From 9f12748260612a3a5029e3e346224ccb54e503b4 Mon Sep 17 00:00:00 2001 From: zer0Black Date: Tue, 30 May 2023 16:34:17 +0800 Subject: [PATCH] =?UTF-8?q?=E3=80=90fix=E3=80=91=E5=A4=84=E7=90=86csrf?= =?UTF-8?q?=E7=9A=84bug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/java/com/jero/config/filter/csrf/CsrfFilter.java | 2 +- .../src/main/java/com/jero/JeroSystemSingleApplication.java | 2 +- .../src/main/resources/application-dev.yml | 4 ++-- .../src/main/resources/application-prod.yml | 2 +- .../src/main/resources/application-test.yml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java index c40e84f3..9e76d8f0 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java @@ -78,7 +78,7 @@ public class CsrfFilter implements Filter { private boolean isWhiteReq(String referUrl) { try { if (referUrl == null || "".equals(referUrl) || size == 0) { - return false; + return true; } else { String refHost = ""; referUrl = referUrl.toLowerCase(); diff --git a/jero-boot/jero-boot-single-startup/src/main/java/com/jero/JeroSystemSingleApplication.java b/jero-boot/jero-boot-single-startup/src/main/java/com/jero/JeroSystemSingleApplication.java index 182fc42c..110fad48 100644 --- a/jero-boot/jero-boot-single-startup/src/main/java/com/jero/JeroSystemSingleApplication.java +++ b/jero-boot/jero-boot-single-startup/src/main/java/com/jero/JeroSystemSingleApplication.java @@ -36,7 +36,7 @@ public class JeroSystemSingleApplication extends SpringBootServletInitializer { "Application jero-boot is running! Access URLs:\n\t" + "Local: \t\thttp://localhost:" + port + path + "\n\t" + "External: \thttp://" + ip + ":" + port + path + "\n\t" + - "Swagger文档: \thttp://" + ip + ":" + port + path + "doc.html\n" + + "Swagger文档: \thttp://" + ip + ":" + port + path + "/doc.html\n" + "----------------------------------------------------------"); } diff --git a/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml b/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml index 5f93c5ae..685afc34 100644 --- a/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml +++ b/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml @@ -272,13 +272,13 @@ jero: # 文件限制后缀黑名单 fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin # 跨站白名单 - whiteUrls: localhost:3000 + whiteUrls: localhost:3000,localhost:8080 # xss白名单 xssExcludedPages: /login,/updatePassword # cors白名单 notFilter: # origin地址 - originIp: http://localhost:3000 + originIp: http://localhost:3000, # 加密默认值 password: pbe: diff --git a/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml b/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml index fe2b5ebe..36497f9a 100644 --- a/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml +++ b/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml @@ -273,7 +273,7 @@ jero: # 文件限制后缀黑名单 fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin # 跨站白名单 - whiteUrls: + whiteUrls: localhost:3000,localhost:8080 # xss白名单 xssExcludedPages: /login,/updatePassword # cors白名单 diff --git a/jero-boot/jero-boot-single-startup/src/main/resources/application-test.yml b/jero-boot/jero-boot-single-startup/src/main/resources/application-test.yml index b72cab39..9f1b07e7 100644 --- a/jero-boot/jero-boot-single-startup/src/main/resources/application-test.yml +++ b/jero-boot/jero-boot-single-startup/src/main/resources/application-test.yml @@ -272,7 +272,7 @@ jero: # 文件限制后缀黑名单 fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin # 跨站白名单 - whiteUrls: localhost:3000 + whiteUrls: localhost:3000,localhost:8080 # xss白名单 xssExcludedPages: /login,/updatePassword # cors白名单