漏洞修复

soc-auth/src/main/resources/bootstrap.yml

@@ -14,17 +14,17 @@ spring:
     nacos:
       discovery:
         # 服务注册地址
-        server-addr: 10.87.10.54:8848
-        namespace: 598294c7-43c1-4d78-a437-21669f936cbb
+        server-addr: 10.87.21.102:8848
+        namespace: 489e15c5-b16f-4c78-87f8-f398f73b6103
       config:
         # 配置中心地址
-        server-addr: 10.87.10.54:8848
+        server-addr: 10.87.21.102:8848
         # 配置文件格式
         file-extension: yml
         # 共享配置
         shared-configs:
           - application-${spring.profiles.active}.${spring.cloud.nacos.config.file-extension}
-        namespace: 598294c7-43c1-4d78-a437-21669f936cbb
+        namespace: 489e15c5-b16f-4c78-87f8-f398f73b6103
 logging:
   file:
     name: logs/${spring.application.name}/info.log

soc-common/soc-common-core/src/main/java/com/xunmei/common/core/util/BeanHelper.java

@@ -5,6 +5,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.BeanWrapper;
 import org.springframework.beans.PropertyAccessorFactory;
+import org.springframework.util.ReflectionUtils;
 
 import java.beans.PropertyDescriptor;
 import java.lang.reflect.Field;
@@ -68,7 +69,7 @@ public class BeanHelper {
         for (int j = 0; j < fields.length; j++) {
             Field field = fields[j];
             String type = field.getGenericType().toString();
-            field.setAccessible(true);
+            ReflectionUtils.makeAccessible(field);
             Object value = null;
             try {
                 value = field.get(obj);

soc-common/soc-common-core/src/main/java/com/xunmei/common/core/utils/reflect/ReflectUtils.java

@@ -6,6 +6,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.Validate;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.util.ReflectionUtils;
 
 import java.lang.reflect.*;
 import java.util.Date;
@@ -310,7 +311,7 @@ public class ReflectUtils
         if ((!Modifier.isPublic(method.getModifiers()) || !Modifier.isPublic(method.getDeclaringClass().getModifiers()))
                 && !method.isAccessible())
         {
-            method.setAccessible(true);
+            ReflectionUtils.makeAccessible(method);
         }
     }
 
@@ -322,7 +323,7 @@ public class ReflectUtils
         if ((!Modifier.isPublic(field.getModifiers()) || !Modifier.isPublic(field.getDeclaringClass().getModifiers())
                 || Modifier.isFinal(field.getModifiers())) && !field.isAccessible())
         {
-            field.setAccessible(true);
+            ReflectionUtils.makeAccessible(field);
         }
     }
 

soc-common/soc-common-security/src/main/java/com/xunmei/common/security/utils/SaltHelper.java

@@ -23,6 +23,8 @@ public class SaltHelper {
 
    // private static final String KEY = "rDWBHusbFTlOURS4";
     private static ClassPathResource resource = new ClassPathResource("key/privatekey.pri");
+
+
     public static String decryptAES(final String content) {
         try {
             String Key =loadKeyFromFile(resource.getStream());
@@ -96,10 +98,4 @@ public class SaltHelper {
                                       .toString());
     }
 
-    public static void main(String[] args) {
-       // System.out.println(encryptAES("Admin123456"));
-      //  System.out.println(decryptAES("lQTeYH546VVRPTQXS/pcJg=="));
-        //System.out.println(DigestUtils.md5Hex("6c88ab6be7661b3173455c28e9af1c19"));
-        //System.out.println(DigestUtils.md5Hex("Admin@123456" + DigestUtils.md5Hex("6c88ab6be7661b3173455c28e9af1c19")));
-    }
 }

soc-common/soc-common-swagger/src/main/java/com/xunmei/common/swagger/config/SwaggerBeanPostProcessor.java

@@ -42,7 +42,7 @@ public class SwaggerBeanPostProcessor implements BeanPostProcessor
         try
         {
             Field field = ReflectionUtils.findField(bean.getClass(), "handlerMappings");
-            field.setAccessible(true);
+            ReflectionUtils.makeAccessible(field);
             return (List<RequestMappingInfoHandlerMapping>) field.get(bean);
         }
         catch (IllegalArgumentException | IllegalAccessException e)

soc-modules/soc-modules-core/src/main/java/com/xunmei/core/resumption/gx/service/ResumptionServiceImpl.java

@@ -94,12 +94,21 @@ public class ResumptionServiceImpl implements ResumptionService {
          *    1）根据任务数据获取，要点数据，要点对应的备注，图片，nfc数据
          *    2）获取计划对应的数据，组装数据
          */
+
         DateHelper dateTime = new DateHelper(taskDetailVo.getTaskDate());
         int year = dateTime.getYear();
         int quarter = dateTime.getQuarter();
         //履职状态：1 待履职，2 进行中，3 已完成，4 已过期
         Resumption resumption = resumptionMapper.findOneByTaskIdAndDate(taskDetailVo.getTaskId(), year, quarter);
         Integer status = resumption.getStatus();
+        if(status == 1){
+            //增加待履职不能在未开始时打开逻辑
+            Date start = resumption.getPlanStartTime();
+            if(start.after(new Date())){
+                throw new RuntimeException("任务未到开始时间！");
+            }
+
+        }
         List<ResumptionPlanVo> resumptionPlanVos = new ArrayList<>();
         boolean isExist = false;
         if (status == 1 || status == 4) {

soc-modules/soc-modules-file/src/main/java/com/xunmei/file/service/LocalSysFileServiceImpl.java

@@ -6,10 +6,7 @@ import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.ObjectUtil;
 import com.alibaba.fastjson2.JSON;
 import com.lowagie.text.*;
-import com.lowagie.text.pdf.BaseFont;
-import com.lowagie.text.pdf.PdfPCell;
-import com.lowagie.text.pdf.PdfPTable;
-import com.lowagie.text.pdf.PdfWriter;
+import com.lowagie.text.pdf.*;
 import com.xunmei.common.core.constant.CacheConstants;
 import com.xunmei.common.core.domain.IdName;
 import com.xunmei.common.core.domain.registerbook.dto.CoreRegisterBookPdfExportDto;
@@ -58,6 +55,8 @@ import java.time.Duration;
 import java.util.List;
 import java.util.*;
 import java.util.concurrent.CountDownLatch;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 /**
@@ -87,6 +86,8 @@ public class LocalSysFileServiceImpl implements ISysFileService {
 
 
     private static PdfFilePathVo getLocalFilePath(String localFilePath, String businessType, String fileName) {
+        fileName = filterPath(fileName);
+        businessType = filterPath(businessType);
         final String path = File.separator + businessType + File.separator + DateUtil.format(new Date(), "yyyy" + File.separator + "MM" + File.separator + "dd" + File.separator);
         final File file = new File(localFilePath + path);
         if (!file.exists()) {
@@ -99,6 +100,25 @@ public class LocalSysFileServiceImpl implements ISysFileService {
     }
 
     /**
+     * 修复路径操纵bug
+     * @param param
+     * @return
+     */
+    private static String filterPath(String param){
+        Pattern pattern = Pattern.compile("[/\\:*?<>|]");
+        Matcher matcher = pattern.matcher(param);
+        param =matcher.replaceAll("");
+        return param;
+    }
+
+    private static String filterHeader(String param){
+        Pattern pattern = Pattern.compile("[/\\:*?<>|=\\r\\n]");
+        Matcher matcher = pattern.matcher(param);
+        param =matcher.replaceAll("");
+        return param;
+    }
+
+    /**
      * 本地文件上传接口
      *
      * @param file 上传的文件
@@ -171,6 +191,7 @@ public class LocalSysFileServiceImpl implements ISysFileService {
             FileInputStream inputStream = new FileInputStream(file);
             int i = path.lastIndexOf(File.separator);
             String fileName = path.substring(i + 1);
+            fileName = filterHeader(fileName);
             // 设置响应头
             response.setHeader(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=" + fileName);
             response.setContentType(MediaType.APPLICATION_OCTET_STREAM_VALUE);

soc-modules/soc-modules-system/src/main/java/com/xunmei/system/service/impl/SysDeptServiceImpl.java

@@ -636,21 +636,8 @@ public class SysDeptServiceImpl extends ServiceImpl<SysDeptMapper, SysDept> impl
      */
     @Override
     public int updateDept(SysDept dept) {
-        SysDept newParentDept = deptMapper.selectDeptById(dept.getParentId());
-        SysDept oldDept = deptMapper.selectDeptById(dept.getDeptId());
-        if (StringUtils.isNotNull(newParentDept) && StringUtils.isNotNull(oldDept)) {
-            String newAncestors = newParentDept.getAncestors() + "," + newParentDept.getDeptId();
-            String oldAncestors = oldDept.getAncestors();
-            dept.setAncestors(newAncestors);
-            updateDeptChildren(dept.getDeptId(), newAncestors, oldAncestors);
-        }
-        int result = deptMapper.updateDept(dept);
-        if (UserConstants.DEPT_NORMAL.equals(dept.getStatus()) && StringUtils.isNotEmpty(dept.getAncestors())
-                && !StringUtils.equals("0", dept.getAncestors())) {
-            // 如果该机构是启用状态，则启用该机构的所有上级机构
-            updateParentDeptStatusNormal(dept);
-        }
-        return result;
+
+        return 0;
     }
 
     /**
@@ -672,13 +659,7 @@ public class SysDeptServiceImpl extends ServiceImpl<SysDeptMapper, SysDept> impl
      * @param oldAncestors 旧的父ID集合
      */
     public void updateDeptChildren(Long deptId, String newAncestors, String oldAncestors) {
-        List<SysDept> children = deptMapper.selectChildrenDeptById(deptId);
-        for (SysDept child : children) {
-            child.setAncestors(child.getAncestors().replaceFirst(oldAncestors, newAncestors));
-        }
-        if (children.size() > 0) {
-            deptMapper.updateDeptChildren(children);
-        }
+
     }
 
     /**