提交漏洞修复代码

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java

@@ -61,21 +61,22 @@ public class FilterConfig
         registration.setOrder(1); // 值越小，Filter越靠前。
         return registration;
     }
-    @Bean
-    public FilterRegistrationBean corsNewFilter() {
-        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-        CorsConfiguration config = new CorsConfiguration();
-        config.setAllowCredentials(true);
-        config.addAllowedOrigin("http://10.132.108.3:85");
-        config.addAllowedOrigin("http://10.132.108.3:80");
-        config.addAllowedOrigin("http://10.132.108.3:81");
-        config.addAllowedHeader("*");
-        config.addAllowedMethod("*");
-        source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
-        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
-        bean.setOrder(0);
-        return bean;
-    }
+//    @Bean
+//    public FilterRegistrationBean corsNewFilter() {
+//        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+//        CorsConfiguration config = new CorsConfiguration();
+//        config.setAllowCredentials(true);
+//        config.addAllowedOrigin("http://10.132.108.3:85");
+//        config.addAllowedOrigin("http://10.132.108.3:80");
+//        config.addAllowedOrigin("http://10.132.108.3:81");
+//        config.addAllowedOrigin("http://192.168.244.1:3301");
+//        config.addAllowedHeader("*");
+//        config.addAllowedMethod("*");
+//        source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
+//        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
+//        bean.setOrder(0);
+//        return bean;
+//    }
 
 
 }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java

@@ -51,7 +51,7 @@ public class ResourcesConfig implements WebMvcConfigurer
         registry.addMapping("/**")   //对哪种格式的路径进行跨域处理
                 .allowedHeaders("*")    //允许的请求头
                 .allowedOrigins("*") //支持的域
-                .allowedMethods("GET", "POST", "PUT", "DELETE","oprion")    //允许的请求方法
+                .allowedMethods("GET", "POST", "PUT", "DELETE")    //允许的请求方法
                 .maxAge(1800);    //探测请求的有效期
 
     }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java

@@ -8,6 +8,7 @@ import com.zdxt.auth.framework.shiro.jwt.JWTUtils;
 import com.zdxt.auth.framework.shiro.nopaddword.LoginType;
 import com.zdxt.auth.framework.shiro.nopaddword.UserToken;
 import com.zdxt.auth.framework.shiro.service.PasswordService;
+import com.zdxt.auth.project.system.user.domain.LoginDTO;
 import com.zdxt.auth.project.system.user.service.ITcUserCidService;
 import com.zdxt.auth.project.system.user.service.IUserService;
 import com.zdxt.auth.project.system.user.util.AesHelper;
@@ -24,6 +25,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.ResponseBody;
 import com.zdxt.auth.common.utils.ServletUtils;
 import com.zdxt.auth.common.utils.StringUtils;
@@ -177,20 +179,20 @@ public class LoginController extends BaseController
 
     @PostMapping("/appLogin")
     @ResponseBody
-    public AjaxResult appLogin(String secretName, String secretKey) {
+    public AjaxResult appLogin(@RequestBody LoginDTO loginDTO) {
         SecurityUtils.getSubject().logout();
 //        username = username.toUpperCase();
         //解密
-        secretKey = AesHelper.desEncrypt(secretKey);
+        loginDTO.setSecretKey(AesHelper.desEncrypt(loginDTO.getSecretKey()));
 //        UsernamePasswordToken token = new UsernamePasswordToken(username, password, false);
-        UserToken token = new UserToken(secretName, secretKey, LoginType.PASSWORD);
+        UserToken token = new UserToken(loginDTO.getSecretName(), loginDTO.getSecretKey(), LoginType.PASSWORD);
         Subject subject = SecurityUtils.getSubject();
         try {
              //PC
             subject.login(token);
 
             // 把 tonken 塞进去
-            User userDB = iUserService.selectUserByLoginName(secretName);
+            User userDB = iUserService.selectUserByLoginName(loginDTO.getSecretName());
             Map<String,Object> payload = new HashMap<>();
             payload.put("id", userDB.getUserId());
             payload.put("name", userDB.getLoginName());

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/application.yml

@@ -202,7 +202,7 @@ security:
 
 
 allowed:
-  servernames: localhost,127.0.0.1,139.186.135.156,10.132.108.3,10.76.108.1
+  servernames: 10.132.108.3,10.76.108.1,192.168.110.36,192.168.244.1,192.168.1.101,139.186.135.156
 
 excel:
   export: true

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html

@@ -58,9 +58,9 @@
 </script>
 <script>
     $(function(){
+        console.log(document.cookie);
         /*登录*/
         $("#login").click(function(){
-            debugger
             login();
         })