sec: 预览安全问题

laws-base/laws-base-core/src/main/java/com/jero/common/constant/CommonConstant.java

@@ -303,6 +303,7 @@ public class CommonConstant {
     public static final String X_ACCESS_TOKEN = "X-Access-Token";
     // common/view 预览接口用的token
     public static final String AT = "at";
+    public static final String TIME = "time";
     public static final String X_SIGN = "X-Sign";
     public static final String X_TIMESTAMP = "X-TIMESTAMP";
 

laws-modules/src/main/java/com/jero/modules/sys/controller/SysCommonController.java

@@ -3,9 +3,11 @@ package com.jero.modules.sys.controller;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.jero.common.constant.CommonConstant;
 import com.jero.common.exception.JeroBootException;
 import com.jero.common.util.IntekeyUtils;
 import com.jero.common.util.MinioUtil;
+import com.jero.common.util.RedisUtil;
 import com.jero.modules.laws.enterprise.service.EnterpriseStandardAuthUserService;
 import com.jero.modules.laws.standard.entity.LawsEnterpriseStandard;
 import com.jero.modules.laws.standard.service.ILawsEnterpriseStandardService;
@@ -52,6 +54,9 @@ public class SysCommonController {
     @Resource
     private EnterpriseStandardAuthUserService authUserService;
 
+    @Resource
+    private RedisUtil redisUtil;
+
 
     /**
      * 下载文件
@@ -98,9 +103,29 @@ public class SysCommonController {
      */
     @GetMapping(value = "/view/{id}")
     public void view(@PathVariable String id, HttpServletRequest request, HttpServletResponse response) {
+        if (!this.viewAuth(request)) {
+            noAuthFile(response, "预览无权限.pdf");
+            return;
+        }
         downloadAndViewWithWaterMark(id, response);
     }
 
+    private boolean viewAuth(HttpServletRequest request) {
+        String at = request.getParameter(CommonConstant.AT);
+        String time = request.getParameter(CommonConstant.TIME);
+        if (StrUtil.isBlank(time)) {
+            return true;
+        } else {
+            // 判断是否是外部系统对接的账户
+            Object o = redisUtil.get(at + "-" + time);
+            if (o == null) {
+                redisUtil.set(at + "-" + time, "1", 60 * 60 * 24 * 7);
+                return true;
+            }
+            return false;
+        }
+    }
+
     private void downloadAndViewWithWaterMark(@PathVariable String id, HttpServletResponse response) {
         // 查询数据表数据是否存在
         LambdaQueryWrapper<OSSFile> queryWrapper = new LambdaQueryWrapper<>();
@@ -117,21 +142,8 @@ public class SysCommonController {
                 String userId = UserUtils.getUserId();
                 boolean auth = authUserService.detailPermissionByUser(standardId, null, userId);
                 if (!auth) {
-                    // 返回固定无权限pdf模板
-                    try (InputStream inputStream = new ClassPathResource("pdfTemplate/暂无该文件查看权限.pdf").getInputStream();
-                         OutputStream outputStream = response.getOutputStream()
-                    ) {
-                        byte[] buf = new byte[1024];
-                        int len;
-                        while ((len = inputStream.read(buf)) > 0) {
-                            outputStream.write(buf, 0, len);
-                        }
-                        response.flushBuffer();
-                        return;
-                    } catch (Exception e) {
-                        log.error(e.getMessage());
-                        response.setStatus(404);
-                    }
+                    noAuthFile(response, "暂无该文件查看权限.pdf");
+                    return;
                 }
             }
         }
@@ -198,5 +210,22 @@ public class SysCommonController {
         }
     }
 
+    private static void noAuthFile(HttpServletResponse response, String fileName) {
+        // 返回固定无权限pdf模板
+        try (InputStream inputStream = new ClassPathResource("pdfTemplate/" + fileName).getInputStream();
+             OutputStream outputStream = response.getOutputStream()
+        ) {
+            byte[] buf = new byte[1024];
+            int len;
+            while ((len = inputStream.read(buf)) > 0) {
+                outputStream.write(buf, 0, len);
+            }
+            response.flushBuffer();
+        } catch (Exception e) {
+            log.error(e.getMessage());
+            response.setStatus(404);
+        }
+    }
+
 
 }