diff --git a/ruoyi-auth/src/main/java/com/xhpc/auth/controller/TokenController.java b/ruoyi-auth/src/main/java/com/xhpc/auth/controller/TokenController.java
index d49fca62..147885bf 100644
--- a/ruoyi-auth/src/main/java/com/xhpc/auth/controller/TokenController.java
+++ b/ruoyi-auth/src/main/java/com/xhpc/auth/controller/TokenController.java
@@ -89,7 +89,7 @@ public class TokenController extends BaseController
             return R.fail("该租户已过期或已停用，请联系管理员");
         }
         //验证 输入的验证码
-        if("18123374652".equals(form.getUsername()) || "123456".equals(form.getPassword())){
+        if("18123374652".equals(form.getUsername()) && "123456".equals(form.getPassword())){
 
         }else{
             String captcha = redisService.getCacheObject("pcToken:" + form.getUsername());
diff --git a/ruoyi-modules/ruoyi-system/src/main/java/com/xhpc/system/controller/SysProfileController.java b/ruoyi-modules/ruoyi-system/src/main/java/com/xhpc/system/controller/SysProfileController.java
index 3c2479ca..a4865394 100644
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/xhpc/system/controller/SysProfileController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/xhpc/system/controller/SysProfileController.java
@@ -2,9 +2,7 @@ package com.xhpc.system.controller;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.Map;
+import java.util.*;
 
 import com.aliyun.oss.OSSClient;
 import com.xhpc.common.core.utils.DateUtils;
@@ -137,24 +135,30 @@ public class SysProfileController extends BaseController
      */
     @Log(title = "用户头像", businessType = BusinessType.UPDATE)
     @PostMapping("/avatar")
-    public AjaxResult avatar(HttpServletRequest request) {
+    public AjaxResult avatar(MultipartFile file) {
         try {
-            String fileNames = "";
-            StandardMultipartHttpServletRequest req = (StandardMultipartHttpServletRequest) request;
-            Iterator<String> iterator = req.getFileNames();
-            while (iterator.hasNext()) {
-                MultipartFile file = req.getFile(iterator.next());
-                fileNames = file.getOriginalFilename();
-                fileNames = DateUtils.timePath() + fileNames;
-                InputStream input = file.getInputStream();
-                // 创建OSSClient实例
-                OSSClient ossClient = new OSSClient(environment.getProperty("oss.endpoint"), environment.getProperty("oss.access-key"), environment.getProperty("oss.secret-key"));
-                // 上传文件流
-                ossClient.putObject(environment.getProperty("oss.bucket-name"), fileNames, input);
-                ossClient.shutdown();
+            List<String> IMAGE_EXTENSIONS = Arrays.asList(".jpg", ".jpeg", ".png");
+            // 源文件名称
+            final String originalFileName = file.getOriginalFilename();
+            if (StringUtils.isBlank(originalFileName)) {
+                return AjaxResult.error("请选择图片！");
             }
+            // 文件后缀[.jpg]
+            final String suffix = originalFileName.substring(originalFileName.lastIndexOf(".")).toLowerCase();
+            if (!IMAGE_EXTENSIONS.contains(suffix)) {
+                return AjaxResult.error("图片格式错误！");
+            }
+            String newFileName = "avatar/"+DateUtils.timePath() + suffix;
+
+            InputStream input = file.getInputStream();
+            // 创建OSSClient实例
+            OSSClient ossClient = new OSSClient(environment.getProperty("oss.endpoint"), environment.getProperty("oss.access-key"), environment.getProperty("oss.secret-key"));
+            // 上传文件流
+            ossClient.putObject(environment.getProperty("oss.bucket-name"), newFileName, input);
+            ossClient.shutdown();
+
             LoginUser loginUser = tokenService.getLoginUser(ServletUtils.getRequest());
-            String url="https://xhpc-bucket1.oss-cn-hangzhou.aliyuncs.com/"+fileNames;
+            String url="https://xhpc-bucket1.oss-cn-hangzhou.aliyuncs.com/"+newFileName;
             if (userService.updateUserAvatar(loginUser.getUsername(), url)) {
                 AjaxResult ajax = AjaxResult.success();
                 ajax.put("imgUrl", url);
@@ -168,4 +172,27 @@ public class SysProfileController extends BaseController
         }
         return AjaxResult.error("上传图片异常，请联系管理员");
     }
+
+    @Log(title = "用户头像", businessType = BusinessType.UPDATE)
+    @PostMapping("/avatarUrl")
+    public AjaxResult avatarUrl(String url){
+        try {
+            if(url==null || "".equals(url) || url.length()==0){
+                return AjaxResult.error("请选择上传图片！");
+            }
+            LoginUser loginUser = tokenService.getLoginUser(ServletUtils.getRequest());
+            if (userService.updateUserAvatar(loginUser.getUsername(), url)) {
+                AjaxResult ajax = AjaxResult.success();
+                ajax.put("imgUrl", url);
+                // 更新缓存用户头像
+                loginUser.getSysUser().setAvatar(url);
+                tokenService.setLoginUser(loginUser);
+                return ajax;
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return AjaxResult.error("上传图片异常，请联系管理员");
+    }
+
 }
diff --git a/xhpc-modules/xhpc-card/src/main/java/com/xhpc/card/service/IXhpcCardClientUserService.java b/xhpc-modules/xhpc-card/src/main/java/com/xhpc/card/service/IXhpcCardClientUserService.java
index e814cf0a..934cedfe 100644
--- a/xhpc-modules/xhpc-card/src/main/java/com/xhpc/card/service/IXhpcCardClientUserService.java
+++ b/xhpc-modules/xhpc-card/src/main/java/com/xhpc/card/service/IXhpcCardClientUserService.java
@@ -48,7 +48,6 @@ public interface IXhpcCardClientUserService {
 
     /**
      * 获取运营商接口
-     * @param tenantId   租户id
      * @return
      */
     AjaxResult getXhpcCardClientUserStatus(Integer usersID,Integer status);