fix 68500 【安全】手机号邮箱等敏感信息在数据库中不是加密存储

2023-05-05 11:38:11 +08:00
parent 7468e58c64
commit e172db2287
3 changed files with 111 additions and 2 deletions
@@ -300,7 +300,7 @@ public class SysUserController {
 //    @RequestMapping(value = "/queryById", method = RequestMethod.GET)
    @GetMapping("/queryById")
    public Results<SysUser> queryById(@RequestParam(name = "id", required = true) String id) {
-        SysUser sysUser = sysUserService.getById(id);
+        SysUser sysUser = sysUserService.queryById(id);
        if (sysUser == null) {
            return Results.error(INEXISTENCE);
        } else {
@@ -451,6 +451,10 @@ public class SysUserController {
                item.setOrgCodeTxt(useDepNames.get(item.getId()))
            );
        }
+        userList.forEach(user -> {
+            // 对手机号、邮箱进行解密处理
+            sysUserService.proceedDecrypt(user);
+        });

        try {
            result.setSuccess(true);
@@ -478,6 +482,10 @@ public class SysUserController {
            @RequestParam(name="realname",required=false) String realname,
            @RequestParam(name=USER_NAME,required=false) String username) {
        IPage<SysUser> pageList = sysUserDepartService.queryDepartUserPageList(departId, username, realname, pageSize, pageNo);
+        pageList.getRecords().forEach(user -> {
+            // 对手机号、邮箱进行解密处理
+            sysUserService.proceedDecrypt(user);
+        });
        return Results.OK(pageList);
    }

@@ -501,6 +509,10 @@ public class SysUserController {
       }
        //update-end--Author:kangxiaolin  Date:20180825 for：[03]用户导出，如果选择数据则只导出相关数据----------------------
        List<SysUser> pageList = sysUserService.list(queryWrapper);
+        pageList.forEach(user -> {
+            // 对手机号、邮箱进行解密处理
+            sysUserService.proceedDecrypt(user);
+        });

        //导出文件名称
        mv.addObject(JeroController.FILE_NAME, "用户列表");
@@ -577,6 +589,8 @@ public class SysUserController {
        successAndErrorLines.setSuccessLines(successLines);
        successAndErrorLines.setErrorLines(errorLines);
        try {
+            // 对手机号、邮箱进行加密处理
+            sysUserService.proceedEncrypt(sysUserExcel);
            sysUserService.save(sysUserExcel);
            successAndErrorLines.setSuccessLines(successLines + 1);
        } catch (Exception e) {
@@ -629,6 +643,9 @@ public class SysUserController {
 		String[] userId = userIds.split(",");
 		Collection<String> idList = Arrays.asList(userId);
 		Collection<SysUser> userRole = sysUserService.listByIds(idList);
+        userRole.forEach(user -> {
+            sysUserService.proceedDecrypt(user);
+        });
 		result.setSuccess(true);
 		result.setResult(userRole);
 		return result;
@@ -676,6 +693,9 @@ public class SysUserController {
        String roleId = req.getParameter("roleId");
        String username = req.getParameter(USER_NAME);
        IPage<SysUser> pageList = sysUserService.getUserByRoleId(page,roleId,username);
+        pageList.getRecords().forEach(user -> {
+            sysUserService.proceedDecrypt(user);
+        });
        result.setSuccess(true);
        result.setResult(pageList);
        return result;
@@ -793,6 +813,9 @@ public class SysUserController {
                    item.setOrgCode(useDepNames.get(item.getId()))
                );
            }
+            pageList.getRecords().forEach(user -> {
+                sysUserService.proceedDecrypt(user);
+            });
            result.setSuccess(true);
            result.setResult(pageList);
        }else{
@@ -278,4 +278,18 @@ public interface ISysUserService extends IService<SysUser> {
 	/** userId转为username */
 	List<String> userIdToUsername(Collection<String> userIdList);

+	/**
+	* @Remarks: 根据id查询
+	**/
+	SysUser queryById(String id);
+
+	/**
+	* @Remarks: 对手机号、邮箱进行解密处理
+	**/
+	void proceedDecrypt(SysUser user);
+
+	/**
+	 * @Remarks: 对手机号、邮箱进行加密处理
+	 **/
+	void proceedEncrypt(SysUser user);
 }
@@ -1,5 +1,6 @@
 package com.jero.modules.system.service.impl;

+import cn.hutool.core.util.StrUtil;
 import com.alibaba.fastjson.JSONObject;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
@@ -64,7 +65,12 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl

 	@Override
 	public IPage<SysUser> queryPage(Page<SysUser> page, List<String> subDepIds, String roleId, QueryWrapper<SysUser> queryWrapper){
-		return this.userMapper.queryPage(page, subDepIds, roleId, queryWrapper);
+		IPage<SysUser> sysUserIPage = this.userMapper.queryPage(page, subDepIds, roleId, queryWrapper);
+		sysUserIPage.getRecords().forEach(user -> {
+			// 对手机号、邮箱进行解密处理
+			proceedDecrypt(user);
+		});
+		return sysUserIPage;
 	}

    @Override
@@ -458,6 +464,8 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 	@Transactional(rollbackFor = Exception.class)
 	public void saveUser(SysUser user, String selectedRoles, String selectedDeparts) {
 		//step.1 保存用户
+		// 对手机号、邮箱进行加密处理
+		proceedEncrypt(user);
 		this.save(user);
 		//step.2 保存角色
 		if(oConvertUtils.isNotEmpty(selectedRoles)) {
@@ -477,11 +485,67 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 		}
 	}

+	/**
+	 * @Remarks: 对手机号、邮箱进行加密处理
+	 **/
+	@Override
+	public void proceedEncrypt(SysUser user) {
+		if (user == null) {
+			return;
+		}
+		String email = user.getEmail();
+		String phone = user.getPhone();
+		if (StrUtil.isNotEmpty(email)){
+			// 对邮箱地址进行加密
+			email = PasswordUtil.encrypt(email);
+			user.setEmail(email);
+		}
+
+		if (StrUtil.isNotEmpty(phone)){
+			// 对手机号码进行加密
+			phone = PasswordUtil.encrypt(phone);
+			user.setPhone(phone);
+		}
+	}
+
+	/**
+	 * @Remarks: 对手机号、邮箱进行解密处理
+	 **/
+	@Override
+	public void proceedDecrypt(SysUser user) {
+		if (user == null) {
+			return;
+		}
+		String email = user.getEmail();
+		String phone = user.getPhone();
+		if (StrUtil.isNotEmpty(email)){
+			// 对邮箱地址进行加密
+			try {
+				email = PasswordUtil.decrypt(email);
+			} catch (Exception e) {
+				email = user.getEmail();
+			}
+			user.setEmail(email);
+		}
+
+		if (StrUtil.isNotEmpty(phone)){
+			// 对手机号码进行加密
+			try {
+				phone = PasswordUtil.decrypt(phone);
+			} catch (Exception e) {
+				phone = user.getPhone();
+			}
+			user.setPhone(phone);
+		}
+	}
+
 	@Override
 	@Transactional(rollbackFor = Exception.class)
 	@CacheEvict(value={CacheConstant.SYS_USERS_CACHE}, allEntries=true)
 	public void editUser(SysUser user, String roles, String departs) {
 		//step.1 修改用户基础信息
+		// 对手机号、邮箱进行加密处理
+		proceedEncrypt(user);
 		this.updateById(user);
 		//step.2 修改角色
 		//处理用户角色 先删后加
@@ -523,5 +587,13 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 		return userList.stream().map(SysUser::getUsername).collect(Collectors.toList());
 	}

+	@Override
+	public SysUser queryById(String id) {
+		SysUser user = getById(id);
+		// 对手机号、邮箱进行解密处理
+		proceedDecrypt(user);
+		return user;
+	}
+

 }