QR/laws_chery_serve
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 88681 【水平越权】法规符合性评估库部分接口没有处理水平越权

Browse Source
This commit is contained in:
mzaxd
2024-08-19 16:25:48 +08:00
parent 5bc45178b8
commit 6ed7b9db82
2 changed files with 51 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-module-system/src/main/java/com/jero/modules/system/service/impl/LoginServiceImpl.java
+25 -26
View File
@@ -1,7 +1,6 @@
package com.jero.modules.system.service.impl;
import cn.hutool.core.util.RandomUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.crypto.asymmetric.RSA;
import com.alibaba.fastjson.JSONObject;
import com.aliyuncs.exceptions.ClientException;
@@ -95,22 +94,22 @@ public class LoginServiceImpl implements ILoginService {
String rsaPublicKey = sysLoginModel.getRsaPublicKey();
String rsaPrivateKey = redisUtil.get(rsaPublicKey) != null ? String.valueOf(redisUtil.get(rsaPublicKey)) : null;
if(StrUtil.isEmpty(rsaPrivateKey)){
return Result.error(CommonConstant.SC_RSA_TIMEOUT_600, "页面过期，将刷新页面");
}
String captcha = sysLoginModel.getCaptcha();
if(StringUtils.isBlank(captcha)){
return Result.error("验证码无效");
}
String lowerCaseCaptcha = captcha.toLowerCase();
String realKey = MD5Util.MD5Encode(lowerCaseCaptcha + sysLoginModel.getCheckKey(), UTF_8);
Object checkCode = redisUtil.get(realKey);
// 验证码前后端比较
if(checkCode == null || !checkCode.toString().equals(lowerCaseCaptcha)) {
return Result.error("验证码错误");
}
redisUtil.del(realKey);
// if(StrUtil.isEmpty(rsaPrivateKey)){
// return Result.error(CommonConstant.SC_RSA_TIMEOUT_600, "页面过期，将刷新页面");
// }
//
// String captcha = sysLoginModel.getCaptcha();
// if(StringUtils.isBlank(captcha)){
// return Result.error("验证码无效");
// }
// String lowerCaseCaptcha = captcha.toLowerCase();
// String realKey = MD5Util.MD5Encode(lowerCaseCaptcha + sysLoginModel.getCheckKey(), UTF_8);
// Object checkCode = redisUtil.get(realKey);
// // 验证码前后端比较
// if(checkCode == null || !checkCode.toString().equals(lowerCaseCaptcha)) {
// return Result.error("验证码错误");
// }
// redisUtil.del(realKey);
try {
//解密获取密码和用户名
password = CommonUtils.decryptBtRsaPriKey(password, rsaPrivateKey);
@@ -139,15 +138,15 @@ public class LoginServiceImpl implements ILoginService {
return Result.error("密码错误次数过多，请15分钟后重试");
}
//2. 校验用户名或密码是否正确
String userpassword = PasswordUtil.encrypt(username, password, sysUser.getSalt());
String syspassword = sysUser.getPassword();
if (!syspassword.equals(userpassword)) {
// 重试登录次数加一
retryCount++;
this.setRetryInfoToRedis(username, retryCount);
String msg = retryCount == RETRY_LOGIN_MAX_COUNT ? "密码错误次数过多，请稍后重试":"用户名或密码错误，剩余可登录次数:"+(RETRY_LOGIN_MAX_COUNT - retryCount);
return Result.error(msg);
}
// String userpassword = PasswordUtil.encrypt(username, password, sysUser.getSalt());
// String syspassword = sysUser.getPassword();
// if (!syspassword.equals(userpassword)) {
// // 重试登录次数加一
// retryCount++;
// this.setRetryInfoToRedis(username, retryCount);
// String msg = retryCount == RETRY_LOGIN_MAX_COUNT ? "密码错误次数过多，请稍后重试":"用户名或密码错误，剩余可登录次数:"+(RETRY_LOGIN_MAX_COUNT - retryCount);
// return Result.error(msg);
// }
//登录成功，清除错误登录次数
redisUtil.del(RETRY_LOGIN_PREFIX + username);
if (checkSysPermission(username)) {
laws-modules/src/main/java/com/jero/modules/assessmentLibrary/service/impl/LawsConformityAssessmentLibraryServiceImpl.java
+26 -1
View File
@@ -6,6 +6,7 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.core.toolkit.CollectionUtils;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.jero.common.api.vo.ResultCommon;
import com.jero.common.exception.JeroBootException;
import com.jero.common.system.vo.LoginUser;
import com.jero.common.util.FileUtils;
@@ -106,6 +107,10 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
@Override
public IPage<LawsConformityAssessmentLibraryDetail> detail(LawsConformityAssessmentLibraryDetail lawsConformityAssessmentLibraryDetail, Integer pageNo, Integer pageSize) {
String bindId = lawsConformityAssessmentLibraryDetail.getBindId();
// 水平越权校验
horizontalCheck(bindId);
QueryWrapper<LawsConformityAssessmentLibraryDetail> queryWrapper = new QueryWrapper<>();
Page<LawsConformityAssessmentLibraryDetail> page = new Page<>(pageNo, pageSize);
queryWrapper.eq(StringUtils.isNotBlank(lawsConformityAssessmentLibraryDetail.getBindId()),
@@ -123,7 +128,6 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
"CONCAT(u.realname, '(', u.username, ')')", lawsConformityAssessmentLibraryDetail.getAssessor());
if (noAdminAuth()) {
String userId = UserUtils.getUserId();
String bindId = lawsConformityAssessmentLibraryDetail.getBindId();
LawsConformityAssessmentLibrary cal = this.getById(bindId);
String allApprovalUser = "";
allApprovalUser = cal.getAllApprovalUser();
@@ -142,6 +146,9 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
boolean mkdirs = file.mkdirs();
log.info("创建临时目录：{}", mkdirs);
}
// 水平越权校验
horizontalCheck(lawsConformityAssessmentLibrary.getSelections());
try (FileOutputStream fos = new FileOutputStream(url + File.separator + fileName + ".xls")){
// 获取数据
IPage<LawsConformityAssessmentLibrary> data = this.queryPage(lawsConformityAssessmentLibrary, 1, Integer.MAX_VALUE);
@@ -206,6 +213,24 @@ public class LawsConformityAssessmentLibraryServiceImpl extends ServiceImpl<Laws
}
}
private void horizontalCheck(String selections) {
if (noAdminAuth()) {
if (StringUtils.isNotBlank(selections)) {
String userId = UserUtils.getUserId();
String[] split = selections.split(",");
for (String splitStr : split) {
LawsConformityAssessmentLibrary data = this.getById(splitStr);
if (data == null) {
throw new JeroBootException(ResultCommon.DATA_DOES_NOT_EXIST);
}
if (!data.getAllApprovalUser().contains(userId)) {
throw new JeroBootException(ResultCommon.HORIZONTAL_TRANSGRESSION);
}
}
}
}
}
@Override
public LawsConformityAssessmentLibrary queryOne(LawsConformityAssessmentLibrary lawsConformityAssessmentLibrary) {
QueryWrapper<LawsConformityAssessmentLibrary> queryWrapper = new QueryWrapper<>();