upgradeQuality',
+                'name': 'upgradeQualityS',
                 'desc': '芯片升阶',
                 'group': 'Chip',
-                'url': 'webapp/index.php?c=Chip&a=upgradeQuality',
+                'surl': 'webapp/index.php?c=Chip&a=upgradeQualityS',
                 'params': [
                     _common.ReqHead(),
                     ['chip_uniid', '', '升阶芯片唯一id'],
@@ -61,10 +61,10 @@ class Chip(object):
                 ]
             },
             {
-                'name': 'synChip',
+                'name': 'synChipS',
                 'desc': '芯片合成',
                 'group': 'Chip',
-                'url': 'webapp/index.php?c=Chip&a=synChip',
+                'surl': 'webapp/index.php?c=Chip&a=synChipS',
                 'params': [
                     _common.ReqHead(),
                     ['item_id', '', '材料item_id'],
diff --git a/doc/HashRate.py b/doc/HashRate.py
index 3f83989a..6c857da1 100644
--- a/doc/HashRate.py
+++ b/doc/HashRate.py
@@ -25,10 +25,10 @@ class HashRate(object):
                     ['refresh_times', 0, '今日刷新次数'],
                 ]
             },{
-                'name': 'commitTask',
+                'name': 'commitTaskS',
                 'desc': '获取算力信息',
                 'group': 'HashRate',
-                'url': 'webapp/index.php?c=HashRate&a=commitTask',
+                'surl': 'webapp/index.php?c=HashRate&a=commitTaskS',
                 'params': [
                     _common.ReqHead(),
                     ['task_id', 0, '任务id'],
diff --git a/doc/Hero.py b/doc/Hero.py
index 7b910a90..968118af 100644
--- a/doc/Hero.py
+++ b/doc/Hero.py
@@ -75,10 +75,10 @@ class Hero(object):
                     _common.RspHead(),
                 ]
             },{
-                'name': 'upgradeQuality',
+                'name': 'upgradeQualityS',
                 'desc': '英雄升阶',
                 'group': 'Hero',
-                'url': 'webapp/index.php?c=Hero&a=upgradeQuality',
+                'surl': 'webapp/index.php?c=Hero&a=upgradeQualityS',
                 'params': [
                     _common.ReqHead(),
                     ['hero_uniid', 0, '英雄唯一id'],
@@ -107,10 +107,10 @@ class Hero(object):
                       ['property_chg', _common.PropertyChg(), '属性变更'],
                 ]
             },{
-                'name': 'synHero',
+                'name': 'synHeroS',
                 'desc': '英雄合成',
                 'group': 'Hero',
-                'url': 'webapp/index.php?c=Hero&a=synHero',
+                'surl': 'webapp/index.php?c=Hero&a=synHeroS',
                 'params': [
                     _common.ReqHead(),
                     ['item_id', 0, '碎片item_id'],
diff --git a/doc/HeroSkin.py b/doc/HeroSkin.py
index a8459dd2..a93d54e8 100644
--- a/doc/HeroSkin.py
+++ b/doc/HeroSkin.py
@@ -70,10 +70,10 @@ class HeroSkin(object):
                     _common.RspHead(),
                 ]
             },{
-                'name': 'synSkin',
+                'name': 'synSkinS',
                 'desc': '皮肤合成',
                 'group': 'HeroSkin',
-                'url': 'webapp/index.php?c=HeroSkin&a=synSkin',
+                'surl': 'webapp/index.php?c=HeroSkin&a=synSkinS',
                 'params': [
                     _common.ReqHead(),
                     ['item_id', 0, '材料itemId'],
diff --git a/doc/InGameMall.py b/doc/InGameMall.py
index d9525a60..d5253cd8 100644
--- a/doc/InGameMall.py
+++ b/doc/InGameMall.py
@@ -29,10 +29,10 @@ class InGameMall(object):
                 ]
             },
             {
-                'name': 'sell',
+                'name': 'sellS',
                 'desc': '出售',
                 'group': 'InGameMall',
-                'url': 'webapp/index.php?c=InGameMall&a=sell',
+                'surl': 'webapp/index.php?c=InGameMall&a=sellS',
                 'params': [
                     _common.ReqHead(),
                     ['goods_uniid', '', '道具id'],
@@ -45,10 +45,10 @@ class InGameMall(object):
                 ]
             },
             {
-                'name': 'buy',
+                'name': 'buyS',
                 'desc': '购买',
                 'group': 'InGameMall',
-                'url': 'webapp/index.php?c=InGameMall&a=buy',
+                'surl': 'webapp/index.php?c=InGameMall&a=buyS',
                 'params': [
                     _common.ReqHead(),
                     ['order_id', '', '订单id'],
@@ -59,10 +59,10 @@ class InGameMall(object):
                 ]
             },
             {
-                'name': 'cancel',
+                'name': 'cancelS',
                 'desc': '下架物品',
                 'group': 'InGameMall',
-                'url': 'webapp/index.php?c=InGameMall&a=cancel',
+                'surl': 'webapp/index.php?c=InGameMall&a=cancelS',
                 'params': [
                     _common.ReqHead(),
                     ['order_id', '', '订单id'],
@@ -135,10 +135,10 @@ class InGameMall(object):
                 ]
             },
             {
-                'name': 'shoppingCartBuy',
+                'name': 'shoppingCartBuyS',
                 'desc': '购物车下单',
                 'group': 'InGameMall',
-                'url': 'webapp/index.php?c=InGameMall&a=shoppingCartBuy',
+                'surl': 'webapp/index.php?c=InGameMall&a=shoppingCartBuyS',
                 'params':[
                     _common.ReqHead(),
                     ['order_ids', '', '订单id(多个订单用 | 隔开)'],
diff --git a/doc/README.php b/doc/README.php
index 78698960..b947f10e 100644
--- a/doc/README.php
+++ b/doc/README.php
@@ -18,6 +18,20 @@
      * @apiSuccessExample {json} Success-Response:
      * 2024/07/25
      * c=Bag&a=useItemS
+     * c=Bag&a=buyItemS
+     * c=Avatar&a=buyAvatarS
+     * c=Chip&a=upgradeQualityS
+     * c=Chip&a=synChipS
+     * c=HashRate&a=commitTaskS
+     * c=Hero&a=synHeroS
+     * c=Hero&a=upgradeQualityS
+     * c=HeroSkin&a=synSkinS
+     * c=InGameMall&a=sellS
+     * c=InGameMall&a=buyS
+     * c=InGameMall&a=cancelS
+     * c=InGameMall&a=shoppingCartBuyS
+     * c=Sign&a=receiveS
+     * c=User&a=selectFreeItemS
      *
      *
     */
diff --git a/doc/Sign.py b/doc/Sign.py
index 3a125bf7..371a36a5 100644
--- a/doc/Sign.py
+++ b/doc/Sign.py
@@ -20,10 +20,10 @@ class Sign(object):
                 ]
             },
             {
-                'name': 'receive',
+                'name': 'receiveS',
                 'desc': '领取签到奖励',
                 'group': 'Sign',
-                'url': 'webapp/index.php?c=Sign&a=receive',
+                'surl': 'webapp/index.php?c=Sign&a=receiveS',
                 'params': [
                     _common.ReqHead(),
                     ['sign_id', '', '签到id'],
diff --git a/doc/User.py b/doc/User.py
index ed59c622..e423edd3 100644
--- a/doc/User.py
+++ b/doc/User.py
@@ -150,6 +150,19 @@ class User(object):
                     _common.RspHead(),
                     ['!data', [], '列表'],
                 ]
+            },{
+                'name': 'selectFreeItemS',
+                'desc': '获取免费英雄和武器列表',
+                'group': 'User',
+                'surl': 'webapp/index.php?c=User&a=selectFreeItemS',
+                'params': [
+                    _common.ReqHead(),
+                    ['itemId', 0, '英雄itemId'],
+                ],
+                'response': [
+                    _common.RspHead(),
+                    ['!data', [], 'item'],
+                ]
             },
             {
                 'method': 'POST',
diff --git a/webapp/controller/AvatarController.class.php b/webapp/controller/AvatarController.class.php
index 4614a53e..6387e291 100644
--- a/webapp/controller/AvatarController.class.php
+++ b/webapp/controller/AvatarController.class.php
@@ -128,7 +128,7 @@ class AvatarController extends BaseAuthedController {
     }
 
 
-    public function buyAvatar(){
+    public function buyAvatarS(){
         $itemId = trim(getReqVal('item_id', 0));
         $itemMeta = \mt\Item::get($itemId);
         if (!$itemMeta || $itemMeta['type'] !=  \mt\Item::AVATAR_TYPE){
diff --git a/webapp/controller/BagController.class.php b/webapp/controller/BagController.class.php
index 11fd58e9..b60d772e 100644
--- a/webapp/controller/BagController.class.php
+++ b/webapp/controller/BagController.class.php
@@ -466,7 +466,7 @@ class BagController extends BaseAuthedController {
     }
 
 
-    public function buyItem()
+    public function buyItemS()
     {
         $itemId = getReqVal('item_id', 0);
         $itemNum = getReqVal('item_num', 1);
diff --git a/webapp/controller/BaseAuthedController.class.php b/webapp/controller/BaseAuthedController.class.php
index 4720db51..4126c56b 100644
--- a/webapp/controller/BaseAuthedController.class.php
+++ b/webapp/controller/BaseAuthedController.class.php
@@ -476,6 +476,7 @@ class BaseAuthedController extends BaseController {
 
     public function _addItems($items, $awardService, $propertyService)
     {
+        myself()->_checkS();
         $heads = array();
         $headFrames = array();
         foreach ($items as $item) {
@@ -630,6 +631,7 @@ class BaseAuthedController extends BaseController {
 
     public function _decItems($items)
     {
+        myself()->_checkS();
         foreach ($items as $item) {
             //道具消耗埋点
             LogService::consumeItem($item);
diff --git a/webapp/controller/BaseController.class.php b/webapp/controller/BaseController.class.php
index 0c56937b..eb51257c 100644
--- a/webapp/controller/BaseController.class.php
+++ b/webapp/controller/BaseController.class.php
@@ -370,4 +370,11 @@ class BaseController {
         die();
     }
 
+    public function _checkS()
+    {
+        $sign = getReqVal('__sign', '');
+        if (empty($sign)) {
+            error_log('waring unsafe call---------------' . json_encode($_REQUEST));
+        }
+    }
 }
diff --git a/webapp/controller/ChipController.class.php b/webapp/controller/ChipController.class.php
index 236d6bf2..7ef2529e 100644
--- a/webapp/controller/ChipController.class.php
+++ b/webapp/controller/ChipController.class.php
@@ -114,7 +114,7 @@ class ChipController extends BaseAuthedController
         ));
     }
 
-    public function upgradeQuality(){
+    public function upgradeQualityS(){
         $chipUniId = getReqVal('chip_uniid', 0);
         $consumeUniIds = getReqVal('consume_uniids',0);
         $chipDb = Chip::find($chipUniId);
@@ -212,7 +212,7 @@ class ChipController extends BaseAuthedController
         ));
     }
 
-    public function synChip(){
+    public function synChipS(){
         $itemId = getReqVal('item_id',0);
         $itemNum = getReqVal('item_num',0);
         $needItem = \mt\Parameter::getVal('chip_craft_need_item',0);
diff --git a/webapp/controller/HashRateController.class.php b/webapp/controller/HashRateController.class.php
index 60204d77..ad649e09 100644
--- a/webapp/controller/HashRateController.class.php
+++ b/webapp/controller/HashRateController.class.php
@@ -67,7 +67,7 @@ class HashRateController extends BaseAuthedController
         ));
     }
 
-    public function commitTask(){
+    public function commitTaskS(){
         $currentPeriod= \mt\AchievementsCycle::getCurrentPeriod();
         if (! $currentPeriod){
             $this->_rspErr(1, 'Already ended');
diff --git a/webapp/controller/HeroController.class.php b/webapp/controller/HeroController.class.php
index dc0ba6b1..7dc327a1 100644
--- a/webapp/controller/HeroController.class.php
+++ b/webapp/controller/HeroController.class.php
@@ -73,7 +73,7 @@ class HeroController extends BaseAuthedController {
         ));
     }
 
-    public function synHero(){
+    public function synHeroS(){
         $itemId = getReqVal('item_id',0);
         $itemNum = getReqVal('item_num',0);
         $itemMeta = \mt\Item::get($itemId);
@@ -129,7 +129,7 @@ class HeroController extends BaseAuthedController {
 
     }
 
-    public function upgradeQuality(){
+    public function upgradeQualityS(){
         $heroUniId = getReqVal('hero_uniid', 0);
         $itemId = getReqVal('item_id',0);
         $itemNum = max(0,getReqVal('item_num',0));
diff --git a/webapp/controller/HeroSkinController.class.php b/webapp/controller/HeroSkinController.class.php
index 5bed965f..8d432eef 100644
--- a/webapp/controller/HeroSkinController.class.php
+++ b/webapp/controller/HeroSkinController.class.php
@@ -166,7 +166,7 @@ class HeroSkinController extends BaseAuthedController {
         ));
     }
 
-    public function synSkin(){
+    public function synSkinS(){
         $itemId = getReqVal('item_id',0);
         $itemNum = getReqVal('item_num',0);
         $itemMeta = \mt\Item::get($itemId);
diff --git a/webapp/controller/InGameMallController.class.php b/webapp/controller/InGameMallController.class.php
index 6768ddf8..33bb3acf 100644
--- a/webapp/controller/InGameMallController.class.php
+++ b/webapp/controller/InGameMallController.class.php
@@ -185,7 +185,7 @@ class InGameMallController extends BaseAuthedController {
         myself()->_rspData($out);
     }
 
-    public function sell()
+    public function sellS()
     {
         $goodsUniid = getReqVal('goods_uniid', '');
         $itemId = getReqVal('item_id', '');
@@ -294,7 +294,7 @@ class InGameMallController extends BaseAuthedController {
         ));
     }
 
-    public function buy(){
+    public function buyS(){
         $orderId = getReqVal('order_id', '');
         $goodsDb = InGameMall::findByOrderId($orderId);
         if (!$goodsDb) {
@@ -431,7 +431,7 @@ EOD;
         LogService::burialPointEvent($event1);
     }
 
-    public function cancel()
+    public function cancelS()
     {
         $orderId = getReqVal('order_id', '');
         $goodsDb = InGameMall::findByOrderId($orderId);
@@ -642,7 +642,7 @@ EOD;
         ));
     }
 
-    public function shoppingCartBuy(){
+    public function shoppingCartBuyS(){
         $orderIds = getReqVal('order_ids', '');
         if (!$orderIds){
             $this->_rspErr(1, 'param is not null');
diff --git a/webapp/controller/SignController.class.php b/webapp/controller/SignController.class.php
index 1fe2c313..216c2ec5 100644
--- a/webapp/controller/SignController.class.php
+++ b/webapp/controller/SignController.class.php
@@ -51,7 +51,7 @@ class SignController extends BaseAuthedController
         ));
     }
 
-    public function receive(){
+    public function receiveS(){
         $sign_id = getReqVal('sign_id', '');
         $meta = \mt\Sign::get($sign_id);
         if (!$meta){
diff --git a/webapp/controller/StarController.class.php b/webapp/controller/StarController.class.php
index 911cd4aa..e3a94c4e 100644
--- a/webapp/controller/StarController.class.php
+++ b/webapp/controller/StarController.class.php
@@ -21,9 +21,12 @@ class StarController extends BaseAuthedController {
     private $currMissionSeasonMeta = null;
     public function _handlePre()
     {
+
         if(getReqVal('a', '') != 'resetStar'){
             parent::_handlePre();
         }
+        $this->_rspErr(10, 'server internal error');
+        die();
         $this->currMissionSeasonMeta = \mt\StarLevel::getCurrentSeason();
         if (!$this->currMissionSeasonMeta) {
             $this->_rspErr(10, 'server internal error');
diff --git a/webapp/controller/UserController.class.php b/webapp/controller/UserController.class.php
index 7f5b1c70..58709155 100644
--- a/webapp/controller/UserController.class.php
+++ b/webapp/controller/UserController.class.php
@@ -912,7 +912,7 @@ class UserController extends BaseAuthedController {
 
     }
 
-    public function selectFreeItem(){
+    public function selectFreeItemS(){
         $itemId = getReqVal('itemId', '');
         if (!$itemId){
             $this->_rspErr(1, 'param is error');