diff --git a/crm_config.json b/crm_config.json
index 98601b6..def196b 100644
--- a/crm_config.json
+++ b/crm_config.json
@@ -3,5 +3,5 @@
     "UserName": "wechat",
     "UserPass": "crmwechat.api",
     "AttachmentCache" : "/tmp/",
-    "CacheSiteURL": "http://wechat.hitxy.org.au/crmcache"
+    "CacheSiteURL": "http://192.168.1.39:65500/crmcache"
 }
\ No newline at end of file
diff --git a/crmcache.go b/crmcache.go
index c3c212a..3805d19 100644
--- a/crmcache.go
+++ b/crmcache.go
@@ -7,10 +7,12 @@ import (
 )
 
 func crmcache(w http.ResponseWriter, r *http.Request) {
-	// if !checkSignature(r) {
-	// 	w.WriteHeader(http.StatusUnauthorized)
-	// 	fmt.Fprintf(w, "Expired or invalid link")
-	// }
+	debugDumpHTTPRequest(r)
+	if !checkSignatureByToken(r, IntraAPIConfig.CRMSecrete) {
+		w.WriteHeader(http.StatusUnauthorized)
+		fmt.Fprintf(w, "Expired or invalid link")
+		return
+	}
 
 	v, err := url.ParseQuery(r.URL.RawQuery)
 	if err != nil {
diff --git a/procGetBasicUserInfo.go b/procGetBasicUserInfo.go
index e59034c..14711c0 100644
--- a/procGetBasicUserInfo.go
+++ b/procGetBasicUserInfo.go
@@ -61,7 +61,8 @@ func (m crmdLead) getBasicUserInfoPhoto() (ret sendNewsArticle) {
 	a.Description = ""
 	a.PicURL = m.avatarCacheURL()
 	a.Title = m.Name
-	a.URL = ""
+	a.URL = m.avatarCacheURL()
+	log.Println(a.URL)
 	return a
 }