feat: PDF预览安全问题

laws-modules-docking/src/main/java/com/jero/modules/docking/srms/service/impl/SrmsApiServiceImpl.java

@@ -190,7 +190,7 @@ public class SrmsApiServiceImpl implements SrmsApiService {
                 re = loginService.srmsByToken(byTokenRequests.getUsername());
                 String token = re.getResult().get("token").toString();
                 String viewKey = token + "-X";
-                redisUtil.set(viewKey, token, 3600);
+                redisUtil.set(viewKey, token, 24 * 60 * 60);
             }
             return re;
         } catch (Exception e) {

laws-modules/src/main/java/com/jero/modules/sys/controller/SysCommonController.java

@@ -3,9 +3,11 @@ package com.jero.modules.sys.controller;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.jero.common.constant.CommonConstant;
 import com.jero.common.exception.JeroBootException;
 import com.jero.common.util.IntekeyUtils;
 import com.jero.common.util.MinioUtil;
+import com.jero.common.util.RedisUtil;
 import com.jero.modules.laws.enterprise.service.EnterpriseStandardAuthUserService;
 import com.jero.modules.laws.standard.entity.LawsEnterpriseStandard;
 import com.jero.modules.laws.standard.service.ILawsEnterpriseStandardService;
@@ -52,6 +54,9 @@ public class SysCommonController {
     @Resource
     private EnterpriseStandardAuthUserService authUserService;
 
+    @Resource
+    private RedisUtil redisUtil;
+
 
     /**
      * 下载文件
@@ -98,9 +103,28 @@ public class SysCommonController {
      */
     @GetMapping(value = "/view/{id}")
     public void view(@PathVariable String id, HttpServletRequest request, HttpServletResponse response) {
+        if (!this.viewAuth(request)) {
+            noAuthFile(response, "预览无权限.pdf");
+            return;
+        }
         downloadAndViewWithWaterMark(id, response);
     }
 
+
+    private boolean viewAuth(HttpServletRequest request) {
+        String token = request.getHeader(CommonConstant.X_ACCESS_TOKEN);
+        String at = request.getParameter(CommonConstant.AT);
+        if (StrUtil.isBlank(at)) {
+            return false;
+        }
+        if (StrUtil.isBlank(token)) {
+            // 判断是否是外部系统对接的账户
+            Object o = redisUtil.get(at + "-X");
+            return null != o;
+        }
+        return at.equals(token);
+    }
+
     private void downloadAndViewWithWaterMark(@PathVariable String id, HttpServletResponse response) {
         // 查询数据表数据是否存在
         LambdaQueryWrapper<OSSFile> queryWrapper = new LambdaQueryWrapper<>();
@@ -117,21 +141,8 @@ public class SysCommonController {
                 String userId = UserUtils.getUserId();
                 boolean auth = authUserService.detailPermissionByUser(standardId, null, userId);
                 if (!auth) {
-                    // 返回固定无权限pdf模板
-                    try (InputStream inputStream = new ClassPathResource("pdfTemplate/暂无该文件查看权限.pdf").getInputStream();
-                         OutputStream outputStream = response.getOutputStream()
-                    ) {
-                        byte[] buf = new byte[1024];
-                        int len;
-                        while ((len = inputStream.read(buf)) > 0) {
-                            outputStream.write(buf, 0, len);
-                        }
-                        response.flushBuffer();
-                        return;
-                    } catch (Exception e) {
-                        log.error(e.getMessage());
-                        response.setStatus(404);
-                    }
+                    noAuthFile(response, "暂无该文件查看权限.pdf");
+                    return;
                 }
             }
         }
@@ -199,4 +210,21 @@ public class SysCommonController {
     }
 
 
+    private static void noAuthFile(HttpServletResponse response, String fileName) {
+        // 返回固定无权限pdf模板
+        try (InputStream inputStream = new ClassPathResource("pdfTemplate/" + fileName).getInputStream();
+             OutputStream outputStream = response.getOutputStream()
+        ) {
+            byte[] buf = new byte[1024];
+            int len;
+            while ((len = inputStream.read(buf)) > 0) {
+                outputStream.write(buf, 0, len);
+            }
+            response.flushBuffer();
+        } catch (Exception e) {
+            log.error(e.getMessage());
+            response.setStatus(404);
+        }
+    }
+
 }