fix 68500 【安全】手机号邮箱等敏感信息在数据库中不是加密存储

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java

@@ -300,7 +300,7 @@ public class SysUserController {
 //    @RequestMapping(value = "/queryById", method = RequestMethod.GET)
     @GetMapping("/queryById")
     public Results<SysUser> queryById(@RequestParam(name = "id", required = true) String id) {
-        SysUser sysUser = sysUserService.getById(id);
+        SysUser sysUser = sysUserService.queryById(id);
         if (sysUser == null) {
             return Results.error(INEXISTENCE);
         } else {
@@ -451,6 +451,10 @@ public class SysUserController {
                 item.setOrgCodeTxt(useDepNames.get(item.getId()))
             );
         }
+        userList.forEach(user -> {
+            // 对手机号、邮箱进行解密处理
+            sysUserService.proceedDecrypt(user);
+        });
 
         try {
             result.setSuccess(true);
@@ -478,6 +482,10 @@ public class SysUserController {
             @RequestParam(name="realname",required=false) String realname,
             @RequestParam(name=USER_NAME,required=false) String username) {
         IPage<SysUser> pageList = sysUserDepartService.queryDepartUserPageList(departId, username, realname, pageSize, pageNo);
+        pageList.getRecords().forEach(user -> {
+            // 对手机号、邮箱进行解密处理
+            sysUserService.proceedDecrypt(user);
+        });
         return Results.OK(pageList);
     }
 
@@ -501,6 +509,10 @@ public class SysUserController {
        }
         //update-end--Author:kangxiaolin  Date:20180825 for：[03]用户导出，如果选择数据则只导出相关数据----------------------
         List<SysUser> pageList = sysUserService.list(queryWrapper);
+        pageList.forEach(user -> {
+            // 对手机号、邮箱进行解密处理
+            sysUserService.proceedDecrypt(user);
+        });
 
         //导出文件名称
         mv.addObject(JeroController.FILE_NAME, "用户列表");
@@ -577,6 +589,8 @@ public class SysUserController {
         successAndErrorLines.setSuccessLines(successLines);
         successAndErrorLines.setErrorLines(errorLines);
         try {
+            // 对手机号、邮箱进行加密处理
+            sysUserService.proceedEncrypt(sysUserExcel);
             sysUserService.save(sysUserExcel);
             successAndErrorLines.setSuccessLines(successLines + 1);
         } catch (Exception e) {
@@ -629,6 +643,9 @@ public class SysUserController {
 		String[] userId = userIds.split(",");
 		Collection<String> idList = Arrays.asList(userId);
 		Collection<SysUser> userRole = sysUserService.listByIds(idList);
+        userRole.forEach(user -> {
+            sysUserService.proceedDecrypt(user);
+        });
 		result.setSuccess(true);
 		result.setResult(userRole);
 		return result;
@@ -676,6 +693,9 @@ public class SysUserController {
         String roleId = req.getParameter("roleId");
         String username = req.getParameter(USER_NAME);
         IPage<SysUser> pageList = sysUserService.getUserByRoleId(page,roleId,username);
+        pageList.getRecords().forEach(user -> {
+            sysUserService.proceedDecrypt(user);
+        });
         result.setSuccess(true);
         result.setResult(pageList);
         return result;
@@ -793,6 +813,9 @@ public class SysUserController {
                     item.setOrgCode(useDepNames.get(item.getId()))
                 );
             }
+            pageList.getRecords().forEach(user -> {
+                sysUserService.proceedDecrypt(user);
+            });
             result.setSuccess(true);
             result.setResult(pageList);
         }else{

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/service/ISysUserService.java

@@ -278,4 +278,18 @@ public interface ISysUserService extends IService<SysUser> {
 	/** userId转为username */
 	List<String> userIdToUsername(Collection<String> userIdList);
 
+	/**
+	* @Remarks: 根据id查询
+	**/
+	SysUser queryById(String id);
+
+	/**
+	* @Remarks: 对手机号、邮箱进行解密处理
+	**/
+	void proceedDecrypt(SysUser user);
+
+	/**
+	 * @Remarks: 对手机号、邮箱进行加密处理
+	 **/
+	void proceedEncrypt(SysUser user);
 }

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/service/impl/SysUserServiceImpl.java

@@ -1,5 +1,6 @@
 package com.jero.modules.system.service.impl;
 
+import cn.hutool.core.util.StrUtil;
 import com.alibaba.fastjson.JSONObject;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
@@ -64,7 +65,12 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 
 	@Override
 	public IPage<SysUser> queryPage(Page<SysUser> page, List<String> subDepIds, String roleId, QueryWrapper<SysUser> queryWrapper){
-		return this.userMapper.queryPage(page, subDepIds, roleId, queryWrapper);
+		IPage<SysUser> sysUserIPage = this.userMapper.queryPage(page, subDepIds, roleId, queryWrapper);
+		sysUserIPage.getRecords().forEach(user -> {
+			// 对手机号、邮箱进行解密处理
+			proceedDecrypt(user);
+		});
+		return sysUserIPage;
 	}
 
     @Override
@@ -458,6 +464,8 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 	@Transactional(rollbackFor = Exception.class)
 	public void saveUser(SysUser user, String selectedRoles, String selectedDeparts) {
 		//step.1 保存用户
+		// 对手机号、邮箱进行加密处理
+		proceedEncrypt(user);
 		this.save(user);
 		//step.2 保存角色
 		if(oConvertUtils.isNotEmpty(selectedRoles)) {
@@ -477,11 +485,67 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 		}
 	}
 
+	/**
+	 * @Remarks: 对手机号、邮箱进行加密处理
+	 **/
+	@Override
+	public void proceedEncrypt(SysUser user) {
+		if (user == null) {
+			return;
+		}
+		String email = user.getEmail();
+		String phone = user.getPhone();
+		if (StrUtil.isNotEmpty(email)){
+			// 对邮箱地址进行加密
+			email = PasswordUtil.encrypt(email);
+			user.setEmail(email);
+		}
+
+		if (StrUtil.isNotEmpty(phone)){
+			// 对手机号码进行加密
+			phone = PasswordUtil.encrypt(phone);
+			user.setPhone(phone);
+		}
+	}
+
+	/**
+	 * @Remarks: 对手机号、邮箱进行解密处理
+	 **/
+	@Override
+	public void proceedDecrypt(SysUser user) {
+		if (user == null) {
+			return;
+		}
+		String email = user.getEmail();
+		String phone = user.getPhone();
+		if (StrUtil.isNotEmpty(email)){
+			// 对邮箱地址进行加密
+			try {
+				email = PasswordUtil.decrypt(email);
+			} catch (Exception e) {
+				email = user.getEmail();
+			}
+			user.setEmail(email);
+		}
+
+		if (StrUtil.isNotEmpty(phone)){
+			// 对手机号码进行加密
+			try {
+				phone = PasswordUtil.decrypt(phone);
+			} catch (Exception e) {
+				phone = user.getPhone();
+			}
+			user.setPhone(phone);
+		}
+	}
+
 	@Override
 	@Transactional(rollbackFor = Exception.class)
 	@CacheEvict(value={CacheConstant.SYS_USERS_CACHE}, allEntries=true)
 	public void editUser(SysUser user, String roles, String departs) {
 		//step.1 修改用户基础信息
+		// 对手机号、邮箱进行加密处理
+		proceedEncrypt(user);
 		this.updateById(user);
 		//step.2 修改角色
 		//处理用户角色 先删后加
@@ -523,5 +587,13 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 		return userList.stream().map(SysUser::getUsername).collect(Collectors.toList());
 	}
 
+	@Override
+	public SysUser queryById(String id) {
+		SysUser user = getById(id);
+		// 对手机号、邮箱进行解密处理
+		proceedDecrypt(user);
+		return user;
+	}
+
 
 }