diff --git a/run.py b/run.py
index ca8a16e..9997586 100644
--- a/run.py
+++ b/run.py
@@ -3,4 +3,4 @@
 from server.app import web_app
 
 if __name__ == "__main__":
-    web_app.run(host='0.0.0.0', port=80)
+    web_app.run(host='0.0.0.0', port=7788)
diff --git a/server/api/privilege.py b/server/api/privilege.py
index 3b521c9..a3d1829 100644
--- a/server/api/privilege.py
+++ b/server/api/privilege.py
@@ -5,8 +5,8 @@ from flask import request
 
 from server.database import db_adapter
 from server.database.models import User, UserToken
-from server.utils import get_now
-from server.utils.api_response import unauthorized, forbidden
+from server.utils import get_now, get_config
+from server.utils.api_response import unauthorized, forbidden, insecurity_request
 
 
 def token_required(func):
@@ -53,13 +53,29 @@ def admin_privilege_required(func):
     return authenticate_and_call
 
 
+def white_list_check(func):
+    """
+    check request's ip whether in config's white_list
+    """
+    def authenticate_and_call(*args, **kwargs):
+        if request.ipaddress not in get_config('white_list'):
+            return insecurity_request(message='%s' % request.ipaddress)
+        return func(*args, **kwargs)
+
+    authenticate_and_call.original = func.__name__
+    if hasattr(func, "original"):
+        authenticate_and_call.original = func.original
+    return authenticate_and_call
+
+
 def __validate_token():
     if 'token' not in request.headers:
         return False
 
-    t = db_adapter.find_first_object_by(UserToken,
-                                        token=request.headers['token'])
-    if not t or t.expire_date <= get_now():
+    t = db_adapter.find_first_object(UserToken,
+                                     UserToken.token==request.headers['token'],
+                                     UserToken.expire_date<=get_now())
+    if not t:
         return False
 
     return t.user
diff --git a/server/api/routes.py b/server/api/routes.py
index a033db1..16fc6b3 100644
--- a/server/api/routes.py
+++ b/server/api/routes.py
@@ -3,7 +3,6 @@
 
 from server.app import web_api
 from server.database import db_adapter
-from server.database.models import Host
 from flask_restful import Resource
 
 
@@ -14,9 +13,9 @@ class TestResource(Resource):
 
 class HostResource(Resource):
     def get(self):
-        return db_adapter.find_first_object_by(Host, id=1).dic()
+        return "passed"
 
 
 def init_routes():
     web_api.add_resource(TestResource, "/api/test")
-    web_api.add_resource(HostResource, "/api/host")
\ No newline at end of file
+    web_api.add_resource(HostResource, "/api/users")
diff --git a/server/database/db_adapters.py b/server/database/db_adapters.py
index 0747abc..ec62c54 100644
--- a/server/database/db_adapters.py
+++ b/server/database/db_adapters.py
@@ -1,5 +1,7 @@
 # -*- coding: utf-8 -*-
 
+from server.log import log
+
 
 class SQLAlchemyAdapterMetaClass(type):
     @staticmethod
@@ -67,30 +69,30 @@ class SQLAlchemyAdapter(DBAdapter):
         """ Retrieve one object specified by the primary key 'pk' """
         return ObjectClass.query.get(id)
 
-    def find_all_objects(self, ObjectClass, *criterion):
+    def get_all_objects(self, ObjectClass, *criterion):
         return ObjectClass.query.filter(*criterion).all()
 
-    def find_all_objects_by(self, ObjectClass, **kwargs):
+    def get_all_objects_by(self, ObjectClass, **kwargs):
         return ObjectClass.query.filter_by(**kwargs).all()
 
-    def find_all_objects_order_by(self, ObjectClass, limit=None, *order_by, **kwargs):
+    def get_all_objects_order_by(self, ObjectClass, limit=None, *order_by, **kwargs):
         if limit is not None:
             return ObjectClass.query.filter_by(**kwargs).order_by(*order_by).limit(limit)
         else:
             return ObjectClass.query.filter_by(**kwargs).order_by(*order_by).all()
 
+    def get_first_object_by(self, ObjectClass, **kwargs):
+        return ObjectClass.query.filter_by(**kwargs).first()
+
     def count(self, ObjectClass, *criterion):
         return ObjectClass.query.filter(*criterion).count()
 
     def count_by(self, ObjectClass, **kwargs):
         return ObjectClass.query.filter_by(**kwargs).count()
 
-    def find_first_object(self, ObjectClass, *criterion):
+    def get_first_object(self, ObjectClass, *criterion):
         return ObjectClass.query.filter(*criterion).first()
 
-    def find_first_object_by(self, ObjectClass, **kwargs):
-        return ObjectClass.query.filter_by(**kwargs).first()
-
     def add_object(self, inst):
         self.db_session.add(inst)
 
@@ -125,3 +127,10 @@ class SQLAlchemyAdapter(DBAdapter):
         return query.delete(synchronize_session=False)
 
         # ------------------------------ auto wrapped 'public' methods  --- end ------------------------------
+
+    def exec_sql(self, sql_str):
+        try:
+            self.session().execte(sql_str)
+        except Exception as ex:
+            log.error(ex)
+            return None
diff --git a/server/log/logging.conf b/server/log/logging.conf
index d8a610e..0312e07 100644
--- a/server/log/logging.conf
+++ b/server/log/logging.conf
@@ -46,14 +46,14 @@ args=(sys.stdout,)
 class=logging.handlers.TimedRotatingFileHandler
 level=DEBUG
 formatter=myFormatter
-args=('/var/log/open-hackathon/sunnycloud.log','midnight',1,14)
+args=('/var/log/isa.qa/isa.qa.log','midnight',1,14)
 
 #define sqlLogHandler
 [handler_sqlLogHandler]
 class=logging.handlers.TimedRotatingFileHandler
 level=DEBUG
 formatter=myFormatter
-args=('/var/log/open-hackathon/sunnycloud.log','midnight',1,14)
+args=('/var/log/isa.qa/isa.qa.log','midnight',1,14)
 
 #define formatter
 [formatter_myFormatter]
diff --git a/server/others/__init__.py b/server/others/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/server/others/__init__.py
diff --git a/server/others/test_dg.py b/server/others/test_dg.py
new file mode 100644
index 0000000..136afba
--- /dev/null
+++ b/server/others/test_dg.py
@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*-
+
+# 测试递归方法函数的使用--跟平台功能无关,但也不要删掉,谢谢!
+
+import json
+
+
+def restorkey(key):
+    with open("F:\\result.txt", "a") as f:
+        f.write(key)
+
+
+def print_keyvalue_all(input_json, previous_key_str):
+
+    if isinstance(input_json, dict):
+
+        for key in input_json.keys():
+            key_str = previous_key_str + '/' + key
+            key_value = input_json.get(key)
+
+            if isinstance(key_value, dict):
+                print_keyvalue_all(key_value, key_str)
+
+            elif isinstance(key_value, list):
+                for json_array in key_value:
+                    print_keyvalue_all(json_array, key_str)
+            else:
+                result = str(key_str) + "  ==  " + str(key_value)
+                print result
+                restorkey("%s\n" % result)
+
+    elif isinstance(input_json, list):
+        for input_json_array in input_json:
+            print_keyvalue_all(input_json_array, previous_key_str)
+
+
+if __name__ == '__main__':
+    with open('F:\\new.json') as json_file:
+        data = json.load(json_file)
+        print_keyvalue_all(data, '/')
diff --git a/server/services/user.py b/server/services/user.py
index 1d5055f..10f8150 100644
--- a/server/services/user.py
+++ b/server/services/user.py
@@ -7,7 +7,7 @@ from datetime import timedelta
 from flask import request, g
 
 from server.database import db_adapter
-from server.database import models
+from server.database.models import User
 from server.log import log
 from server.utils import get_now
 from server.utils.api_response import ok, bad_request, internal_server_error
@@ -31,6 +31,20 @@ class UserService(object):
                 "token": user_token.token()
             }
 
+    def get_user_info(self, id):
+        return db_adapter.get_first_object_by(User, d=id)
+
+    def get_user_list(self, filter_json):
+        sql_condition = 1 == 1
+        for condition in filter_json:
+            if condition == 'begin_time':
+                sql_condition = sql_condition, User.condition > filter_json['begin_time']
+            elif condition == 'end_time':
+                sql_condition = sql_condition, User.condition < filter_json['end_time']
+            else:
+                sql_condition = sql_condition, User.condition == filter_json['condition']
+        return db_adapter.get_all_objects(User, sql_condition)
+
     # --------------- helper private functions ---------------------#
 
     def __generate_api_token(self, user):
diff --git a/server/utils/__init__.py b/server/utils/__init__.py
index 3069ad8..872900e 100644
--- a/server/utils/__init__.py
+++ b/server/utils/__init__.py
@@ -3,14 +3,16 @@
 
 from datetime import datetime
 
+from server.config import config
+
 
 def get_now():
     return datetime.now()
 
 
-def get_config():
-    return None
+def get_config(key):
+    return config[key]
 
 
-def get_safe_config():
-    return None
+def get_safe_config(key, default=None):
+    return default if not config[key] else config[key]
diff --git a/server/utils/api_response.py b/server/utils/api_response.py
index 0bb334b..ebd30ff 100644
--- a/server/utils/api_response.py
+++ b/server/utils/api_response.py
@@ -62,4 +62,11 @@ def internal_server_error(message="",
     return __response_with_code(500, message, friendly_message)
 
 
+def insecurity_request(message="",
+                       friendly_message=(
+                           'Invalid request ipaddress which not in'
+                           'platform\'s white list.'
+                       )):
+    return __response_with_code(412, message, friendly_message)
+
 
diff --git a/server/utils/constants.py b/server/utils/constants.py
index 702d13a..40a96af 100644
--- a/server/utils/constants.py
+++ b/server/utils/constants.py
@@ -1,25 +1 @@
 # -*- coding: utf-8 -*-
-
-
-class VM(object):
-    OS_TYPE_LINUX = 0
-    OS_TYPE_WINDOWS = 1
-
-
-class NETWORK(object):
-    IP_TYPE_PUBLIC = 0
-    IP_TYPE_PRIVATE = 1
-
-
-class DISK(object):
-    TYPE_SYSTEM = 0
-    TYPE_MOUNTED = 1
-
-    FORMAT_NTFS = 0
-    FORMAT_EXT4 = 1
-
-
-class IMAGE(object):
-    TYPE_DEFAULT = 0  # Router or Monitor
-    TYPE_PROVIDER = 1  # vm images type
-    TYPE_CUSTOMIZE = 2   # created by users