提交漏洞修复代码

lib/EmergencyBaseLib/EmergencyCommon/src/main/java/com/zdxt/common/controller/BaseController.java

@@ -32,8 +32,8 @@ public class BaseController
         Integer pageSize = pageDomain.getPageSize();
         if (StringUtils.isNotNull(pageNum) && StringUtils.isNotNull(pageSize))
         {
-            String orderBy = SqlUtil.escapeOrderBySql(pageDomain.getOrderBy());
-            PageHelper.startPage(pageNum, pageSize, orderBy);
+//            String orderBy = SqlUtil.escapeOrderBySql(pageDomain.getOrderBy());
+            PageHelper.startPage(pageNum, pageSize);
         }
     }
 

lib/EmergencyService/pom.xml

@@ -449,11 +449,11 @@
             <artifactId>myexcel</artifactId>
             <version>3.9.1</version>
         </dependency>
-        <dependency>
-            <groupId>com.bstek.ureport</groupId>
-            <artifactId>ureport2-console</artifactId>
-            <version>2.2.9</version>
-        </dependency>
+<!--        <dependency>-->
+<!--            <groupId>com.bstek.ureport</groupId>-->
+<!--            <artifactId>ureport2-console</artifactId>-->
+<!--            <version>2.2.9</version>-->
+<!--        </dependency>-->
 
         <dependency>
             <groupId>com.googlecode.aviator</groupId>

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java

@@ -10,7 +10,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
-//@Component
+@Component
 public class CookieFilter implements Filter {
 
 
@@ -40,7 +40,6 @@ public class CookieFilter implements Filter {
                 System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue);
                 ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Lax").build();
                 httpResponse.addHeader(HttpHeaders.SET_COOKIE,lastCookie.toString());
-
             }
         }
 

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java

@@ -1,11 +1,16 @@
 package com.zdxt.auth.framework.config;
 
+import com.zdxt.auth.common.utils.security.ShiroUtils;
+import com.zdxt.auth.framework.shiro.jwt.JWTUtils;
+import com.zdxt.domain.auth.User;
 import org.springframework.stereotype.Component;
 
 import javax.servlet.*;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
 
 /**
  *  跨域配置
@@ -25,10 +30,26 @@ public class CorsFilter implements Filter {
         res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
         res.addHeader("X-Frame-Options", "SAMEORIGIN");
         res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
+        User user = ShiroUtils.getSysUser();
+//        Map<String,Object> payload = new HashMap<>();
+//        payload.put("id", user.getUserId());
+//        payload.put("name", user.getPassword());
+//        String token1 = JWTUtils.sign(payload);
+//        res.addHeader("token", token1);
+
+//        if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
+//            response.getWriter().println("ok");
+//            return;
+//        }
+        // 判断请求方法是否为OPTIONS
         if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
-            response.getWriter().println("ok");
+            // 设置响应头信息，禁止OPTIONS请求
+            res.setHeader("Allow", "GET, POST, HEAD, PUT, DELETE");
+            res.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
             return;
         }
+
+
         chain.doFilter(request, response);
     }
     @Override

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CsrfFilter.java

@@ -87,7 +87,7 @@ public class CsrfFilter implements Filter {
 
         String referer = request.getHeader("Referer");
         String serverName = request.getServerName();
-
+        log.info("CSRF拦截地址：{}",referer);
         // 判断是否存在外链请求本站
         if (null != referer  && ALLOWED_SERVERNAMES.indexOf(serverName) < 0) {
             log.error("CSRF过滤器 => 服务器：{} => 当前域名：{}", serverName, referer);
@@ -114,7 +114,7 @@ public class CsrfFilter implements Filter {
     /**
      * 判断是否为忽略的URL
      *
-     * @param urlPath URL路径
+     * @param  URL路径
      * @return true-忽略，false-过滤
      */
     private boolean isExcludeUrl(String url) {

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java

@@ -13,6 +13,7 @@ import com.zdxt.auth.common.utils.StringUtils;
 import com.zdxt.auth.common.xss.XssFilter;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.filter.CorsFilter;
 
 /**
  * Filter配置
@@ -71,7 +72,7 @@ public class FilterConfig
         config.addAllowedHeader("*");
         config.addAllowedMethod("*");
         source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
-        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter());
+        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
         bean.setOrder(0);
         return bean;
     }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java

@@ -0,0 +1,37 @@
+package com.zdxt.auth.framework.config;
+
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.Arrays;
+
+@Configuration
+public class GlobalCorsConfig {
+    @Bean
+    public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() {
+        FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>();
+        //添加CORS配置信息
+        CorsConfiguration corsConfiguration = new CorsConfiguration();
+        //允许的域，不要写*，否则cookie就无法使用了
+        corsConfiguration.addAllowedOrigin("*");
+        //允许的头信息
+        corsConfiguration.addAllowedHeader("*");
+        //允许的请求方式
+        corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE"));
+        //是否发送cookie信息
+        corsConfiguration.setAllowCredentials(true);
+        //预检请求的有效期，单位为秒
+        corsConfiguration.setMaxAge(3600L);
+
+        //添加映射路径，标识待拦截的请求
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", corsConfiguration);
+
+        corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source));
+        corsFilterFilterRegistrationBean.setOrder(-1);
+        return corsFilterFilterRegistrationBean;
+    }
+}

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java

@@ -5,10 +5,7 @@ import com.zdxt.common.config.RuoYiConfig;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
-import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.servlet.config.annotation.*;
 import com.zdxt.auth.common.constant.Constants;
 import com.zdxt.auth.framework.interceptor.RepeatSubmitInterceptor;
 
@@ -49,6 +46,15 @@ public class ResourcesConfig implements WebMvcConfigurer
         registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
     }
 
+    @Override
+    public void addCorsMappings(CorsRegistry registry){
+        registry.addMapping("/**")   //对哪种格式的路径进行跨域处理
+                .allowedHeaders("*")    //允许的请求头
+                .allowedMethods("GET", "POST", "PUT", "DELETE")    //允许的请求方法
+                .maxAge(1800)       //探测请求的有效期
+                .allowedOrigins("http://10.132.108.3:85","http://192.168.110.36:3301");  //支持的域
+    }
+
     /**
      * 自定义拦截规则
      */
@@ -57,7 +63,28 @@ public class ResourcesConfig implements WebMvcConfigurer
     {
 //        registry.addInterceptor(repeatSubmitInterceptor).addPathPatterns("/**");
         registry.addInterceptor(new JWTInterceptor())
-                .addPathPatterns("/app/**")
-                .excludePathPatterns("/app/thirdLogin/siqLogin", "/appLogin");// 除了登录放行，其他接口都token验证
+                .addPathPatterns("/**")
+                .excludePathPatterns("/app/thirdLogin/siqLogin", "/appLogin","/login","/index","/**/*.css",
+                        "/**/*.js", "/**/*.png", "/**/*.jpg",
+                        "/**/*.jpeg", "/**/*.gif", "/**/fonts/*",
+                        "/enterpriseInformation",
+                        "/code/registration",
+                        "/code/linkage",
+                        "/code/ruleList",
+                        "/code/LawEnforcementWarningList",
+                        "/system/dept",
+                        "/system/user",
+                        "/system/role",
+                        "/system/post",
+                        "/system/menu",
+                        "/monitor/operlog",
+                        "/monitor/logininfor",
+                        "/system/dict",
+                        "/system/config",
+                        "/monitor/job",
+                        "/statistical/analysis",
+                        "/statistical/view"
+                        );
+        // 除了登录放行，其他接口都token验证
     }
 }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/shiro/jwt/JWTInterceptor.java

@@ -22,6 +22,7 @@ public class JWTInterceptor implements HandlerInterceptor {
 
     @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+
         String token = request.getHeader("token");
         Map<String, Object> map = new HashMap<>();
 
@@ -29,6 +30,7 @@ public class JWTInterceptor implements HandlerInterceptor {
             JWTVerifier verify =  JWTUtils.verify(token);
             map.put("state", true);
             map.put("msg", "请求成功");
+            return true;
         }catch (SignatureGenerationException e){
             e.printStackTrace();
             map.put("msg","无效签名");

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/web/controller/BaseController.java

@@ -53,8 +53,8 @@ public class BaseController
         Integer pageSize = pageDomain.getPageSize();
         if (StringUtils.isNotNull(pageNum) && StringUtils.isNotNull(pageSize))
         {
-            String orderBy = SqlUtil.escapeOrderBySql(pageDomain.getOrderBy());
-            PageHelper.startPage(pageNum, pageSize, orderBy);
+//            String orderBy = SqlUtil.escapeOrderBySql(pageDomain.getOrderBy());
+            PageHelper.startPage(pageNum, pageSize);
         }
     }
 

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/dept/controller/DeptController.java

@@ -165,7 +165,7 @@ public class DeptController extends BaseController {
      */
     @Log(title = "部门管理", businessType = BusinessType.DELETE)
     @RequiresPermissions("system:dept:remove")
-    @GetMapping("/remove/{deptId}")
+//    @GetMapping("/remove/{deptId}")
     @ResponseBody
     public AjaxResult remove(@PathVariable("deptId") Long deptId)
     {

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/IndexController.java

@@ -1,9 +1,11 @@
 package com.zdxt.auth.project.system.user.controller;
 
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
 import com.zdxt.auth.common.utils.security.ShiroUtils;
+import com.zdxt.auth.framework.shiro.jwt.JWTUtils;
 import com.zdxt.auth.framework.web.domain.AjaxResult;
 import com.zdxt.auth.project.system.config.service.IConfigService;
 import com.zdxt.auth.project.system.menu.domain.MenuVo;
@@ -55,6 +57,11 @@ public class IndexController extends BaseController
         mmap.put("systemCode",systemCodeDtoList);
         mmap.put("copyrightYear", ruoYiConfig.getCopyrightYear());
         mmap.put("demoEnabled", ruoYiConfig.isDemoEnabled());
+        Map<String,Object> payload = new HashMap<>();
+        payload.put("id", user.getUserId());
+        payload.put("name", user.getPassword());
+        String token1 = JWTUtils.sign(payload);
+        mmap.put("token",token1);
         String index = configService.selectConfigByKey("style.work");
         return index;
     }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java

@@ -139,6 +139,13 @@ public class LoginController extends BaseController
                         map.put("userId", sysUser.getUserId());
                         map.put("compName",sysUser.getDept().getDeptName());
 
+                        Map<String,Object> payload = new HashMap<>();
+                        payload.put("id", sysUser.getUserId());
+                        payload.put("name", sysUser.getLoginName());
+                        String token1 = JWTUtils.sign(payload);
+
+                        userBean.setToken(token1);
+
                         result.put(AjaxResult.CODE_TAG, "200");
                         result.put(AjaxResult.MSG_TAG, "登录成功");
                         result.put(AjaxResult.DATA_TAG, userBean);
@@ -157,7 +164,8 @@ public class LoginController extends BaseController
                 //return null;
             } else { //PC
                 subject.login(token);
-                return success();
+
+                return success("登录成功");
             }
         } catch (AuthenticationException e) {
             String msg = "用户或密码错误";

lib/EmergencyService/zdxtEmergencyBootStart/src/main/java/com/zdxt/config/UreportConfig.java

@@ -4,7 +4,7 @@ import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.web.servlet.ServletRegistrationBean;
 import org.springframework.context.annotation.Bean;
 
-import com.bstek.ureport.console.UReportServlet;
+//import com.bstek.ureport.console.UReportServlet;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.ImportResource;
 
@@ -19,15 +19,15 @@ import javax.servlet.Servlet;
  * Time: 11:26
  */
 
-@ImportResource("classpath:ureport-console-context.xml")
-@EnableAutoConfiguration
-@Configuration
-public class UreportConfig {
-
-    @Bean
-    public ServletRegistrationBean<Servlet> buildUreportServlet(){
-        return new ServletRegistrationBean<Servlet>(new UReportServlet(), "/ureport/*");
-    }
-
-}
+//@ImportResource("classpath:ureport-console-context.xml")
+//@EnableAutoConfiguration
+//@Configuration
+//public class UreportConfig {
+//
+//    @Bean
+//    public ServletRegistrationBean<Servlet> buildUreportServlet(){
+//        return new ServletRegistrationBean<Servlet>(new UReportServlet(), "/ureport/*");
+//    }
+//
+//}
 

lib/EmergencyService/zdxtEmergencyBootStart/src/main/java/com/zdxt/config/UreportDataSource.java

@@ -1,12 +1,12 @@
 package com.zdxt.config;
 
-import com.bstek.ureport.definition.datasource.BuildinDatasource;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.stereotype.Component;
-
-import javax.sql.DataSource;
-import java.sql.Connection;
-import java.sql.SQLException;
+//import com.bstek.ureport.definition.datasource.BuildinDatasource;
+//import org.springframework.beans.factory.annotation.Autowired;
+//import org.springframework.stereotype.Component;
+//
+//import javax.sql.DataSource;
+//import java.sql.Connection;
+//import java.sql.SQLException;
 
 /**
  * Created with IntelliJ IDEA.
@@ -16,28 +16,28 @@ import java.sql.SQLException;
  * Time: 11:46
  */
 
-@Component
-public class UreportDataSource implements BuildinDatasource {
-    private static final String NAME = "MyDataSource";
-
-
-    @Autowired
-    private DataSource dataSource;
-
-    @Override
-    public String name() {
-        return NAME;
-    }
-
-    @Override
-    public Connection getConnection() {
-        try {
-            return dataSource.getConnection();
-        } catch (SQLException e) {
-
-            e.printStackTrace();
-        }
-        return null;
-
-    }
-}
+//@Component
+//public class UreportDataSource implements BuildinDatasource {
+//    private static final String NAME = "MyDataSource";
+//
+//
+//    @Autowired
+//    private DataSource dataSource;
+//
+//    @Override
+//    public String name() {
+//        return NAME;
+//    }
+//
+//    @Override
+//    public Connection getConnection() {
+//        try {
+//            return dataSource.getConnection();
+//        } catch (SQLException e) {
+//
+//            e.printStackTrace();
+//        }
+//        return null;
+//
+//    }
+//}

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/static/ruoyi/js/ry-ui.js

@@ -28,6 +28,12 @@ var table = {
 };
 
 (function ($) {
+    $.ajaxSetup({
+        cache: true,
+        headers: {
+            "token": window.parent.token
+        },
+    });
     $.extend({
     	_tree: {},
     	bttTable: {},

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/static/ruoyi/js/zdxtUtil.js

@@ -29,6 +29,13 @@ var table = {
 
 (function ($) {
 	// $('body').css('font-size', '15px');
+
+    $.ajaxSetup({
+        cache: true,
+        headers: {
+            "token": window.parent.token
+        },
+    });
     $.extend({
     	_tree: {},
     	bttTable: {},

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html

@@ -380,6 +380,8 @@
     // var historyPath = storage.get("historyPath");
     // 排除非左侧菜单链接
     var excludesUrl = ["/system/user/profile"];
+    var token = [[${token}]];
+    console.log(token);
 
     // 本地主题优先，未设置取系统配置
     if ($.common.isNotEmpty(skin)) {
@@ -419,6 +421,12 @@
 
     $(function () {
         $('#page-wrapper').css({"margin": "0 0 0 0px"});
+        $.ajaxSetup({
+            cache: true,
+            headers: {
+                "token": token
+            },
+        });
         // promptCalls();
         // $('#page-wrapper').width("100%")
         // if($.common.equals("history", mode) && window.performance.navigation.type == 1) {
@@ -639,7 +647,6 @@
                 }
                 if(result.code == 1){
                     location.href = ctx + 'login-1.html';
-
                 }
             }
 

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html

@@ -88,8 +88,14 @@
                 //"rememberMe": rememberMe
             },
             success: function(r) {
+                console.log(r);
                 if (r.code == 0) {
+
+                    $.ajaxSettings.beforeSend =function(xhr,request){
+                        xhr.setRequestHeader("token",r.data);
+                    }
                     location.href = ctx + 'index';
+
                 } else {
                     layer.msg(r.msg)
                 }

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/project/code/registration/registration.html

@@ -67,7 +67,7 @@
             </div>
         </div>
     </div>
-    <th:block th:include="include :: footer" />
+    <th:block th:include="zdxtInclude :: footer" />
     <script th:inline="javascript">
         var editFlag = [[${@permission.hasPermi('code:registration:edit')}]];
         var removeFlag = [[${@permission.hasPermi('code:registration:remove')}]];