提交漏洞修复代码和民生诉求对接

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java

@@ -11,7 +11,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
-@Component
+//@Component
 public class CookieFilter implements Filter {
 
 

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java

@@ -3,12 +3,15 @@ package com.zdxt.auth.framework.config;
 import com.zdxt.auth.common.utils.security.ShiroUtils;
 import com.zdxt.auth.framework.shiro.jwt.JWTUtils;
 import com.zdxt.domain.auth.User;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Component;
 
 import javax.servlet.*;
+import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -17,39 +20,84 @@ import java.util.Map;
  * @author: QingWang.Li
  * @date: 2020/5/27 11:35
  */
-@Component
+@Slf4j
+@Component()
 public class CorsFilter implements Filter {
 
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
-            throws IOException, ServletException {
-        HttpServletResponse res = (HttpServletResponse) response;
-        res.addHeader("Access-Control-Allow-Credentials", "true");
-        res.addHeader("Access-Control-Allow-Origin", "*");
-        res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
-        res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
-        res.addHeader("X-Frame-Options", "SAMEORIGIN");
-//        res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
-//        User user = ShiroUtils.getSysUser();
-//        Map<String,Object> payload = new HashMap<>();
-//        payload.put("id", user.getUserId());
-//        payload.put("name", user.getPassword());
-//        String token1 = JWTUtils.sign(payload);
-//        res.addHeader("token", token1);
 
-//        if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
-//            response.getWriter().println("ok");
-//            return;
-//        }
-//         TODO 暂时允许options 判断请求方法是否为OPTIONS
+
+//    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+//            throws IOException, ServletException {
+//        HttpServletResponse res = (HttpServletResponse) response;
+//        res.addHeader("Access-Control-Allow-Credentials", "true");
+//        res.addHeader("Access-Control-Allow-Origin", "*");
+//        res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
+//        res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
+//        res.addHeader("X-Frame-Options", "SAMEORIGIN");
+////        res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
+////        User user = ShiroUtils.getSysUser();
+////        Map<String,Object> payload = new HashMap<>();
+////        payload.put("id", user.getUserId());
+////        payload.put("name", user.getPassword());
+////        String token1 = JWTUtils.sign(payload);
+////        res.addHeader("token", token1);
+//
+////        if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
+////            response.getWriter().println("ok");
+////            return;
+////        }
+////         TODO 暂时允许options 判断请求方法是否为OPTIONS
 //        if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
 //            // 设置响应头信息，禁止OPTIONS请求
 //            res.setHeader("Allow", "GET, POST, HEAD, PUT, DELETE");
 //            res.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
 //            return;
 //        }
+//        chain.doFilter(request, response);
+//    }
+
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        //配置可信域名
+        String[]  authhosts = {"http://10.132.108.3:85","http://jdm.szssfj.cn","http://localhost:85"};
+        String authost = "";
+        HttpServletRequest httprequest = (HttpServletRequest) request;
+        String origin = httprequest.getHeader("Origin");
+        log.info("Origin头：{}",origin);
+        HttpServletResponse httpresponse  =  (HttpServletResponse) response;
+        if(origin != null &&  !Arrays.asList(authhosts).contains(origin)) {
+            httpresponse.sendError(403);
+            return;
+        }
+        else {
+            for(int i=0;i<authhosts.length;i++) {
+                if(i!=authhosts.length - 1) {
+                    authost = authost + authhosts[i]+",";
+                }else {
+                    authost = authost + authhosts[i];
+                }
+            }
+
+            httpresponse.addHeader("Access-Control-Allow-Origin", authost);
+            httpresponse.addHeader("Access-Control-Allow-Methods",
+                    "GET, POST");
+            httpresponse.addHeader("Access-Control-Allow-Headers",
+                    "origin, content-type, accept, x-requested-with, sid, mycustom, smuser");
+            httpresponse.addHeader("Access-Control-Allow-Credentials", "true");
+            httpresponse.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
+            httpresponse.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
+            httpresponse.addHeader("X-Frame-Options", "SAMEORIGIN");
+//        res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
+            //         TODO 暂时允许options 判断请求方法是否为OPTIONS
+            if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
+                // 设置响应头信息，禁止OPTIONS请求
+                httpresponse.setHeader("Allow", "GET, POST, HEAD, PUT, DELETE");
+                httpresponse.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+                return;
+            }
             chain.doFilter(request, response);
         }
+
+    }
     @Override
     public void destroy() {
     }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java

@@ -41,12 +41,13 @@ public class HostFilter implements Filter{
         String[] split = host.split(":");
         String serverName = request.getServerName();
         log.info("请求的源地址：{}",host);
-        System.out.println("serverName-debug:" + host);
+//        System.out.println("serverName-debug:" + host);
         if (!isEmpty(split[0])) {
             if (checkBlankList(split[0])) {
                 filterChain.doFilter(servletRequest, servletResponse);
             } else {
-                System.out.println("[serverName deny access tips]->" + split[0]);
+//                System.out.println("[serverName deny access tips]->" + split[0]);
+                log.info("被拦截的IP：{}",split[0]);
 //	        response.getWriter().print("host deny");
                 response.setStatus(403);
                 response.flushBuffer();

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java

@@ -76,11 +76,12 @@ public class ResourcesConfig implements WebMvcConfigurer
                         "/code/linkage",
                         "/code/ruleList",
                         "/code/LawEnforcementWarningList",
-                        "/system/dept",
-                        "/system/user",
-                        "/system/role",
-                        "/system/post",
-                        "/system/menu",
+                        "/system/dept/**",
+                        "/system/user/**",
+                        "/system/role/**",
+                        "/system/post/**",
+                        "/system/menu/**",
+                        "/code/linkage/**",
                         "/monitor/operlog",
                         "/monitor/logininfor",
                         "/system/dict",

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/SpringSessionConfiguration.java

@@ -1,25 +1,25 @@
-package com.zdxt.auth.framework.config;
-
-import org.apache.tomcat.util.http.SameSiteCookies;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.session.web.http.CookieSerializer;
-import org.springframework.session.web.http.DefaultCookieSerializer;
-
-
-@Configuration
-public class SpringSessionConfiguration {
-
-    @Bean
-    public CookieSerializer cookieSerializer() {
-        DefaultCookieSerializer serializer = new DefaultCookieSerializer ();
-        serializer.setCookieName("JSESSIONID");
-        serializer.setDomainName("localhost");
-        serializer.setCookiePath("/**");
-        serializer.setCookieMaxAge(3600);
-        serializer.setSameSite(SameSiteCookies.LAX.getValue());  // 设置SameSite属性
-        serializer.setUseHttpOnlyCookie(true);
-//        serializer.setUseSecureCookie(true);
-        return serializer;
-    }
-}
+//package com.zdxt.auth.framework.config;
+//
+//import org.apache.tomcat.util.http.SameSiteCookies;
+//import org.springframework.context.annotation.Bean;
+//import org.springframework.context.annotation.Configuration;
+//import org.springframework.session.web.http.CookieSerializer;
+//import org.springframework.session.web.http.DefaultCookieSerializer;
+//
+//
+////@Configuration
+//public class SpringSessionConfiguration {
+//
+//    @Bean
+//    public CookieSerializer cookieSerializer() {
+//        DefaultCookieSerializer serializer = new DefaultCookieSerializer ();
+//        serializer.setCookieName("JSESSIONID");
+////        serializer.setDomainName("localhost");
+//        serializer.setCookiePath("/**");
+//        serializer.setCookieMaxAge(3600);
+//        serializer.setSameSite(SameSiteCookies.LAX.getValue());  // 设置SameSite属性
+//        serializer.setUseHttpOnlyCookie(true);
+////        serializer.setUseSecureCookie(true);
+//        return serializer;
+//    }
+//}

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java

@@ -45,14 +45,14 @@ public class TomcatConfig {
         return tomcatServletContainerFactory;
     }
     //tomcat配置
-    @Bean
-    public TomcatContextCustomizer sameSiteCookiesConfig() {
-        return context -> {
-            final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
-            // 设置Cookie的SameSite
-            cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue());
-            context.setCookieProcessor(cookieProcessor);
-        };
-    }
+//    @Bean
+//    public TomcatContextCustomizer sameSiteCookiesConfig() {
+//        return context -> {
+//            final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
+//            // 设置Cookie的SameSite
+//            cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue());
+//            context.setCookieProcessor(cookieProcessor);
+//        };
+//    }
 }
 

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/application.yml

@@ -271,6 +271,8 @@ srnwg:
 mssq:
   appId: 67a83c8a136346cd98f844359902a23c
   appkey: NjdhODNjOGExMzYzNDZjZDk4Zjg0NDM1OTkwMmEyM2M6TXNzcTIwMjQ=
+  apiUrl: http://10.224.158.64:8282/proxy/api
+
 
 #短信平台
 sms:

lib/EmergencyService/zdxtLawEnforcementCodeService/src/main/java/com/zdxt/code/service/impl/MssqApiServiceImpl.java

@@ -16,13 +16,13 @@ import static com.zdxt.code.utils.ServiceInvocation.httpRequest;
 @Service
 public class MssqApiServiceImpl implements MssqApiService {
 
-    @Value("mssq.apiUrl")
+//    @Value("${mssq.apiUrl}")
     private String mssqUrl;
 
-    @Value("mssq.appId")
+//    @Value("${mssq.appId}")
     private String appId;
 
-    @Value("mssq.appKey")
+//    @Value("${mssq.appKey}")
     private String appKey;
 
     @Override