潘钊 / bsth_control · Commits

Commit 07243d32cc01fb70705505e177123d7386f670a9

Authored by 王通
1 parent daf25afc

1.加入越权和sql注入防御机制

Inline Side-by-side
Showing 13 changed files with 792 additions and 338 deletions
src/main/java/com/bsth/common/Constants.java
  View file @07243d3
1   -package com.bsth.common;
2   -
3   -/**
4   - *
5   - * @ClassName: Constants
6   - * @Description: TODO(常量类)
7   - * @author PanZhao
8   - * @date 2016年3月18日 下午11:06:53
9   - *
10   - */
11   -public class Constants {
12   -
13   - /**
14   - * 不需要拦截的资源
15   - */
16   - public static final String LOGIN = "/user/login/**";
17   - public static final String LOGIN_PAGE = "/login.html";
18   - public static final String ASSETS_URL = "/assets/**";
19   - public static final String FAVICON_URL = "/favicon.ico";
20   - public static final String METRONIC_URL = "/metronic_v4.5.4/**";
21   - public static final String LOGIN_FAILURE = "/user/loginFailure";
22   - public static final String CAPTCHA = "/captcha.jpg";
23   - //免登录白名单
24   - public static final String XD_PAGE = "/pages/control/lineallot_v3/**";
25   - public static final String FREE_URL="/freeLogin/**";
26   - public static final String FREE_XD_CHILD_PAGES = "/real_control_v3/**";
27   -
28   - //对外的营运数据接口
29   - public static final String SERVICE_INTERFACE = "/companyService/**";
30   -
31   - /**
32   - * 线调部分子页面不做拦截，便于浏览器缓存
33   - */
34   - public static final String XD_CHILD_PAGES = "/real_control_v2/**";
35   - public static final String XD_REAL_GPS = "/gps/real/line";
36   - //public static final String XD_TEMPS = "/pages/control/line/temps/**";
37   -
38   - //车载网关上行接口
39   - public static final String UPSTREAM_URL = "/control/upstream";
40   - //站点道闸上传入口
41   - public static final String STATIONSIGNO_URL = "/control/stationSigno";
42   - //rfid 上传入口
43   - public static final String UP_RFID_URL = "/rfid/**";
44   -
45   - public static final String SESSION_USERNAME = "sessionUserName";
46   - public static final String COMPANY_AUTHORITYS = "cmyAuths";
47   - public static final String STATION_AND_SECTION_COUNT = "/station/updateStationAndSectionCode";
48   -
49   - /**
50   - * 解除调度指令和班次的外键约束
51   - */
52   - public static final String REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch=?";
53   -
54   - /**
55   - * 批量解除调度指令和班次的外键约束
56   - */
57   - public static final String MULTI_REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch in ";
58   -}
  1 +package com.bsth.common;
  2 +
  3 +/**
  4 + *
  5 + * @ClassName: Constants
  6 + * @Description: TODO(常量类)
  7 + * @author PanZhao
  8 + * @date 2016年3月18日 下午11:06:53
  9 + *
  10 + */
  11 +public class Constants {
  12 +
  13 + /**
  14 + * 不需要拦截的资源
  15 + */
  16 + public static final String LOGIN = "/user/login/**";
  17 + public static final String LOGIN_PAGE = "/login.html";
  18 + public static final String ASSETS_URL = "/assets/**";
  19 + public static final String FAVICON_URL = "/favicon.ico";
  20 + public static final String METRONIC_URL = "/metronic_v4.5.4/**";
  21 + public static final String LOGIN_FAILURE = "/user/loginFailure";
  22 + public static final String CAPTCHA = "/captcha.jpg";
  23 + //免登录白名单
  24 + public static final String XD_PAGE = "/pages/control/lineallot_v3/**";
  25 + public static final String FREE_URL="/freeLogin/**";
  26 + public static final String FREE_XD_CHILD_PAGES = "/real_control_v3/**";
  27 +
  28 + //对外的营运数据接口
  29 + public static final String SERVICE_INTERFACE = "/companyService/**";
  30 +
  31 + /**
  32 + * 线调部分子页面不做拦截，便于浏览器缓存
  33 + */
  34 + public static final String XD_CHILD_PAGES = "/real_control_v2/**";
  35 + public static final String XD_REAL_GPS = "/gps/real/line";
  36 + //public static final String XD_TEMPS = "/pages/control/line/temps/**";
  37 +
  38 + //车载网关上行接口
  39 + public static final String UPSTREAM_URL = "/control/upstream";
  40 + //站点道闸上传入口
  41 + public static final String STATIONSIGNO_URL = "/control/stationSigno";
  42 + //rfid 上传入口
  43 + public static final String UP_RFID_URL = "/rfid/**";
  44 +
  45 + public static final String SESSION_USERNAME = "sessionUserName";
  46 + public static final String COMPANY_AUTHORITYS = "cmyAuths";
  47 + public static final String STATION_AND_SECTION_COUNT = "/station/updateStationAndSectionCode";
  48 +
  49 + /**
  50 + * 解除调度指令和班次的外键约束
  51 + */
  52 + public static final String REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch=?";
  53 +
  54 + /**
  55 + * 批量解除调度指令和班次的外键约束
  56 + */
  57 + public static final String MULTI_REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch in ";
  58 +
  59 + public static final String RESOURCE_AUTHORITYS = "resourceAuthoritys";
  60 +}
... ...
src/main/java/com/bsth/common/SystemParamKeys.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.common;
  2 +
  3 +/**
  4 + * @author Hill
  5 + */
  6 +public class SystemParamKeys {
  7 +
  8 + public static final String SPECIAL_ROLES = "special.roles";
  9 +
  10 + public static final String SPECIAL_DAYS = "special.days";
  11 +
  12 + public static final String URL_HTTP_GPS_REAL_CACHE = "url.http.gps.real.cache";
  13 +
  14 + public static final String URL_HTTP_GPS_REAL = "url.http.gps.real";
  15 +
  16 + public static final String URL_HTTP_DIRECTIVE = "url.http.directive";
  17 +
  18 + public static final String URL_HTTP_RFID = "url.http.rfid";
  19 +
  20 + public static final String URL_HTTP_REPORT = "url.http.report.%s";
  21 +
  22 + public static final String URL_HTTP_TICKETING = "url.http.ticketing";
  23 +
  24 + public static final String URL_HTTP_DSM_ACK = "url.http.dsm.ack";
  25 +
  26 + public static final String URL_HTTP_CP_ACK = "url.http.cp.ack";
  27 +
  28 + public static final String MAIL_ADMIN = "mail.admin";
  29 +
  30 + public static final String MAIL_WAYBILL = "mail.waybill";
  31 +
  32 + public static final String ENABLED_FIRST_LAST_GENERATION = "enabled.first.last.generation";
  33 +
  34 + public static final String ENABLED_FILTER_SQL_INJECTION = "enabled.filter.sql.injection";
  35 +
  36 + public static final String ENABLED_SSO = "enabled.sso";
  37 +
  38 + public static final String SSO_SYSTEM_CODE = "sso.system.code";
  39 +
  40 + public static final String URL_HTTP_SSO_LOGIN = "url.http.sso.login";
  41 +
  42 + public static final String URL_HTTP_SSO_LOGOUT = "url.http.sso.logout";
  43 +
  44 + public static final String URL_HTTP_SSO_AUTH = "url.http.sso.auth";
  45 +
  46 + public static final String URL_HTTP_MAINTENANCE = "url.http.maintenance";
  47 +
  48 + public static final String ENABLED_WHITE_IP = "enabled.white.ip";
  49 +
  50 + public static final String ENABLED_FILTER_AUTHORITY = "enabled.filter.authority";
  51 +}
... ...
src/main/java/com/bsth/controller/realcontrol/AdminUtilsController.java
  View file @07243d3
... ... @@ -5,14 +5,21 @@ import ch.qos.logback.classic.LoggerContext;
5 5 import com.bsth.data.BasicData;
6 6 import com.bsth.data.directive.DayOfDirectives;
7 7 import com.bsth.data.directive.DirectivesPstThread;
  8 +import com.bsth.data.directive.GatewayHttpUtils;
8 9 import com.bsth.data.gpsdata_v2.cache.GeoCacheData;
9 10 import com.bsth.data.gpsdata_v2.handlers.overspeed.OverspeedProcess;
  11 +import com.bsth.data.gpsdata_v2.load.GatewayHttpLoader;
  12 +import com.bsth.data.gpsdata_v2.load.SocketClientLoader;
10 13 import com.bsth.data.gpsdata_v2.thread.GpsDataLoaderThread;
11 14 import com.bsth.data.msg_queue.DirectivePushQueue;
12 15 import com.bsth.data.msg_queue.WebSocketPushQueue;
13 16 import com.bsth.data.pilot80.PilotReport;
14 17 import com.bsth.data.schedule.DayOfSchedule;
15 18 import com.bsth.entity.realcontrol.ScheduleRealInfo;
  19 +import com.bsth.filter.SQLInjectFilter;
  20 +import com.bsth.service.SectionService;
  21 +import com.bsth.service.StationService;
  22 +import com.bsth.service.SystemParamService;
16 23 import com.bsth.websocket.handler.SendUtils;
17 24 import com.fasterxml.jackson.databind.ObjectMapper;
18 25 import org.slf4j.Logger;
... ... @@ -58,6 +65,18 @@ public class AdminUtilsController {
58 65 @Autowired
59 66 private BasicData.BasicDataLoader basicDataLoader;
60 67  
  68 + @Autowired
  69 + private SystemParamService systemParamService;
  70 +
  71 + @Autowired
  72 + private SocketClientLoader socketClientLoader;
  73 +
  74 + @Autowired
  75 + private GatewayHttpLoader gatewayHttpLoader;
  76 +
  77 + @Autowired
  78 + private GatewayHttpUtils gatewayHttpUtils;
  79 +
61 80 /**
62 81 * 出现重复班次的车辆
63 82 *
... ... @@ -216,11 +235,56 @@ public class AdminUtilsController {
216 235 return "error";
217 236 }
218 237  
  238 + @RequestMapping("/setInjectStr")
  239 + public String setInjectStr(@RequestParam String injectStr) {
  240 + Map<String, Object> result = new HashMap<>();
  241 + try {
  242 + SQLInjectFilter.setInjStr(injectStr);
  243 + return "success";
  244 + } catch (Exception e) {
  245 + e.printStackTrace();
  246 + }
  247 +
  248 + return "error";
  249 + }
  250 +
219 251 @RequestMapping("/reloadSystemParam")
220 252 public String reloadSystemParam() {
221   - Map<String, Object> result = new HashMap<>();
222 253 try {
223   - basicDataLoader.loadSystemParam();
  254 + systemParamService.refresh();
  255 +
  256 + return "success";
  257 + } catch (Exception e) {
  258 + e.printStackTrace();
  259 + }
  260 +
  261 + return "error";
  262 + }
  263 +
  264 + @RequestMapping("/applySystemParam")
  265 + public String applySystemParam() {
  266 + try {
  267 + socketClientLoader.afterPropertiesSet();
  268 + gatewayHttpLoader.afterPropertiesSet();
  269 + gatewayHttpUtils.afterPropertiesSet();
  270 +
  271 + return "success";
  272 + } catch (Exception e) {
  273 + e.printStackTrace();
  274 + }
  275 +
  276 + return "error";
  277 + }
  278 +
  279 + @RequestMapping("/reloadAndApplySystemParam")
  280 + public String reloadAndApplySystemParam() {
  281 + try {
  282 + systemParamService.refresh();
  283 +
  284 + socketClientLoader.afterPropertiesSet();
  285 + gatewayHttpLoader.afterPropertiesSet();
  286 + gatewayHttpUtils.afterPropertiesSet();
  287 +
224 288 return "success";
225 289 } catch (Exception e) {
226 290 e.printStackTrace();
... ...
src/main/java/com/bsth/data/SystemParamCache.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.data;
  2 +
  3 +import com.bsth.common.SystemParamKeys;
  4 +import com.bsth.service.SystemParamService;
  5 +import org.springframework.beans.factory.InitializingBean;
  6 +import org.springframework.beans.factory.annotation.Autowired;
  7 +import org.springframework.stereotype.Component;
  8 +
  9 +/**
  10 + * @author Hill
  11 + */
  12 +@Component
  13 +public class SystemParamCache implements InitializingBean {
  14 +
  15 + @Autowired
  16 + private SystemParamService systemParamService;
  17 +
  18 + private static SystemParamService systemParamService1;
  19 +
  20 + public static String getSpecialRoles() {
  21 + return systemParamService1.getValue(SystemParamKeys.SPECIAL_ROLES);
  22 + }
  23 +
  24 + public static String getSpecialDays() {
  25 + return systemParamService1.getValue(SystemParamKeys.SPECIAL_DAYS);
  26 + }
  27 +
  28 + public static String getUrlHttpGpsRealCache() {
  29 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_GPS_REAL_CACHE);
  30 + }
  31 +
  32 + public static String getUrlHttpGpsReal() {
  33 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_GPS_REAL);
  34 + }
  35 +
  36 + public static String getUrlHttpDirective() {
  37 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_DIRECTIVE);
  38 + }
  39 +
  40 + public static String getUrlHttpRfid() {
  41 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_RFID);
  42 + }
  43 +
  44 + public static String getUrlHttpReport(String param) {
  45 + return systemParamService1.getValue(String.format(SystemParamKeys.URL_HTTP_REPORT, param));
  46 + }
  47 +
  48 + public static String getUrlHttpTicketing() {
  49 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_TICKETING);
  50 + }
  51 +
  52 + public static String getUrlHttpDsmAck() {
  53 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_DSM_ACK);
  54 + }
  55 +
  56 + public static String getUrlHttpCpAck() {
  57 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_CP_ACK);
  58 + }
  59 +
  60 + public static String getMailAdmin() {
  61 + return systemParamService1.getValue(SystemParamKeys.MAIL_ADMIN);
  62 + }
  63 +
  64 + public static String getMailWaybill() {
  65 + return systemParamService1.getValue(SystemParamKeys.MAIL_WAYBILL);
  66 + }
  67 +
  68 + public static boolean getEnabledFirstLastGeneration() {
  69 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_FIRST_LAST_GENERATION));
  70 + }
  71 +
  72 + public static boolean getEnabledFilterSqlInjection() {
  73 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_FILTER_SQL_INJECTION));
  74 + }
  75 +
  76 + public static boolean getEnabledSso() {
  77 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_SSO));
  78 + }
  79 +
  80 + public static String getSsoSystemCode() {
  81 + return systemParamService1.getValue(SystemParamKeys.SSO_SYSTEM_CODE);
  82 + }
  83 +
  84 + public static String getUrlHttpSsoLogin() {
  85 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_SSO_LOGIN);
  86 + }
  87 +
  88 + public static String getUrlHttpSsoLogout() {
  89 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_SSO_LOGOUT);
  90 + }
  91 +
  92 + public static String getUrlHttpSsoAuth() {
  93 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_SSO_AUTH);
  94 + }
  95 +
  96 + public static String getUrlHttpMaintenance() {
  97 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_MAINTENANCE);
  98 + }
  99 +
  100 + public static boolean getEnabledWhiteIp() {
  101 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_WHITE_IP));
  102 + }
  103 +
  104 + public static boolean getEnableFilterAuthority() {
  105 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_FILTER_AUTHORITY));
  106 + }
  107 +
  108 + @Override
  109 + public void afterPropertiesSet() throws Exception {
  110 + systemParamService1 = systemParamService;
  111 + systemParamService1.refresh();
  112 + }
  113 +}
... ...
src/main/java/com/bsth/data/directive/GatewayHttpUtils.java
  View file @07243d3
1   -package com.bsth.data.directive;
2   -
3   -import com.alibaba.fastjson.JSONObject;
4   -import com.bsth.util.ConfigUtil;
5   -import org.apache.http.client.config.RequestConfig;
6   -import org.apache.http.client.methods.CloseableHttpResponse;
7   -import org.apache.http.client.methods.HttpPost;
8   -import org.apache.http.entity.StringEntity;
9   -import org.apache.http.impl.client.CloseableHttpClient;
10   -import org.apache.http.impl.client.HttpClients;
11   -import org.apache.http.util.EntityUtils;
12   -import org.slf4j.Logger;
13   -import org.slf4j.LoggerFactory;
14   -
15   -/**
16   - * @author PanZhao
17   - * @ClassName: GatewayHttpUtils
18   - * @Description: TODO(和网关HTTP通讯工具类)
19   - * @date 2016年8月14日 下午9:50:46
20   - */
21   -public class GatewayHttpUtils {
22   - static Logger logger = LoggerFactory.getLogger(GatewayHttpUtils.class);
23   -
24   - static String url;
25   - static CloseableHttpClient httpClient = null;
26   - static HttpPost post;
27   - static RequestConfig requestConfig;
28   - static CloseableHttpResponse response;
29   -
30   - static {
31   - url = ConfigUtil.get("http.send.directive");
32   - httpClient = HttpClients.createDefault();
33   - post = new HttpPost(url);
34   - requestConfig = RequestConfig.custom()
35   - .setConnectTimeout(3000).setConnectionRequestTimeout(2000)
36   - .setSocketTimeout(3000).build();
37   - post.setConfig(requestConfig);
38   - }
39   -
40   - public static int postJson(String jsonStr) {
41   - logger.info("send : " + jsonStr);
42   -
43   - int code = -1;
44   - try {
45   - post.setEntity(new StringEntity(jsonStr, "utf-8"));
46   -
47   - response = httpClient.execute(post);
48   -
49   - int statusCode = response.getStatusLine().getStatusCode();
50   - if(statusCode != 200){
51   - logger.error("http client status code: " + statusCode);
52   - }
53   -
54   - JSONObject json = JSONObject.parseObject(EntityUtils.toString(response.getEntity()));
55   - if (null != json && json.getInteger("errCode") == 0)
56   - code = 0;
57   - else
58   - logger.error("和网关http通讯失败，rs: " + json);
59   -
60   - if (null != response)
61   - response.close();
62   - } catch (Exception e) {
63   - logger.error("", e);
64   - }
65   - return code;
66   - }
67   -}
  1 +package com.bsth.data.directive;
  2 +
  3 +import com.alibaba.fastjson.JSONObject;
  4 +import com.bsth.data.SystemParamCache;
  5 +import org.apache.http.client.config.RequestConfig;
  6 +import org.apache.http.client.methods.CloseableHttpResponse;
  7 +import org.apache.http.client.methods.HttpPost;
  8 +import org.apache.http.entity.StringEntity;
  9 +import org.apache.http.impl.client.CloseableHttpClient;
  10 +import org.apache.http.impl.client.HttpClients;
  11 +import org.apache.http.util.EntityUtils;
  12 +import org.slf4j.Logger;
  13 +import org.slf4j.LoggerFactory;
  14 +import org.springframework.beans.factory.InitializingBean;
  15 +import org.springframework.stereotype.Component;
  16 +
  17 +/**
  18 + * @author PanZhao
  19 + * @ClassName: GatewayHttpUtils
  20 + * @Description: TODO(和网关HTTP通讯工具类)
  21 + * @date 2016年8月14日 下午9:50:46
  22 + */
  23 +@Component
  24 +public class GatewayHttpUtils implements InitializingBean {
  25 + static Logger logger = LoggerFactory.getLogger(GatewayHttpUtils.class);
  26 +
  27 + static String url;
  28 + static CloseableHttpClient httpClient = null;
  29 + static HttpPost post;
  30 + static RequestConfig requestConfig;
  31 + static CloseableHttpResponse response;
  32 +
  33 + public static int postJson(String jsonStr) {
  34 + logger.info("send : " + jsonStr);
  35 +
  36 + int code = -1;
  37 + try {
  38 + post.setEntity(new StringEntity(jsonStr, "utf-8"));
  39 +
  40 + response = httpClient.execute(post);
  41 +
  42 + int statusCode = response.getStatusLine().getStatusCode();
  43 + if(statusCode != 200){
  44 + logger.error("http client status code: " + statusCode);
  45 + }
  46 +
  47 + JSONObject json = JSONObject.parseObject(EntityUtils.toString(response.getEntity()));
  48 + if (null != json && json.getInteger("errCode") == 0)
  49 + code = 0;
  50 + else
  51 + logger.error("和网关http通讯失败，rs: " + json);
  52 +
  53 + if (null != response)
  54 + response.close();
  55 + } catch (Exception e) {
  56 + logger.error("", e);
  57 + }
  58 + return code;
  59 + }
  60 +
  61 + @Override
  62 + public void afterPropertiesSet() throws Exception {
  63 + url = SystemParamCache.getUrlHttpDirective();
  64 + httpClient = HttpClients.createDefault();
  65 + post = new HttpPost(url);
  66 + requestConfig = RequestConfig.custom()
  67 + .setConnectTimeout(3000).setConnectionRequestTimeout(2000)
  68 + .setSocketTimeout(3000).build();
  69 + post.setConfig(requestConfig);
  70 + }
  71 +}
... ...
src/main/java/com/bsth/data/gpsdata_v2/load/GatewayHttpLoader.java
  View file @07243d3
... ... @@ -2,6 +2,7 @@ package com.bsth.data.gpsdata_v2.load;
2 2  
3 3 import com.alibaba.fastjson.JSON;
4 4 import com.bsth.data.BasicData;
  5 +import com.bsth.data.SystemParamCache;
5 6 import com.bsth.data.gpsdata_v2.GpsRealData;
6 7 import com.bsth.data.gpsdata_v2.entity.GpsEntity;
7 8 import com.bsth.data.gpsdata_v2.utils.GpsDataUtils;
... ... @@ -16,6 +17,7 @@ import org.apache.http.impl.client.HttpClients;
16 17 import org.slf4j.Logger;
17 18 import org.slf4j.LoggerFactory;
18 19 import org.springframework.beans.BeansException;
  20 +import org.springframework.beans.factory.InitializingBean;
19 21 import org.springframework.context.ApplicationContext;
20 22 import org.springframework.context.ApplicationContextAware;
21 23 import org.springframework.stereotype.Component;
... ... @@ -30,7 +32,7 @@ import java.util.List;
30 32 * Created by panzhao on 2017/11/15.
31 33 */
32 34 @Component
33   -public class GatewayHttpLoader implements ApplicationContextAware{
  35 +public class GatewayHttpLoader implements ApplicationContextAware, InitializingBean {
34 36  
35 37 static Logger logger = LoggerFactory.getLogger(GatewayHttpLoader.class);
36 38  
... ... @@ -45,17 +47,6 @@ public class GatewayHttpLoader implements ApplicationContextAware{
45 47  
46 48 static GpsRealData gpsRealData;
47 49  
48   - static{
49   - url = ConfigUtil.get("http.gps.real.url");
50   - list = new ArrayList<>();
51   - httpClient = HttpClients.createDefault();
52   - get = new HttpGet(url);
53   - requestConfig = RequestConfig.custom()
54   - .setConnectTimeout(2500).setConnectionRequestTimeout(2000)
55   - .setSocketTimeout(2500).build();
56   - get.setConfig(requestConfig);
57   - }
58   -
59 50 public static List<GpsEntity> load(){
60 51 try{
61 52 if(list.size() > 0)
... ... @@ -117,4 +108,16 @@ public class GatewayHttpLoader implements ApplicationContextAware{
117 108 public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
118 109 gpsRealData = applicationContext.getBean(GpsRealData.class);
119 110 }
  111 +
  112 + @Override
  113 + public void afterPropertiesSet() throws Exception {
  114 + url = SystemParamCache.getUrlHttpGpsReal();
  115 + list = new ArrayList<>();
  116 + httpClient = HttpClients.createDefault();
  117 + get = new HttpGet(url);
  118 + requestConfig = RequestConfig.custom()
  119 + .setConnectTimeout(2500).setConnectionRequestTimeout(2000)
  120 + .setSocketTimeout(2500).build();
  121 + get.setConfig(requestConfig);
  122 + }
120 123 }
... ...
src/main/java/com/bsth/data/gpsdata_v2/load/SocketClientLoader.java
  View file @07243d3
1   -package com.bsth.data.gpsdata_v2.load;
2   -
3   -import com.alibaba.fastjson.JSON;
4   -import com.bsth.data.BasicData;
5   -import com.bsth.data.gpsdata_v2.entity.GpsEntity;
6   -import com.bsth.data.gpsdata_v2.utils.GpsDataUtils;
7   -import com.bsth.util.ConfigUtil;
8   -import org.apache.http.HttpEntity;
9   -import org.apache.http.client.config.RequestConfig;
10   -import org.apache.http.client.methods.CloseableHttpResponse;
11   -import org.apache.http.client.methods.HttpGet;
12   -import org.apache.http.impl.client.CloseableHttpClient;
13   -import org.apache.http.impl.client.HttpClients;
14   -import org.slf4j.Logger;
15   -import org.slf4j.LoggerFactory;
16   -import org.springframework.stereotype.Component;
17   -
18   -import java.io.BufferedReader;
19   -import java.io.InputStreamReader;
20   -import java.util.ArrayList;
21   -import java.util.List;
22   -
23   -/**
24   - * 从专用的socket client 加载数据
25   - * Created by panzhao on 2017/11/15.
26   - */
27   -@Component
28   -public class SocketClientLoader {
29   -
30   - static Logger logger = LoggerFactory.getLogger(SocketClientLoader.class);
31   -
32   - static String url;
33   - static List<GpsEntity> list;
34   - static CloseableHttpClient httpClient = null;
35   - static HttpGet get;
36   - static RequestConfig requestConfig;
37   - static CloseableHttpResponse response;
38   - static HttpEntity entity;
39   - static BufferedReader br;
40   -
41   - static {
42   - url = ConfigUtil.get("http.gps.real.cache.url");
43   - list = new ArrayList<>();
44   - httpClient = HttpClients.createDefault();
45   - get = new HttpGet(url);
46   - requestConfig = RequestConfig.custom()
47   - .setConnectTimeout(2500).setConnectionRequestTimeout(2000)
48   - .setSocketTimeout(2500).build();
49   - get.setConfig(requestConfig);
50   - }
51   -
52   - public static List<GpsEntity> load(){
53   - try {
54   - if(list.size() > 0)
55   - list.clear();
56   - logger.info("load start...");
57   - response = httpClient.execute(get);
58   - entity = response.getEntity();
59   - if(null == entity)
60   - return list;
61   -
62   - br = new BufferedReader(new InputStreamReader(entity.getContent()));
63   - StringBuilder sb = new StringBuilder();
64   - String str;
65   - while ((str = br.readLine()) != null)
66   - sb.append(str);
67   -
68   - list = JSON.parseArray(sb.toString(), GpsEntity.class);
69   -
70   - logger.info("load end ! size: " + list.size());
71   - //过滤掉无效的点位
72   - list = GpsDataUtils.clearInvalid(list);
73   -
74   - for (GpsEntity gps : list) {
75   - gps.setNbbm(BasicData.deviceId2NbbmMap.get(gps.getDeviceId()));
76   - }
77   -
78   - if (null != response)
79   - response.close();
80   - } catch (Exception e) {
81   - logger.error("", e);
82   - }
83   -
84   - return list;
85   - }
86   -}
  1 +package com.bsth.data.gpsdata_v2.load;
  2 +
  3 +import com.alibaba.fastjson.JSON;
  4 +import com.bsth.data.BasicData;
  5 +import com.bsth.data.SystemParamCache;
  6 +import com.bsth.data.gpsdata_v2.entity.GpsEntity;
  7 +import com.bsth.data.gpsdata_v2.utils.GpsDataUtils;
  8 +import org.apache.http.HttpEntity;
  9 +import org.apache.http.client.config.RequestConfig;
  10 +import org.apache.http.client.methods.CloseableHttpResponse;
  11 +import org.apache.http.client.methods.HttpGet;
  12 +import org.apache.http.impl.client.CloseableHttpClient;
  13 +import org.apache.http.impl.client.HttpClients;
  14 +import org.slf4j.Logger;
  15 +import org.slf4j.LoggerFactory;
  16 +import org.springframework.beans.factory.InitializingBean;
  17 +import org.springframework.stereotype.Component;
  18 +
  19 +import java.io.BufferedReader;
  20 +import java.io.InputStreamReader;
  21 +import java.util.ArrayList;
  22 +import java.util.List;
  23 +
  24 +/**
  25 + * 从专用的socket client 加载数据
  26 + * Created by panzhao on 2017/11/15.
  27 + */
  28 +@Component
  29 +public class SocketClientLoader implements InitializingBean {
  30 +
  31 + static Logger logger = LoggerFactory.getLogger(SocketClientLoader.class);
  32 +
  33 + static String url;
  34 + static List<GpsEntity> list;
  35 + static CloseableHttpClient httpClient = null;
  36 + static HttpGet get;
  37 + static RequestConfig requestConfig;
  38 + static CloseableHttpResponse response;
  39 + static HttpEntity entity;
  40 + static BufferedReader br;
  41 +
  42 + public static List<GpsEntity> load(){
  43 + try {
  44 + if(list.size() > 0)
  45 + list.clear();
  46 + logger.info("load start...");
  47 + response = httpClient.execute(get);
  48 + entity = response.getEntity();
  49 + if(null == entity)
  50 + return list;
  51 +
  52 + br = new BufferedReader(new InputStreamReader(entity.getContent()));
  53 + StringBuilder sb = new StringBuilder();
  54 + String str;
  55 + while ((str = br.readLine()) != null)
  56 + sb.append(str);
  57 +
  58 + list = JSON.parseArray(sb.toString(), GpsEntity.class);
  59 +
  60 + logger.info("load end ! size: " + list.size());
  61 + //过滤掉无效的点位
  62 + list = GpsDataUtils.clearInvalid(list);
  63 +
  64 + for (GpsEntity gps : list) {
  65 + gps.setNbbm(BasicData.deviceId2NbbmMap.get(gps.getDeviceId()));
  66 + }
  67 +
  68 + if (null != response)
  69 + response.close();
  70 + } catch (Exception e) {
  71 + logger.error("", e);
  72 + }
  73 +
  74 + return list;
  75 + }
  76 +
  77 + @Override
  78 + public void afterPropertiesSet() throws Exception {
  79 + url = SystemParamCache.getUrlHttpGpsRealCache();
  80 + list = new ArrayList<>();
  81 + httpClient = HttpClients.createDefault();
  82 + get = new HttpGet(url);
  83 + requestConfig = RequestConfig.custom()
  84 + .setConnectTimeout(2500).setConnectionRequestTimeout(2000)
  85 + .setSocketTimeout(2500).build();
  86 + get.setConfig(requestConfig);
  87 + }
  88 +}
... ...
src/main/java/com/bsth/entity/sys/SysUser.java
  View file @07243d3
1 1 package com.bsth.entity.sys;
2 2  
  3 +import com.fasterxml.jackson.annotation.JsonIgnore;
3 4 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
  5 +import org.springframework.format.annotation.DateTimeFormat;
  6 +import org.springframework.util.StringUtils;
4 7 import org.joda.time.DateTime;
5   -
6 8 import javax.persistence.*;
7 9 import java.util.Date;
  10 +import java.util.HashSet;
8 11 import java.util.LinkedHashSet;
9 12 import java.util.Set;
10 13  
... ... @@ -25,16 +28,21 @@ public class SysUser {
25 28 private String userName;
26 29  
27 30 private String name;
28   -
  31 +
  32 + @JsonIgnore
29 33 private String password;
30 34  
31 35 @Column(updatable = false, name = "create_date", columnDefinition = "TIMESTAMP DEFAULT CURRENT_TIMESTAMP")
32 36 private Date createDate;
33   -
34   - @Column(name = "last_loginDate", columnDefinition = "timestamp DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP")
  37 +
  38 + @Column(name = "update_date", columnDefinition = "timestamp DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP")
  39 + private Date updateDate;
  40 +
  41 + @DateTimeFormat(pattern = "yyyy-MM-dd")
35 42 private Date lastLoginDate;
36 43  
37 44 /** 最近密码更新时间 */
  45 + @DateTimeFormat(pattern = "yyyy-MM-dd")
38 46 private Date lastPwdDate;
39 47 /** 密码有效期 */
40 48 private Integer pwdValidPeriod;
... ... @@ -84,6 +92,14 @@ public class SysUser {
84 92 this.createDate = createDate;
85 93 }
86 94  
  95 + public Date getUpdateDate() {
  96 + return updateDate;
  97 + }
  98 +
  99 + public void setUpdateDate(Date updateDate) {
  100 + this.updateDate = updateDate;
  101 + }
  102 +
87 103 public Date getLastLoginDate() {
88 104 return lastLoginDate;
89 105 }
... ... @@ -124,6 +140,27 @@ public class SysUser {
124 140 this.roles = roles;
125 141 }
126 142  
  143 + public Set<String> getLinks() {
  144 + Set<String> links = new HashSet<>();
  145 + if (links.size() == 0) {
  146 + for (Role role : roles) {
  147 + for (Module module : role.getModules()) {
  148 + String symbol = module.getMappSymbol();
  149 + if (!StringUtils.isEmpty(symbol)) {
  150 + String[] symbols = symbol.split(";");
  151 + for (String temp : symbols) {
  152 + if (!StringUtils.isEmpty(temp)) {
  153 + links.add(temp);
  154 + }
  155 + }
  156 + }
  157 + }
  158 + }
  159 + }
  160 +
  161 + return links;
  162 + }
  163 +
127 164 public Date getLastPwdDate() {
128 165 return lastPwdDate;
129 166 }
... ...
src/main/java/com/bsth/filter/AuthorityFilter.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.filter;
  2 +
  3 +import com.bsth.common.Constants;
  4 +import com.bsth.common.ResponseCode;
  5 +import com.bsth.data.SystemParamCache;
  6 +import com.fasterxml.jackson.databind.ObjectMapper;
  7 +import org.slf4j.Logger;
  8 +import org.slf4j.LoggerFactory;
  9 +
  10 +import javax.servlet.*;
  11 +import javax.servlet.http.HttpServletRequest;
  12 +import javax.servlet.http.HttpServletResponse;
  13 +import java.io.IOException;
  14 +import java.util.HashMap;
  15 +import java.util.Map;
  16 +import java.util.Set;
  17 +
  18 +/**
  19 + * 权限过滤器
  20 + * @author Hill
  21 + */
  22 +public class AuthorityFilter extends BaseFilter {
  23 +
  24 + Logger logger = LoggerFactory.getLogger(this.getClass());
  25 +
  26 + private ObjectMapper mapper = new ObjectMapper();
  27 +
  28 + private final String rootUri = "/";
  29 +
  30 + private final String scheduleReferer = "/real_control/v2";
  31 +
  32 + private String[] pubUrls = new String[]{ "/sockjs/", "/pages/", "/error", "/dictionary/all", "/user/isWeakCipher", "/user/isRealName", "/user/currentUser", "/user/companyData", "/module/findByCurrentUser", "/eci/validate_get_destroy_info", "/business", "/personnel/all_py", "/companyAuthority/all", "/line/all", "/basic/refresh_person_data", "/downloadFile", "/report/lineList", "/adminUtils", "/metronic_v4.5.4", "/assets" };
  33 +
  34 + @Override
  35 + public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
  36 + if (!SystemParamCache.getEnableFilterAuthority()) {
  37 + chain.doFilter(request, response);
  38 + return;
  39 + }
  40 +
  41 + String uri = request.getRequestURI(), referer = request.getHeader("Referer");
  42 + Set<String> links = (Set<String>) request.getSession().getAttribute(Constants.RESOURCE_AUTHORITYS);
  43 + if (rootUri.equals(uri) || (referer != null && referer.indexOf(scheduleReferer) > 0) || isPubURL(uri)) {
  44 + chain.doFilter(request, response);
  45 + return;
  46 + }
  47 + if (links != null) {
  48 + boolean matched = false;
  49 + for (String link : links) {
  50 + if (uri.startsWith(link)) {
  51 + matched = true;
  52 + break;
  53 + }
  54 + }
  55 + if (!matched) {
  56 + Map<String, Object> result = new HashMap<>();
  57 + result.put("status", ResponseCode.ERROR);
  58 + result.put("msg", "未授权的访问");
  59 + response.setContentType("text/html;charset=utf-8");
  60 + response.getWriter().write(mapper.writeValueAsString(result));
  61 + return;
  62 + }
  63 + }
  64 +
  65 + chain.doFilter(request, response);
  66 + }
  67 +
  68 + protected boolean isPubURL(String url) {
  69 + for (String pubUrl : pubUrls) {
  70 + if (url.startsWith(pubUrl)) {
  71 + return true;
  72 + }
  73 + }
  74 +
  75 + return false;
  76 + }
  77 +}
... ...
src/main/java/com/bsth/filter/SQLInjectFilter.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.filter;
  2 +
  3 +import com.bsth.data.SystemParamCache;
  4 +import org.springframework.stereotype.Component;
  5 +
  6 +import javax.servlet.FilterChain;
  7 +import javax.servlet.ServletException;
  8 +import javax.servlet.http.HttpServletRequest;
  9 +import javax.servlet.http.HttpServletResponse;
  10 +import java.io.IOException;
  11 +import java.util.Enumeration;
  12 +
  13 +@Component
  14 +public class SQLInjectFilter extends BaseFilter{
  15 +
  16 + private static String injStr = "'|and|exec|create|insert|select|delete|update|count|*|%|chr|mid|master|truncate|drop|char|declare";
  17 +
  18 + private final static String specialUri = "adminUtils";
  19 +
  20 + @Override
  21 + public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
  22 + throws IOException, ServletException {
  23 + if (!SystemParamCache.getEnabledFilterSqlInjection()) {
  24 + chain.doFilter(request, response);
  25 + return;
  26 + }
  27 +
  28 + //获取请求对象中的参数名称
  29 + Enumeration enu = request.getParameterNames();
  30 + String uri = request.getRequestURI();
  31 +
  32 + if (uri.indexOf(specialUri) > -1) {
  33 + chain.doFilter(request, response);
  34 + return;
  35 + }
  36 +
  37 + //遍历枚举
  38 + while (enu.hasMoreElements()) {
  39 + //取参数名
  40 + String paraName = (String)enu.nextElement();
  41 +
  42 + //取参数值并校验
  43 + if (isSqlInject(request.getParameter(paraName))) {
  44 + return;
  45 + }
  46 + }
  47 + //校验完毕，放行
  48 + chain.doFilter(request, response);
  49 + }
  50 +
  51 + private static boolean isSqlInject(String injectStr) {
  52 + String injStrArr[] = injStr.split("\\|");
  53 + injectStr = injectStr.toLowerCase();
  54 + for (int i = 0; i < injStrArr.length; i++) {
  55 + if (injectStr.indexOf(injStrArr[i]) >= 0) {
  56 + return true;
  57 + }
  58 + }
  59 + return false;
  60 + }
  61 +
  62 + public static String getInjStr() {
  63 + return injStr;
  64 + }
  65 +
  66 + public static void setInjStr(String injStr) {
  67 + SQLInjectFilter.injStr = injStr;
  68 + }
  69 +}
... ...
src/main/java/com/bsth/security/WebSecurityConfig.java
  View file @07243d3
1   -package com.bsth.security;
2   -
3   -import org.springframework.beans.factory.annotation.Autowired;
4   -import org.springframework.boot.context.embedded.ServletListenerRegistrationBean;
5   -import org.springframework.context.annotation.Bean;
6   -import org.springframework.context.annotation.Configuration;
7   -import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
8   -import org.springframework.security.config.annotation.web.builders.HttpSecurity;
9   -import org.springframework.security.config.annotation.web.builders.WebSecurity;
10   -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
11   -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
12   -import org.springframework.security.core.session.SessionRegistry;
13   -import org.springframework.security.core.session.SessionRegistryImpl;
14   -import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
15   -import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
16   -import org.springframework.security.web.session.HttpSessionEventPublisher;
17   -
18   -import com.bsth.common.Constants;
19   -import com.bsth.security.filter.LoginInterceptor;
20   -
21   -@Configuration
22   -@EnableWebSecurity
23   -public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
24   -
25   - @Autowired
26   - UserDetailServiceImpl customUserDetailService;
27   -
28   - @Autowired
29   - CustomAccessDecisionManager customAccessDecisionManager;
30   -
31   - @Autowired
32   - SecurityMetadataSourceService securityMetadataSourceService;
33   -
34   -
35   - @Override
36   - public void configure(WebSecurity web) throws Exception {
37   - // 白名单
38   - web.ignoring().antMatchers(Constants.LOGIN_PAGE, Constants.LOGIN, Constants.ASSETS_URL, Constants.FAVICON_URL, Constants.CAPTCHA,
39   - Constants.SERVICE_INTERFACE, Constants.METRONIC_URL, Constants.LOGIN_FAILURE, Constants.UPSTREAM_URL, Constants.XD_CHILD_PAGES, Constants.STATIONSIGNO_URL, Constants.UP_RFID_URL,Constants.STATION_AND_SECTION_COUNT);
40   - }
41   -
42   - @Override
43   - protected void configure(AuthenticationManagerBuilder auth)
44   - throws Exception {
45   - auth.userDetailsService(customUserDetailService).passwordEncoder(
46   - new BCryptPasswordEncoder(4));
47   - }
48   -
49   - @Override
50   - protected void configure(HttpSecurity http) throws Exception {
51   - http.authorizeRequests().antMatchers("/").permitAll().anyRequest()
52   - .authenticated().and()
53   - .formLogin()
54   - //指定登录页
55   - .loginPage(Constants.LOGIN_PAGE)
56   - .loginProcessingUrl(Constants.LOGIN).permitAll()
57   - .and().logout()
58   - //禁用CXRF
59   - .and().csrf().disable()
60   - //禁用匿名用户功能
61   - .anonymous().disable()
62   - //允许 iframe
63   - .headers().frameOptions().disable();
64   -
65   - // 同时只保持一个回话
66   - http.sessionManagement().maximumSessions(1)
67   - .expiredUrl(Constants.LOGIN_PAGE + "?error=true")
68   - .maxSessionsPreventsLogin(false)//让之前的登录过期
69   - .sessionRegistry(sessionRegistry());
70   -
71   - http.addFilterBefore(new LoginInterceptor(), FilterSecurityInterceptor.class);
72   - http.addFilter(filterSecurityInterceptor());
73   - }
74   -
75   - private FilterSecurityInterceptor filterSecurityInterceptor()
76   - throws Exception {
77   - FilterSecurityInterceptor filterSecurityInterceptor = new FilterSecurityInterceptor();
78   - filterSecurityInterceptor
79   - .setAccessDecisionManager(customAccessDecisionManager);
80   - filterSecurityInterceptor
81   - .setSecurityMetadataSource(securityMetadataSourceService);
82   - filterSecurityInterceptor
83   - .setAuthenticationManager(authenticationManager());
84   - return filterSecurityInterceptor;
85   - }
86   -
87   -/* @Bean
88   - public LoginSuccessHandler loginSuccessHandler(){
89   - return new LoginSuccessHandler();
90   - }*/
91   -
92   -/* @Bean
93   - public LogoutHandler logoutHandler(){
94   - return new CustomLogoutHandler();
95   - }*/
96   -
97   - @Bean
98   - public SessionRegistry sessionRegistry() {
99   - SessionRegistry sessionRegistry = new SessionRegistryImpl();
100   - return sessionRegistry;
101   - }
102   -
103   - @Bean
104   - public static ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
105   - return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(
106   - new HttpSessionEventPublisher());
107   - }
108   -}
  1 +package com.bsth.security;
  2 +
  3 +import com.bsth.filter.AuthorityFilter;
  4 +import org.springframework.beans.factory.annotation.Autowired;
  5 +import org.springframework.boot.context.embedded.ServletListenerRegistrationBean;
  6 +import org.springframework.context.annotation.Bean;
  7 +import org.springframework.context.annotation.Configuration;
  8 +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  9 +import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  10 +import org.springframework.security.config.annotation.web.builders.WebSecurity;
  11 +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  12 +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  13 +import org.springframework.security.core.session.SessionRegistry;
  14 +import org.springframework.security.core.session.SessionRegistryImpl;
  15 +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  16 +import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
  17 +import org.springframework.security.web.session.HttpSessionEventPublisher;
  18 +
  19 +import com.bsth.common.Constants;
  20 +import com.bsth.security.filter.LoginInterceptor;
  21 +
  22 +@Configuration
  23 +@EnableWebSecurity
  24 +public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  25 +
  26 + @Autowired
  27 + UserDetailServiceImpl customUserDetailService;
  28 +
  29 + @Autowired
  30 + CustomAccessDecisionManager customAccessDecisionManager;
  31 +
  32 + @Autowired
  33 + SecurityMetadataSourceService securityMetadataSourceService;
  34 +
  35 +
  36 + @Override
  37 + public void configure(WebSecurity web) throws Exception {
  38 + // 白名单
  39 + web.ignoring().antMatchers(Constants.LOGIN_PAGE, Constants.LOGIN, Constants.ASSETS_URL, Constants.FAVICON_URL, Constants.CAPTCHA,
  40 + Constants.SERVICE_INTERFACE, Constants.METRONIC_URL, Constants.LOGIN_FAILURE, Constants.UPSTREAM_URL, Constants.XD_CHILD_PAGES, Constants.STATIONSIGNO_URL, Constants.UP_RFID_URL,Constants.STATION_AND_SECTION_COUNT);
  41 + }
  42 +
  43 + @Override
  44 + protected void configure(AuthenticationManagerBuilder auth)
  45 + throws Exception {
  46 + auth.userDetailsService(customUserDetailService).passwordEncoder(
  47 + new BCryptPasswordEncoder(4));
  48 + }
  49 +
  50 + @Override
  51 + protected void configure(HttpSecurity http) throws Exception {
  52 + http.authorizeRequests().antMatchers("/").permitAll().anyRequest()
  53 + .authenticated().and()
  54 + .formLogin()
  55 + //指定登录页
  56 + .loginPage(Constants.LOGIN_PAGE)
  57 + .loginProcessingUrl(Constants.LOGIN).permitAll()
  58 + .and().logout()
  59 + //禁用CXRF
  60 + .and().csrf().disable()
  61 + //禁用匿名用户功能
  62 + .anonymous().disable()
  63 + //允许 iframe
  64 + .headers().frameOptions().disable();
  65 +
  66 + // 同时只保持一个回话
  67 + http.sessionManagement().maximumSessions(1)
  68 + .expiredUrl(Constants.LOGIN_PAGE + "?error=true")
  69 + .maxSessionsPreventsLogin(false)//让之前的登录过期
  70 + .sessionRegistry(sessionRegistry());
  71 +
  72 + http.addFilterBefore(new LoginInterceptor(), FilterSecurityInterceptor.class);
  73 + http.addFilterBefore(new AuthorityFilter(), FilterSecurityInterceptor.class);
  74 + http.addFilter(filterSecurityInterceptor());
  75 + }
  76 +
  77 + private FilterSecurityInterceptor filterSecurityInterceptor()
  78 + throws Exception {
  79 + FilterSecurityInterceptor filterSecurityInterceptor = new FilterSecurityInterceptor();
  80 + filterSecurityInterceptor
  81 + .setAccessDecisionManager(customAccessDecisionManager);
  82 + filterSecurityInterceptor
  83 + .setSecurityMetadataSource(securityMetadataSourceService);
  84 + filterSecurityInterceptor
  85 + .setAuthenticationManager(authenticationManager());
  86 + return filterSecurityInterceptor;
  87 + }
  88 +
  89 +/* @Bean
  90 + public LoginSuccessHandler loginSuccessHandler(){
  91 + return new LoginSuccessHandler();
  92 + }*/
  93 +
  94 +/* @Bean
  95 + public LogoutHandler logoutHandler(){
  96 + return new CustomLogoutHandler();
  97 + }*/
  98 +
  99 + @Bean
  100 + public SessionRegistry sessionRegistry() {
  101 + SessionRegistry sessionRegistry = new SessionRegistryImpl();
  102 + return sessionRegistry;
  103 + }
  104 +
  105 + @Bean
  106 + public static ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
  107 + return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(
  108 + new HttpSessionEventPublisher());
  109 + }
  110 +}
... ...
src/main/java/com/bsth/service/SystemParamService.java
  View file @07243d3
... ... @@ -6,4 +6,8 @@ import com.bsth.entity.SystemParam;
6 6 * @author Hill
7 7 */
8 8 public interface SystemParamService extends BaseService<SystemParam, Integer> {
  9 +
  10 + void refresh();
  11 +
  12 + String getValue(String key);
9 13 }
... ...
src/main/java/com/bsth/service/impl/SystemParamServiceImpl.java
  View file @07243d3
1 1 package com.bsth.service.impl;
2 2  
3 3 import com.bsth.entity.SystemParam;
  4 +import com.bsth.repository.SystemParamRepository;
4 5 import com.bsth.service.SystemParamService;
  6 +import org.springframework.beans.factory.annotation.Autowired;
  7 +import org.springframework.scheduling.annotation.EnableScheduling;
  8 +import org.springframework.scheduling.annotation.Scheduled;
  9 +import org.springframework.stereotype.Service;
  10 +
  11 +import java.util.HashMap;
  12 +import java.util.Map;
5 13  
6 14 /**
7 15 * @author Hill
8 16 */
  17 +@Service
  18 +@EnableScheduling
9 19 public class SystemParamServiceImpl extends BaseServiceImpl<SystemParam, Integer> implements SystemParamService {
10   -}
  20 +
  21 + @Autowired
  22 + private SystemParamRepository systemParamRepository;
  23 +
  24 + private Map<String, String> pairs = new HashMap<>();
  25 +
  26 + @Scheduled(cron = "0 0/30 * * * ?")
  27 + public void refresh() {
  28 + for (SystemParam sp : systemParamRepository.findAll()) {
  29 + pairs.put(sp.getKey(), sp.getValue());
  30 + }
  31 + }
  32 +
  33 + public String getValue(String key) {
  34 + return pairs.get(key);
  35 + }
  36 +}
11 37 \ No newline at end of file
... ...