diff --git a/app/common/model/system/merchant/Merchant.php b/app/common/model/system/merchant/Merchant.php
index 43c7c2af..48ccaec5 100644
--- a/app/common/model/system/merchant/Merchant.php
+++ b/app/common/model/system/merchant/Merchant.php
@@ -191,6 +191,11 @@ class Merchant extends BaseModel
         return $this->hasOne(MerchantType::class, 'mer_type_id', 'type_id');
     }
 
+    public function user()
+    {
+        return $this->hasOne(User::class, 'uid', 'uid');
+    }
+
     public function typeName()
     {
         return $this->merchantType()->bind(['type_name']);
diff --git a/app/controller/api/Auth.php b/app/controller/api/Auth.php
index 7cf584f5..d888a167 100644
--- a/app/controller/api/Auth.php
+++ b/app/controller/api/Auth.php
@@ -211,6 +211,13 @@ class Auth extends BaseController
         }else{
             $data['show_controller_applet']=false;
         }
+        //提现密码
+        if($data['withdrawal_pwd']){
+            $data['withdrawal_pwd'] = 1;
+        }else{
+            $data['withdrawal_pwd'] = 0;
+        }
+
         return app('json')->success($data);
     }
 
diff --git a/app/controller/api/store/merchant/Merchant.php b/app/controller/api/store/merchant/Merchant.php
index 3eb23a2c..ebf147ea 100644
--- a/app/controller/api/store/merchant/Merchant.php
+++ b/app/controller/api/store/merchant/Merchant.php
@@ -144,7 +144,7 @@ class Merchant extends BaseController
 
     public function apply($merId)
     {
-        $merchant = app()->make(MerchantRepository::class)->search(['mer_id' => $merId])->field('uid,mer_id,mer_name,mer_money,financial_bank,financial_wechat,financial_alipay,financial_type,ot_margin')->find();
+            $merchant = app()->make(MerchantRepository::class)->search(['mer_id' => $merId])->field('uid,mer_id,mer_name,mer_money,financial_bank,financial_wechat,financial_alipay,financial_type,ot_margin')->find();
         if (($msg = $this->checkAuth($merchant)) !== true) {
             return app('json')->fail($msg);
         }
@@ -175,7 +175,13 @@ class Merchant extends BaseController
 
     public function createApply($merId)
     {
-        $data = $this->request->param(['extract_money', 'financial_type', 'financial_bank_name', 'financial_bank_bank', 'financial_bank_code', 'financial_bank_branch']);
+        $data = $this->request->param(['extract_money', 'financial_type', 'financial_bank_name', 'financial_bank_bank', 'financial_bank_code', 'financial_bank_branch,withdrawal_pwd']);
+        $withdrawal_pwd = $data['withdrawal_pwd'];
+        if(empty($withdrawal_pwd)) return \app('json')->fail('请输入提现密码');
+        //找到商户的密码
+        $userInfo = \app\common\model\system\merchant\Merchant::getDB()->with('user')->where('mer_id',$merId)->find()->toArray();
+        if (!password_verify($pwd = (string)$withdrawal_pwd, $userInfo['user']['withdrawal_pwd']))
+            return app('json')->fail('提现密码错误');
         $merchant = app()->make(MerchantRepository::class)->search(['mer_id' => $merId])->field('reg_admin_id,uid,mer_id,mer_name,mer_money,financial_bank,financial_wechat,financial_alipay,financial_type')->find();
         if (($msg = $this->checkAuth($merchant)) !== true) {
             return app('json')->fail($msg);
diff --git a/app/controller/api/user/User.php b/app/controller/api/user/User.php
index 54f83a89..93d4bdb1 100644
--- a/app/controller/api/user/User.php
+++ b/app/controller/api/user/User.php
@@ -378,6 +378,44 @@ class User extends BaseController
         return app('json')->success('绑定成功');
     }
 
+    //设置提现密码
+    public function set_withdrawalPassword()
+    {
+        $data = $this->request->params([ 'password','repassword']);
+        if (empty($data['repassword']) || empty($data['password']))
+            return app('json')->fail('请输入提现密码');
+        if ($data['repassword'] !== $data['password'])
+            return app('json')->fail('两次密码不一致');
+        $password = $this->repository->encodePassword($data['password']);
+        $this->repository->update($this->request->uid(), ['withdrawal_pwd' => $password]);
+        return app('json')->success('设置成功');
+    }
+
+
+    //修改
+    public function withdrawalPassword()
+    {
+        $data = $this->request->params(['repassword', 'password', 'sms_code']);
+        if (!$this->user->phone)
+            return app('json')->fail('请先绑定手机号');
+        if (empty($data['repassword']) || empty($data['password']))
+            return app('json')->fail('请输入提现密码');
+        if ($data['repassword'] !== $data['password'])
+            return app('json')->fail('两次密码不一致');
+
+        $sms_code = app()->make(SmsService::class)->checkSmsCode($this->user->phone, $data['sms_code'], 'change_pwd');
+        if (!$data['sms_code'] || !$sms_code)
+            return app('json')->fail('验证码不正确');
+
+        $password = $this->repository->encodePassword($data['password']);
+
+        $this->repository->update($this->request->uid(), ['withdrawal_pwd' => $password]);
+        return app('json')->success('绑定成功');
+
+    }
+
+
+
     public function changePhone()
     {
         $data = $this->request->params(['phone', 'sms_code']);
diff --git a/route/api.php b/route/api.php
index 3c34e37f..0899daad 100644
--- a/route/api.php
+++ b/route/api.php
@@ -29,6 +29,9 @@ Route::group('api/', function () {
     Route::get('category/list_level', 'api.server.StoreCategory/list_level');
     //强制登录
     Route::group(function () {
+
+        Route::get('scanPay/qrcode', 'api.store.order.ScanPay/qrcode');//商家二维码
+
         Route::group('v2', function () {
             //新的下单接口,支持分账
             Route::group('order', function () {
@@ -122,6 +125,8 @@ Route::group('api/', function () {
             Route::post('change/info', 'User/updateBaseInfo');
             Route::post('change/password', 'User/changePassword');
             Route::post('change/bind_promotion_code', 'User/bindPromotionCode');
+            Route::post('change/withdrawal_pwd', 'User/withdrawalPassword');//更改提现密码
+            Route::post('set/withdrawal_pwd', 'User/set_withdrawalPassword');//设置提现密码
             //收藏
             Route::get('/relation/product/lst', 'UserRelation/productList');
             Route::get('/relation/merchant/lst', 'UserRelation/merchantList');