Skip to content

Commit 62a813d

Browse files
huanzi-qchhuanzi-qch
committed
1、修改调整前端文件后拦截路径错误bug；
2、系统设置新增API加密开关，可一键关闭、开启API加密；
1 parent afa0c0b commit 62a813d

27 files changed

Lines changed: 429 additions & 248 deletions

‎src/main/java/cn/huanzi/qch/baseadmin/BaseAdminApplication.java‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@
88
import cn.huanzi.qch.baseadmin.sys.sysuser.service.SysUserService;
99
import cn.huanzi.qch.baseadmin.sys.sysuser.vo.SysUserVo;
1010
import cn.huanzi.qch.baseadmin.sys.sysusermenu.service.SysUserMenuService;
11-
import cn.huanzi.qch.baseadmin.util.RsaUtil;
12-
import cn.huanzi.qch.baseadmin.util.SecurityUtil;
13-
import cn.huanzi.qch.baseadmin.util.VerifyCodeImageUtil;
11+
import cn.huanzi.qch.baseadmin.util.*;
1412
import lombok.extern.slf4j.Slf4j;
1513
import org.springframework.beans.factory.annotation.Autowired;
1614
import org.springframework.beans.factory.annotation.Value;
@@ -83,11 +81,16 @@ class IndexController {
8381
public ApplicationRunner applicationRunner() {
8482
return applicationArguments -> {
8583
try {
86-
InetAddress ia = InetAddress.getLocalHost();
84+
//系统启动时获取数据库数据，设置到公用静态集合sysSettingMap
85+
SysSettingVo sysSettingVo = sysSettingService.get("1").getData();
86+
sysSettingVo.setUserInitPassword(null);//隐藏部分属性
87+
SysSettingUtil.setSysSettingMap(sysSettingVo);
88+
8789
//获取本机内网IP
88-
log.info("启动成功：" + "http://" + ia.getHostAddress() + ":" + port + "/");
89-
} catch (UnknownHostException ex) {
90-
ex.printStackTrace();
90+
log.info("启动成功：" + "http://" + InetAddress.getLocalHost().getHostAddress() + ":" + port + "/");
91+
} catch (UnknownHostException e) {
92+
//输出到日志文件中
93+
log.error(ErrorUtil.errorInfoToString(e));
9194
}
9295
};
9396
}
@@ -100,9 +103,7 @@ public ModelAndView login(){
100103
ModelAndView modelAndView = new ModelAndView("login");
101104

102105
//系统信息
103-
SysSettingVo sysSettingVo = sysSettingService.get("1").getData();
104-
sysSettingVo.setUserInitPassword(null);//隐藏部分属性
105-
modelAndView.addObject("sys", sysSettingVo);
106+
modelAndView.addObject("sys", SysSettingUtil.getSysSetting());
106107

107108
//后端公钥
108109
String publicKey = RsaUtil.getPublicKey();
@@ -121,17 +122,16 @@ public void index1(HttpServletResponse response){
121122
try {
122123
response.sendRedirect("/index");
123124
} catch (IOException e) {
124-
e.printStackTrace();
125+
//输出到日志文件中
126+
log.error(ErrorUtil.errorInfoToString(e));
125127
}
126128
}
127129
@GetMapping("index")
128130
public ModelAndView index(){
129131
ModelAndView modelAndView = new ModelAndView("index");
130132

131133
//系统信息
132-
SysSettingVo sysSettingVo = sysSettingService.get("1").getData();
133-
sysSettingVo.setUserInitPassword(null);//隐藏部分属性
134-
modelAndView.addObject("sys", sysSettingVo);
134+
modelAndView.addObject("sys", SysSettingUtil.getSysSetting());
135135

136136
//登录用户
137137
SysUserVo sysUserVo = sysUserService.findByLoginName(SecurityUtil.getLoginUser().getUsername()).getData();

‎src/main/java/cn/huanzi/qch/baseadmin/aspect/SafetyAspect.java‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44
import cn.huanzi.qch.baseadmin.annotation.Encrypt;
55
import cn.huanzi.qch.baseadmin.common.pojo.Result;
66
import cn.huanzi.qch.baseadmin.util.AesUtil;
7+
import cn.huanzi.qch.baseadmin.util.ErrorUtil;
78
import cn.huanzi.qch.baseadmin.util.RsaUtil;
9+
import cn.huanzi.qch.baseadmin.util.SysSettingUtil;
810
import com.fasterxml.jackson.databind.DeserializationFeature;
911
import com.fasterxml.jackson.databind.ObjectMapper;
1012
import lombok.extern.slf4j.Slf4j;
@@ -46,7 +48,13 @@ public void safetyAspect() {}
4648
*/
4749
@Around(value = "safetyAspect()")
4850
public Object around(ProceedingJoinPoint pjp) {
49-
try {
51+
try {
52+
53+
//判断api加密开关是否开启
54+
if("N".equals(SysSettingUtil.getSysSetting().getSysApiEncrypt())){
55+
return pjp.proceed(pjp.getArgs());
56+
}
57+
5058
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
5159
assert attributes != null;
5260
//request对象
@@ -140,8 +148,8 @@ public Object around(ProceedingJoinPoint pjp) {
140148
return o;
141149

142150
} catch (Throwable e) {
143-
log.error(pjp.getSignature().toString());
144-
e.printStackTrace();
151+
//输出到日志文件中
152+
log.error(ErrorUtil.errorInfoToString(e));
145153
return Result.of(null, false, "加解密异常：\n\t" + e.getMessage());
146154
}
147155
}

‎src/main/java/cn/huanzi/qch/baseadmin/common/service/CommonServiceImpl.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55
import cn.huanzi.qch.baseadmin.common.pojo.Result;
66
import cn.huanzi.qch.baseadmin.common.repository.CommonRepository;
77
import cn.huanzi.qch.baseadmin.util.CopyUtil;
8+
import cn.huanzi.qch.baseadmin.util.ErrorUtil;
89
import cn.huanzi.qch.baseadmin.util.UUIDUtil;
10+
import lombok.extern.slf4j.Slf4j;
911
import org.hibernate.annotations.NotFound;
1012
import org.springframework.beans.BeanUtils;
1113
import org.springframework.beans.factory.annotation.Autowired;
@@ -29,6 +31,7 @@
2931
* @param <E> 实体类
3032
* @param <T> id主键类型
3133
*/
34+
@Slf4j
3235
public class CommonServiceImpl<V, E, T> implements CommonService<V, E, T> {
3336

3437
private Class<V> entityVoClass;//实体类Vo
@@ -134,7 +137,8 @@ public Result<V> save(V entityVo) {
134137
*/
135138
BeanUtils.copyProperties(entity, entityFull, ignoreProperties.toArray(new String[0]));
136139
} catch (IllegalAccessException e) {
137-
e.printStackTrace();
140+
//输出到日志文件中
141+
log.error(ErrorUtil.errorInfoToString(e));
138142
}
139143

140144
E e = commonRepository.save(entityFull);

‎src/main/java/cn/huanzi/qch/baseadmin/config/logback/LoggingWSServer.java‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package cn.huanzi.qch.baseadmin.config.logback;
22

33

4+
import cn.huanzi.qch.baseadmin.util.ErrorUtil;
45
import lombok.extern.slf4j.Slf4j;
56
import org.springframework.beans.factory.annotation.Value;
67
import org.springframework.stereotype.Component;
@@ -118,12 +119,14 @@ public void onOpen(Session session) {
118119
//休眠一秒
119120
Thread.sleep(1000);
120121
} catch (Exception e) {
121-
//捕获但不处理
122-
e.printStackTrace();
122+
//输出到日志文件中
123+
log.error(ErrorUtil.errorInfoToString(e));
123124
} finally {
124125
try {
125126
reader.close();
126-
} catch (IOException ignored) {
127+
} catch (IOException e) {
128+
//输出到日志文件中
129+
log.error(ErrorUtil.errorInfoToString(e));
127130
}
128131
}
129132
}
@@ -164,7 +167,8 @@ private void send(Session session, String message) {
164167
try {
165168
session.getBasicRemote().sendText(message);
166169
} catch (Exception e) {
167-
e.printStackTrace();
170+
//输出到日志文件中
171+
log.error(ErrorUtil.errorInfoToString(e));
168172
}
169173
}
170174
}

‎src/main/java/cn/huanzi/qch/baseadmin/config/security/CaptchaFilterConfig.java‎

Lines changed: 60 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22

33
import cn.huanzi.qch.baseadmin.common.pojo.ParameterRequestWrapper;
44
import cn.huanzi.qch.baseadmin.util.AesUtil;
5+
import cn.huanzi.qch.baseadmin.util.ErrorUtil;
56
import cn.huanzi.qch.baseadmin.util.RsaUtil;
7+
import cn.huanzi.qch.baseadmin.util.SysSettingUtil;
68
import com.fasterxml.jackson.databind.DeserializationFeature;
79
import com.fasterxml.jackson.databind.ObjectMapper;
810
import lombok.extern.slf4j.Slf4j;
@@ -43,72 +45,82 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
4345
//jackson 序列化和反序列化 date处理
4446
mapper.setDateFormat(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"));
4547

46-
//解密
47-
try {
48-
//AES加密后的数据
49-
String data = request.getParameter("data");
50-
//后端RSA公钥加密后的AES的key
51-
String aesKey = request.getParameter("aesKey");
52-
//前端公钥
53-
publicKey = request.getParameter("publicKey");
54-
55-
log.info("前端公钥：" + publicKey);
56-
57-
//后端私钥解密的到AES的key
58-
byte[] plaintext = RsaUtil.decryptByPrivateKey(Base64.decodeBase64(aesKey), RsaUtil.getPrivateKey());
59-
aesKey = new String(plaintext);
60-
log.info("解密出来的AES的key：" + aesKey);
61-
62-
//RSA解密出来字符串多一对双引号
63-
aesKey = aesKey.substring(1, aesKey.length() - 1);
64-
65-
//AES解密得到明文data数据
66-
String decrypt = AesUtil.decrypt(data, aesKey);
67-
log.info("解密出来的data数据：" + decrypt);
68-
69-
//设置到方法的形参中，目前只能设置只有一个参数的情况
70-
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
71-
72-
//new一个自定义RequestWrapper
73-
HashMap hashMap = mapper.readValue(decrypt, HashMap.class);
74-
ParameterRequestWrapper parameterRequestWrapper = new ParameterRequestWrapper(request);
75-
for (Object key : hashMap.keySet()) {
76-
parameterRequestWrapper.addParameter((String) key, hashMap.get(key));
77-
}
48+
//判断api加密开关是否开启
49+
if("Y".equals(SysSettingUtil.getSysSetting().getSysApiEncrypt())){
50+
//解密
51+
try {
52+
//AES加密后的数据
53+
String data = request.getParameter("data");
54+
//后端RSA公钥加密后的AES的key
55+
String aesKey = request.getParameter("aesKey");
56+
//前端公钥
57+
publicKey = request.getParameter("publicKey");
58+
59+
log.info("前端公钥：" + publicKey);
60+
61+
//后端私钥解密的到AES的key
62+
byte[] plaintext = RsaUtil.decryptByPrivateKey(Base64.decodeBase64(aesKey), RsaUtil.getPrivateKey());
63+
aesKey = new String(plaintext);
64+
log.info("解密出来的AES的key：" + aesKey);
65+
66+
//RSA解密出来字符串多一对双引号
67+
aesKey = aesKey.substring(1, aesKey.length() - 1);
68+
69+
//AES解密得到明文data数据
70+
String decrypt = AesUtil.decrypt(data, aesKey);
71+
log.info("解密出来的data数据：" + decrypt);
72+
73+
//设置到方法的形参中，目前只能设置只有一个参数的情况
74+
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
7875

79-
servletRequest = parameterRequestWrapper;
80-
request = (HttpServletRequest) servletRequest;
81-
} catch (Throwable e) {
82-
e.printStackTrace();
76+
//new一个自定义RequestWrapper
77+
HashMap hashMap = mapper.readValue(decrypt, HashMap.class);
78+
ParameterRequestWrapper parameterRequestWrapper = new ParameterRequestWrapper(request);
79+
for (Object key : hashMap.keySet()) {
80+
parameterRequestWrapper.addParameter((String) key, hashMap.get(key));
81+
}
82+
83+
servletRequest = parameterRequestWrapper;
84+
request = (HttpServletRequest) servletRequest;
85+
} catch (Throwable e) {
86+
//输出到日志文件中
87+
log.error(ErrorUtil.errorInfoToString(e));
88+
}
8389
}
8490

8591
//从session中获取生成的验证码
8692
String verifyCode = request.getSession().getAttribute("verifyCode").toString();
8793

8894
if (captchaEnable && !verifyCode.toLowerCase().equals(request.getParameter("captcha").toLowerCase())) {
89-
//加密
90-
try {
95+
String dataString = "{\"code\":\"400\",\"msg\":\"验证码错误\"}";
96+
97+
//判断api加密开关是否开启
98+
if("Y".equals(SysSettingUtil.getSysSetting().getSysApiEncrypt())){
99+
//加密
100+
try {
91101
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
92102
//每次响应之前随机获取AES的key，加密data数据
93103
String key = AesUtil.getKey();
94104
log.info("AES的key：" + key);
95-
String dataString = "{\"code\":\"400\",\"msg\":\"验证码错误\"}";
96105
log.info("需要加密的data数据：" + dataString);
97106
String data = AesUtil.encrypt(dataString, key);
98107

99108
//用前端的公钥来解密AES的key，并转成Base64
100109
String aesKey = Base64.encodeBase64String(RsaUtil.encryptByPublicKey(key.getBytes(), publicKey));
101-
102-
//转json字符串并转成Object对象，设置到Result中并赋值给返回值o
103-
response.setCharacterEncoding("UTF-8");
104-
response.setContentType("application/json; charset=utf-8");
105-
PrintWriter out = response.getWriter();
106-
out.print("{\"data\":{\"data\":\"" + data + "\",\"aesKey\":\"" + aesKey + "\"}}");
107-
out.flush();
108-
out.close();
110+
dataString = "{\"data\":{\"data\":\"" + data + "\",\"aesKey\":\"" + aesKey + "\"}}";
109111
} catch (Throwable e) {
110-
e.printStackTrace();
112+
//输出到日志文件中
113+
log.error(ErrorUtil.errorInfoToString(e));
114+
}
111115
}
116+
117+
//转json字符串并转成Object对象，设置到Result中并赋值给返回值o
118+
response.setCharacterEncoding("UTF-8");
119+
response.setContentType("application/json; charset=utf-8");
120+
PrintWriter out = response.getWriter();
121+
out.print(dataString);
122+
out.flush();
123+
out.close();
112124
return;
113125
}
114126
}

‎src/main/java/cn/huanzi/qch/baseadmin/config/security/LoginFailureHandlerConfig.java‎

Lines changed: 39 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
package cn.huanzi.qch.baseadmin.config.security;
22

33
import cn.huanzi.qch.baseadmin.util.AesUtil;
4+
import cn.huanzi.qch.baseadmin.util.ErrorUtil;
45
import cn.huanzi.qch.baseadmin.util.RsaUtil;
6+
import cn.huanzi.qch.baseadmin.util.SysSettingUtil;
57
import com.fasterxml.jackson.databind.DeserializationFeature;
68
import com.fasterxml.jackson.databind.ObjectMapper;
79
import lombok.extern.slf4j.Slf4j;
@@ -12,6 +14,7 @@
1214

1315
import javax.servlet.http.HttpServletRequest;
1416
import javax.servlet.http.HttpServletResponse;
17+
import java.io.IOException;
1518
import java.io.PrintWriter;
1619
import java.text.SimpleDateFormat;
1720

@@ -22,40 +25,44 @@
2225
@Slf4j
2326
public class LoginFailureHandlerConfig implements AuthenticationFailureHandler {
2427
@Override
25-
public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) {
28+
public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException {
2629
String msg = "{\"code\":\"400\",\"msg\":\"用户名或密码错误\"}";
2730

28-
//加密
29-
30-
//前端公钥
31-
String publicKey = httpServletRequest.getParameter("publicKey");
32-
33-
log.info("前端公钥：" + publicKey);
34-
35-
//jackson
36-
ObjectMapper mapper = new ObjectMapper();
37-
//jackson 序列化和反序列化 date处理
38-
mapper.setDateFormat(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"));
39-
try {
40-
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
41-
//每次响应之前随机获取AES的key，加密data数据
42-
String key = AesUtil.getKey();
43-
log.info("AES的key：" + key);
44-
log.info("需要加密的data数据：" + msg);
45-
String data = AesUtil.encrypt(msg, key);
46-
47-
//用前端的公钥来解密AES的key，并转成Base64
48-
String aesKey = Base64.encodeBase64String(RsaUtil.encryptByPublicKey(key.getBytes(), publicKey));
49-
50-
//转json字符串并转成Object对象，设置到Result中并赋值给返回值o
51-
httpServletResponse.setCharacterEncoding("UTF-8");
52-
httpServletResponse.setContentType("application/json; charset=utf-8");
53-
PrintWriter out = httpServletResponse.getWriter();
54-
out.print("{\"data\":{\"data\":\"" + data + "\",\"aesKey\":\"" + aesKey + "\"}}");
55-
out.flush();
56-
out.close();
57-
} catch (Throwable ee) {
58-
ee.printStackTrace();
31+
//判断api加密开关是否开启
32+
if("Y".equals(SysSettingUtil.getSysSetting().getSysApiEncrypt())){
33+
//加密
34+
try {
35+
//前端公钥
36+
String publicKey = httpServletRequest.getParameter("publicKey");
37+
38+
log.info("前端公钥：" + publicKey);
39+
40+
//jackson
41+
ObjectMapper mapper = new ObjectMapper();
42+
//jackson 序列化和反序列化 date处理
43+
mapper.setDateFormat(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"));
44+
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
45+
//每次响应之前随机获取AES的key，加密data数据
46+
String key = AesUtil.getKey();
47+
log.info("AES的key：" + key);
48+
log.info("需要加密的data数据：" + msg);
49+
String data = AesUtil.encrypt(msg, key);
50+
51+
//用前端的公钥来解密AES的key，并转成Base64
52+
String aesKey = Base64.encodeBase64String(RsaUtil.encryptByPublicKey(key.getBytes(), publicKey));
53+
msg = "{\"data\":{\"data\":\"" + data + "\",\"aesKey\":\"" + aesKey + "\"}}";
54+
} catch (Throwable ee) {
55+
//输出到日志文件中
56+
log.error(ErrorUtil.errorInfoToString(ee));
57+
}
5958
}
59+
60+
//转json字符串并转成Object对象，设置到Result中并赋值给返回值o
61+
httpServletResponse.setCharacterEncoding("UTF-8");
62+
httpServletResponse.setContentType("application/json; charset=utf-8");
63+
PrintWriter out = httpServletResponse.getWriter();
64+
out.print(msg);
65+
out.flush();
66+
out.close();
6067
}
6168
}

0 commit comments

Comments
 (0)