潘钊 / bsth_control · Commits

Commit 07243d32cc01fb70705505e177123d7386f670a9

Authored by 王通
1 parent daf25afc

1.加入越权和sql注入防御机制

Inline Side-by-side
Showing 13 changed files with 792 additions and 338 deletions
src/main/java/com/bsth/common/Constants.java
  View file @07243d3
1 -package com.bsth.common;  
2 -  
3 -/**  
4 - *  
5 - * @ClassName: Constants  
6 - * @Description: TODO(常量类)  
7 - * @author PanZhao  
8 - * @date 2016年3月18日 下午11:06:53  
9 - *  
10 - */  
11 -public class Constants {  
12 -  
13 - /**  
14 - * 不需要拦截的资源  
15 - */  
16 - public static final String LOGIN = "/user/login/**";  
17 - public static final String LOGIN_PAGE = "/login.html";  
18 - public static final String ASSETS_URL = "/assets/**";  
19 - public static final String FAVICON_URL = "/favicon.ico";  
20 - public static final String METRONIC_URL = "/metronic_v4.5.4/**";  
21 - public static final String LOGIN_FAILURE = "/user/loginFailure";  
22 - public static final String CAPTCHA = "/captcha.jpg";  
23 - //免登录白名单  
24 - public static final String XD_PAGE = "/pages/control/lineallot_v3/**";  
25 - public static final String FREE_URL="/freeLogin/**";  
26 - public static final String FREE_XD_CHILD_PAGES = "/real_control_v3/**";  
27 -  
28 - //对外的营运数据接口  
29 - public static final String SERVICE_INTERFACE = "/companyService/**";  
30 -  
31 - /**  
32 - * 线调部分子页面不做拦截，便于浏览器缓存  
33 - */  
34 - public static final String XD_CHILD_PAGES = "/real_control_v2/**";  
35 - public static final String XD_REAL_GPS = "/gps/real/line";  
36 - //public static final String XD_TEMPS = "/pages/control/line/temps/**";  
37 -  
38 - //车载网关上行接口  
39 - public static final String UPSTREAM_URL = "/control/upstream";  
40 - //站点道闸上传入口  
41 - public static final String STATIONSIGNO_URL = "/control/stationSigno";  
42 - //rfid 上传入口  
43 - public static final String UP_RFID_URL = "/rfid/**";  
44 -  
45 - public static final String SESSION_USERNAME = "sessionUserName";  
46 - public static final String COMPANY_AUTHORITYS = "cmyAuths";  
47 - public static final String STATION_AND_SECTION_COUNT = "/station/updateStationAndSectionCode";  
48 -  
49 - /**  
50 - * 解除调度指令和班次的外键约束  
51 - */  
52 - public static final String REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch=?";  
53 -  
54 - /**  
55 - * 批量解除调度指令和班次的外键约束  
56 - */  
57 - public static final String MULTI_REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch in ";  
58 -} 1 +package com.bsth.common;
  2 +
  3 +/**
  4 + *
  5 + * @ClassName: Constants
  6 + * @Description: TODO(常量类)
  7 + * @author PanZhao
  8 + * @date 2016年3月18日 下午11:06:53
  9 + *
  10 + */
  11 +public class Constants {
  12 +
  13 + /**
  14 + * 不需要拦截的资源
  15 + */
  16 + public static final String LOGIN = "/user/login/**";
  17 + public static final String LOGIN_PAGE = "/login.html";
  18 + public static final String ASSETS_URL = "/assets/**";
  19 + public static final String FAVICON_URL = "/favicon.ico";
  20 + public static final String METRONIC_URL = "/metronic_v4.5.4/**";
  21 + public static final String LOGIN_FAILURE = "/user/loginFailure";
  22 + public static final String CAPTCHA = "/captcha.jpg";
  23 + //免登录白名单
  24 + public static final String XD_PAGE = "/pages/control/lineallot_v3/**";
  25 + public static final String FREE_URL="/freeLogin/**";
  26 + public static final String FREE_XD_CHILD_PAGES = "/real_control_v3/**";
  27 +
  28 + //对外的营运数据接口
  29 + public static final String SERVICE_INTERFACE = "/companyService/**";
  30 +
  31 + /**
  32 + * 线调部分子页面不做拦截，便于浏览器缓存
  33 + */
  34 + public static final String XD_CHILD_PAGES = "/real_control_v2/**";
  35 + public static final String XD_REAL_GPS = "/gps/real/line";
  36 + //public static final String XD_TEMPS = "/pages/control/line/temps/**";
  37 +
  38 + //车载网关上行接口
  39 + public static final String UPSTREAM_URL = "/control/upstream";
  40 + //站点道闸上传入口
  41 + public static final String STATIONSIGNO_URL = "/control/stationSigno";
  42 + //rfid 上传入口
  43 + public static final String UP_RFID_URL = "/rfid/**";
  44 +
  45 + public static final String SESSION_USERNAME = "sessionUserName";
  46 + public static final String COMPANY_AUTHORITYS = "cmyAuths";
  47 + public static final String STATION_AND_SECTION_COUNT = "/station/updateStationAndSectionCode";
  48 +
  49 + /**
  50 + * 解除调度指令和班次的外键约束
  51 + */
  52 + public static final String REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch=?";
  53 +
  54 + /**
  55 + * 批量解除调度指令和班次的外键约束
  56 + */
  57 + public static final String MULTI_REMOVE_DIRECTIVE_SCH_FK = "update bsth_v_directive_60 set sch=NULL where sch in ";
  58 +
  59 + public static final String RESOURCE_AUTHORITYS = "resourceAuthoritys";
  60 +}
src/main/java/com/bsth/common/SystemParamKeys.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.common;
  2 +
  3 +/**
  4 + * @author Hill
  5 + */
  6 +public class SystemParamKeys {
  7 +
  8 + public static final String SPECIAL_ROLES = "special.roles";
  9 +
  10 + public static final String SPECIAL_DAYS = "special.days";
  11 +
  12 + public static final String URL_HTTP_GPS_REAL_CACHE = "url.http.gps.real.cache";
  13 +
  14 + public static final String URL_HTTP_GPS_REAL = "url.http.gps.real";
  15 +
  16 + public static final String URL_HTTP_DIRECTIVE = "url.http.directive";
  17 +
  18 + public static final String URL_HTTP_RFID = "url.http.rfid";
  19 +
  20 + public static final String URL_HTTP_REPORT = "url.http.report.%s";
  21 +
  22 + public static final String URL_HTTP_TICKETING = "url.http.ticketing";
  23 +
  24 + public static final String URL_HTTP_DSM_ACK = "url.http.dsm.ack";
  25 +
  26 + public static final String URL_HTTP_CP_ACK = "url.http.cp.ack";
  27 +
  28 + public static final String MAIL_ADMIN = "mail.admin";
  29 +
  30 + public static final String MAIL_WAYBILL = "mail.waybill";
  31 +
  32 + public static final String ENABLED_FIRST_LAST_GENERATION = "enabled.first.last.generation";
  33 +
  34 + public static final String ENABLED_FILTER_SQL_INJECTION = "enabled.filter.sql.injection";
  35 +
  36 + public static final String ENABLED_SSO = "enabled.sso";
  37 +
  38 + public static final String SSO_SYSTEM_CODE = "sso.system.code";
  39 +
  40 + public static final String URL_HTTP_SSO_LOGIN = "url.http.sso.login";
  41 +
  42 + public static final String URL_HTTP_SSO_LOGOUT = "url.http.sso.logout";
  43 +
  44 + public static final String URL_HTTP_SSO_AUTH = "url.http.sso.auth";
  45 +
  46 + public static final String URL_HTTP_MAINTENANCE = "url.http.maintenance";
  47 +
  48 + public static final String ENABLED_WHITE_IP = "enabled.white.ip";
  49 +
  50 + public static final String ENABLED_FILTER_AUTHORITY = "enabled.filter.authority";
  51 +}
src/main/java/com/bsth/controller/realcontrol/AdminUtilsController.java
  View file @07243d3
@@ -5,14 +5,21 @@ import ch.qos.logback.classic.LoggerContext; @@ -5,14 +5,21 @@ import ch.qos.logback.classic.LoggerContext;
5 import com.bsth.data.BasicData; 5 import com.bsth.data.BasicData;
6 import com.bsth.data.directive.DayOfDirectives; 6 import com.bsth.data.directive.DayOfDirectives;
7 import com.bsth.data.directive.DirectivesPstThread; 7 import com.bsth.data.directive.DirectivesPstThread;
  8 +import com.bsth.data.directive.GatewayHttpUtils;
8 import com.bsth.data.gpsdata_v2.cache.GeoCacheData; 9 import com.bsth.data.gpsdata_v2.cache.GeoCacheData;
9 import com.bsth.data.gpsdata_v2.handlers.overspeed.OverspeedProcess; 10 import com.bsth.data.gpsdata_v2.handlers.overspeed.OverspeedProcess;
  11 +import com.bsth.data.gpsdata_v2.load.GatewayHttpLoader;
  12 +import com.bsth.data.gpsdata_v2.load.SocketClientLoader;
10 import com.bsth.data.gpsdata_v2.thread.GpsDataLoaderThread; 13 import com.bsth.data.gpsdata_v2.thread.GpsDataLoaderThread;
11 import com.bsth.data.msg_queue.DirectivePushQueue; 14 import com.bsth.data.msg_queue.DirectivePushQueue;
12 import com.bsth.data.msg_queue.WebSocketPushQueue; 15 import com.bsth.data.msg_queue.WebSocketPushQueue;
13 import com.bsth.data.pilot80.PilotReport; 16 import com.bsth.data.pilot80.PilotReport;
14 import com.bsth.data.schedule.DayOfSchedule; 17 import com.bsth.data.schedule.DayOfSchedule;
15 import com.bsth.entity.realcontrol.ScheduleRealInfo; 18 import com.bsth.entity.realcontrol.ScheduleRealInfo;
  19 +import com.bsth.filter.SQLInjectFilter;
  20 +import com.bsth.service.SectionService;
  21 +import com.bsth.service.StationService;
  22 +import com.bsth.service.SystemParamService;
16 import com.bsth.websocket.handler.SendUtils; 23 import com.bsth.websocket.handler.SendUtils;
17 import com.fasterxml.jackson.databind.ObjectMapper; 24 import com.fasterxml.jackson.databind.ObjectMapper;
18 import org.slf4j.Logger; 25 import org.slf4j.Logger;
@@ -58,6 +65,18 @@ public class AdminUtilsController { @@ -58,6 +65,18 @@ public class AdminUtilsController {
58 @Autowired 65 @Autowired
59 private BasicData.BasicDataLoader basicDataLoader; 66 private BasicData.BasicDataLoader basicDataLoader;
60 67
  68 + @Autowired
  69 + private SystemParamService systemParamService;
  70 +
  71 + @Autowired
  72 + private SocketClientLoader socketClientLoader;
  73 +
  74 + @Autowired
  75 + private GatewayHttpLoader gatewayHttpLoader;
  76 +
  77 + @Autowired
  78 + private GatewayHttpUtils gatewayHttpUtils;
  79 +
61 /** 80 /**
62 * 出现重复班次的车辆 81 * 出现重复班次的车辆
63 * 82 *
@@ -216,11 +235,56 @@ public class AdminUtilsController { @@ -216,11 +235,56 @@ public class AdminUtilsController {
216 return "error"; 235 return "error";
217 } 236 }
218 237
  238 + @RequestMapping("/setInjectStr")
  239 + public String setInjectStr(@RequestParam String injectStr) {
  240 + Map<String, Object> result = new HashMap<>();
  241 + try {
  242 + SQLInjectFilter.setInjStr(injectStr);
  243 + return "success";
  244 + } catch (Exception e) {
  245 + e.printStackTrace();
  246 + }
  247 +
  248 + return "error";
  249 + }
  250 +
219 @RequestMapping("/reloadSystemParam") 251 @RequestMapping("/reloadSystemParam")
220 public String reloadSystemParam() { 252 public String reloadSystemParam() {
221 - Map<String, Object> result = new HashMap<>();  
222 try { 253 try {
223 - basicDataLoader.loadSystemParam(); 254 + systemParamService.refresh();
  255 +
  256 + return "success";
  257 + } catch (Exception e) {
  258 + e.printStackTrace();
  259 + }
  260 +
  261 + return "error";
  262 + }
  263 +
  264 + @RequestMapping("/applySystemParam")
  265 + public String applySystemParam() {
  266 + try {
  267 + socketClientLoader.afterPropertiesSet();
  268 + gatewayHttpLoader.afterPropertiesSet();
  269 + gatewayHttpUtils.afterPropertiesSet();
  270 +
  271 + return "success";
  272 + } catch (Exception e) {
  273 + e.printStackTrace();
  274 + }
  275 +
  276 + return "error";
  277 + }
  278 +
  279 + @RequestMapping("/reloadAndApplySystemParam")
  280 + public String reloadAndApplySystemParam() {
  281 + try {
  282 + systemParamService.refresh();
  283 +
  284 + socketClientLoader.afterPropertiesSet();
  285 + gatewayHttpLoader.afterPropertiesSet();
  286 + gatewayHttpUtils.afterPropertiesSet();
  287 +
224 return "success"; 288 return "success";
225 } catch (Exception e) { 289 } catch (Exception e) {
226 e.printStackTrace(); 290 e.printStackTrace();
src/main/java/com/bsth/data/SystemParamCache.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.data;
  2 +
  3 +import com.bsth.common.SystemParamKeys;
  4 +import com.bsth.service.SystemParamService;
  5 +import org.springframework.beans.factory.InitializingBean;
  6 +import org.springframework.beans.factory.annotation.Autowired;
  7 +import org.springframework.stereotype.Component;
  8 +
  9 +/**
  10 + * @author Hill
  11 + */
  12 +@Component
  13 +public class SystemParamCache implements InitializingBean {
  14 +
  15 + @Autowired
  16 + private SystemParamService systemParamService;
  17 +
  18 + private static SystemParamService systemParamService1;
  19 +
  20 + public static String getSpecialRoles() {
  21 + return systemParamService1.getValue(SystemParamKeys.SPECIAL_ROLES);
  22 + }
  23 +
  24 + public static String getSpecialDays() {
  25 + return systemParamService1.getValue(SystemParamKeys.SPECIAL_DAYS);
  26 + }
  27 +
  28 + public static String getUrlHttpGpsRealCache() {
  29 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_GPS_REAL_CACHE);
  30 + }
  31 +
  32 + public static String getUrlHttpGpsReal() {
  33 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_GPS_REAL);
  34 + }
  35 +
  36 + public static String getUrlHttpDirective() {
  37 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_DIRECTIVE);
  38 + }
  39 +
  40 + public static String getUrlHttpRfid() {
  41 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_RFID);
  42 + }
  43 +
  44 + public static String getUrlHttpReport(String param) {
  45 + return systemParamService1.getValue(String.format(SystemParamKeys.URL_HTTP_REPORT, param));
  46 + }
  47 +
  48 + public static String getUrlHttpTicketing() {
  49 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_TICKETING);
  50 + }
  51 +
  52 + public static String getUrlHttpDsmAck() {
  53 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_DSM_ACK);
  54 + }
  55 +
  56 + public static String getUrlHttpCpAck() {
  57 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_CP_ACK);
  58 + }
  59 +
  60 + public static String getMailAdmin() {
  61 + return systemParamService1.getValue(SystemParamKeys.MAIL_ADMIN);
  62 + }
  63 +
  64 + public static String getMailWaybill() {
  65 + return systemParamService1.getValue(SystemParamKeys.MAIL_WAYBILL);
  66 + }
  67 +
  68 + public static boolean getEnabledFirstLastGeneration() {
  69 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_FIRST_LAST_GENERATION));
  70 + }
  71 +
  72 + public static boolean getEnabledFilterSqlInjection() {
  73 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_FILTER_SQL_INJECTION));
  74 + }
  75 +
  76 + public static boolean getEnabledSso() {
  77 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_SSO));
  78 + }
  79 +
  80 + public static String getSsoSystemCode() {
  81 + return systemParamService1.getValue(SystemParamKeys.SSO_SYSTEM_CODE);
  82 + }
  83 +
  84 + public static String getUrlHttpSsoLogin() {
  85 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_SSO_LOGIN);
  86 + }
  87 +
  88 + public static String getUrlHttpSsoLogout() {
  89 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_SSO_LOGOUT);
  90 + }
  91 +
  92 + public static String getUrlHttpSsoAuth() {
  93 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_SSO_AUTH);
  94 + }
  95 +
  96 + public static String getUrlHttpMaintenance() {
  97 + return systemParamService1.getValue(SystemParamKeys.URL_HTTP_MAINTENANCE);
  98 + }
  99 +
  100 + public static boolean getEnabledWhiteIp() {
  101 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_WHITE_IP));
  102 + }
  103 +
  104 + public static boolean getEnableFilterAuthority() {
  105 + return Boolean.parseBoolean(systemParamService1.getValue(SystemParamKeys.ENABLED_FILTER_AUTHORITY));
  106 + }
  107 +
  108 + @Override
  109 + public void afterPropertiesSet() throws Exception {
  110 + systemParamService1 = systemParamService;
  111 + systemParamService1.refresh();
  112 + }
  113 +}
src/main/java/com/bsth/data/directive/GatewayHttpUtils.java
  View file @07243d3
1 -package com.bsth.data.directive;  
2 -  
3 -import com.alibaba.fastjson.JSONObject;  
4 -import com.bsth.util.ConfigUtil;  
5 -import org.apache.http.client.config.RequestConfig;  
6 -import org.apache.http.client.methods.CloseableHttpResponse;  
7 -import org.apache.http.client.methods.HttpPost;  
8 -import org.apache.http.entity.StringEntity;  
9 -import org.apache.http.impl.client.CloseableHttpClient;  
10 -import org.apache.http.impl.client.HttpClients;  
11 -import org.apache.http.util.EntityUtils;  
12 -import org.slf4j.Logger;  
13 -import org.slf4j.LoggerFactory;  
14 -  
15 -/**  
16 - * @author PanZhao  
17 - * @ClassName: GatewayHttpUtils  
18 - * @Description: TODO(和网关HTTP通讯工具类)  
19 - * @date 2016年8月14日 下午9:50:46  
20 - */  
21 -public class GatewayHttpUtils {  
22 - static Logger logger = LoggerFactory.getLogger(GatewayHttpUtils.class);  
23 -  
24 - static String url;  
25 - static CloseableHttpClient httpClient = null;  
26 - static HttpPost post;  
27 - static RequestConfig requestConfig;  
28 - static CloseableHttpResponse response;  
29 -  
30 - static {  
31 - url = ConfigUtil.get("http.send.directive");  
32 - httpClient = HttpClients.createDefault();  
33 - post = new HttpPost(url);  
34 - requestConfig = RequestConfig.custom()  
35 - .setConnectTimeout(3000).setConnectionRequestTimeout(2000)  
36 - .setSocketTimeout(3000).build();  
37 - post.setConfig(requestConfig);  
38 - }  
39 -  
40 - public static int postJson(String jsonStr) {  
41 - logger.info("send : " + jsonStr);  
42 -  
43 - int code = -1;  
44 - try {  
45 - post.setEntity(new StringEntity(jsonStr, "utf-8"));  
46 -  
47 - response = httpClient.execute(post);  
48 -  
49 - int statusCode = response.getStatusLine().getStatusCode();  
50 - if(statusCode != 200){  
51 - logger.error("http client status code: " + statusCode);  
52 - }  
53 -  
54 - JSONObject json = JSONObject.parseObject(EntityUtils.toString(response.getEntity()));  
55 - if (null != json && json.getInteger("errCode") == 0)  
56 - code = 0;  
57 - else  
58 - logger.error("和网关http通讯失败，rs: " + json);  
59 -  
60 - if (null != response)  
61 - response.close();  
62 - } catch (Exception e) {  
63 - logger.error("", e);  
64 - }  
65 - return code;  
66 - }  
67 -} 1 +package com.bsth.data.directive;
  2 +
  3 +import com.alibaba.fastjson.JSONObject;
  4 +import com.bsth.data.SystemParamCache;
  5 +import org.apache.http.client.config.RequestConfig;
  6 +import org.apache.http.client.methods.CloseableHttpResponse;
  7 +import org.apache.http.client.methods.HttpPost;
  8 +import org.apache.http.entity.StringEntity;
  9 +import org.apache.http.impl.client.CloseableHttpClient;
  10 +import org.apache.http.impl.client.HttpClients;
  11 +import org.apache.http.util.EntityUtils;
  12 +import org.slf4j.Logger;
  13 +import org.slf4j.LoggerFactory;
  14 +import org.springframework.beans.factory.InitializingBean;
  15 +import org.springframework.stereotype.Component;
  16 +
  17 +/**
  18 + * @author PanZhao
  19 + * @ClassName: GatewayHttpUtils
  20 + * @Description: TODO(和网关HTTP通讯工具类)
  21 + * @date 2016年8月14日 下午9:50:46
  22 + */
  23 +@Component
  24 +public class GatewayHttpUtils implements InitializingBean {
  25 + static Logger logger = LoggerFactory.getLogger(GatewayHttpUtils.class);
  26 +
  27 + static String url;
  28 + static CloseableHttpClient httpClient = null;
  29 + static HttpPost post;
  30 + static RequestConfig requestConfig;
  31 + static CloseableHttpResponse response;
  32 +
  33 + public static int postJson(String jsonStr) {
  34 + logger.info("send : " + jsonStr);
  35 +
  36 + int code = -1;
  37 + try {
  38 + post.setEntity(new StringEntity(jsonStr, "utf-8"));
  39 +
  40 + response = httpClient.execute(post);
  41 +
  42 + int statusCode = response.getStatusLine().getStatusCode();
  43 + if(statusCode != 200){
  44 + logger.error("http client status code: " + statusCode);
  45 + }
  46 +
  47 + JSONObject json = JSONObject.parseObject(EntityUtils.toString(response.getEntity()));
  48 + if (null != json && json.getInteger("errCode") == 0)
  49 + code = 0;
  50 + else
  51 + logger.error("和网关http通讯失败，rs: " + json);
  52 +
  53 + if (null != response)
  54 + response.close();
  55 + } catch (Exception e) {
  56 + logger.error("", e);
  57 + }
  58 + return code;
  59 + }
  60 +
  61 + @Override
  62 + public void afterPropertiesSet() throws Exception {
  63 + url = SystemParamCache.getUrlHttpDirective();
  64 + httpClient = HttpClients.createDefault();
  65 + post = new HttpPost(url);
  66 + requestConfig = RequestConfig.custom()
  67 + .setConnectTimeout(3000).setConnectionRequestTimeout(2000)
  68 + .setSocketTimeout(3000).build();
  69 + post.setConfig(requestConfig);
  70 + }
  71 +}
src/main/java/com/bsth/data/gpsdata_v2/load/GatewayHttpLoader.java
  View file @07243d3
@@ -2,6 +2,7 @@ package com.bsth.data.gpsdata_v2.load; @@ -2,6 +2,7 @@ package com.bsth.data.gpsdata_v2.load;
2 2
3 import com.alibaba.fastjson.JSON; 3 import com.alibaba.fastjson.JSON;
4 import com.bsth.data.BasicData; 4 import com.bsth.data.BasicData;
  5 +import com.bsth.data.SystemParamCache;
5 import com.bsth.data.gpsdata_v2.GpsRealData; 6 import com.bsth.data.gpsdata_v2.GpsRealData;
6 import com.bsth.data.gpsdata_v2.entity.GpsEntity; 7 import com.bsth.data.gpsdata_v2.entity.GpsEntity;
7 import com.bsth.data.gpsdata_v2.utils.GpsDataUtils; 8 import com.bsth.data.gpsdata_v2.utils.GpsDataUtils;
@@ -16,6 +17,7 @@ import org.apache.http.impl.client.HttpClients; @@ -16,6 +17,7 @@ import org.apache.http.impl.client.HttpClients;
16 import org.slf4j.Logger; 17 import org.slf4j.Logger;
17 import org.slf4j.LoggerFactory; 18 import org.slf4j.LoggerFactory;
18 import org.springframework.beans.BeansException; 19 import org.springframework.beans.BeansException;
  20 +import org.springframework.beans.factory.InitializingBean;
19 import org.springframework.context.ApplicationContext; 21 import org.springframework.context.ApplicationContext;
20 import org.springframework.context.ApplicationContextAware; 22 import org.springframework.context.ApplicationContextAware;
21 import org.springframework.stereotype.Component; 23 import org.springframework.stereotype.Component;
@@ -30,7 +32,7 @@ import java.util.List; @@ -30,7 +32,7 @@ import java.util.List;
30 * Created by panzhao on 2017/11/15. 32 * Created by panzhao on 2017/11/15.
31 */ 33 */
32 @Component 34 @Component
33 -public class GatewayHttpLoader implements ApplicationContextAware{ 35 +public class GatewayHttpLoader implements ApplicationContextAware, InitializingBean {
34 36
35 static Logger logger = LoggerFactory.getLogger(GatewayHttpLoader.class); 37 static Logger logger = LoggerFactory.getLogger(GatewayHttpLoader.class);
36 38
@@ -45,17 +47,6 @@ public class GatewayHttpLoader implements ApplicationContextAware{ @@ -45,17 +47,6 @@ public class GatewayHttpLoader implements ApplicationContextAware{
45 47
46 static GpsRealData gpsRealData; 48 static GpsRealData gpsRealData;
47 49
48 - static{  
49 - url = ConfigUtil.get("http.gps.real.url");  
50 - list = new ArrayList<>();  
51 - httpClient = HttpClients.createDefault();  
52 - get = new HttpGet(url);  
53 - requestConfig = RequestConfig.custom()  
54 - .setConnectTimeout(2500).setConnectionRequestTimeout(2000)  
55 - .setSocketTimeout(2500).build();  
56 - get.setConfig(requestConfig);  
57 - }  
58 -  
59 public static List<GpsEntity> load(){ 50 public static List<GpsEntity> load(){
60 try{ 51 try{
61 if(list.size() > 0) 52 if(list.size() > 0)
@@ -117,4 +108,16 @@ public class GatewayHttpLoader implements ApplicationContextAware{ @@ -117,4 +108,16 @@ public class GatewayHttpLoader implements ApplicationContextAware{
117 public void setApplicationContext(ApplicationContext applicationContext) throws BeansException { 108 public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
118 gpsRealData = applicationContext.getBean(GpsRealData.class); 109 gpsRealData = applicationContext.getBean(GpsRealData.class);
119 } 110 }
  111 +
  112 + @Override
  113 + public void afterPropertiesSet() throws Exception {
  114 + url = SystemParamCache.getUrlHttpGpsReal();
  115 + list = new ArrayList<>();
  116 + httpClient = HttpClients.createDefault();
  117 + get = new HttpGet(url);
  118 + requestConfig = RequestConfig.custom()
  119 + .setConnectTimeout(2500).setConnectionRequestTimeout(2000)
  120 + .setSocketTimeout(2500).build();
  121 + get.setConfig(requestConfig);
  122 + }
120 } 123 }
src/main/java/com/bsth/data/gpsdata_v2/load/SocketClientLoader.java
  View file @07243d3
1 -package com.bsth.data.gpsdata_v2.load;  
2 -  
3 -import com.alibaba.fastjson.JSON;  
4 -import com.bsth.data.BasicData;  
5 -import com.bsth.data.gpsdata_v2.entity.GpsEntity;  
6 -import com.bsth.data.gpsdata_v2.utils.GpsDataUtils;  
7 -import com.bsth.util.ConfigUtil;  
8 -import org.apache.http.HttpEntity;  
9 -import org.apache.http.client.config.RequestConfig;  
10 -import org.apache.http.client.methods.CloseableHttpResponse;  
11 -import org.apache.http.client.methods.HttpGet;  
12 -import org.apache.http.impl.client.CloseableHttpClient;  
13 -import org.apache.http.impl.client.HttpClients;  
14 -import org.slf4j.Logger;  
15 -import org.slf4j.LoggerFactory;  
16 -import org.springframework.stereotype.Component;  
17 -  
18 -import java.io.BufferedReader;  
19 -import java.io.InputStreamReader;  
20 -import java.util.ArrayList;  
21 -import java.util.List;  
22 -  
23 -/**  
24 - * 从专用的socket client 加载数据  
25 - * Created by panzhao on 2017/11/15.  
26 - */  
27 -@Component  
28 -public class SocketClientLoader {  
29 -  
30 - static Logger logger = LoggerFactory.getLogger(SocketClientLoader.class);  
31 -  
32 - static String url;  
33 - static List<GpsEntity> list;  
34 - static CloseableHttpClient httpClient = null;  
35 - static HttpGet get;  
36 - static RequestConfig requestConfig;  
37 - static CloseableHttpResponse response;  
38 - static HttpEntity entity;  
39 - static BufferedReader br;  
40 -  
41 - static {  
42 - url = ConfigUtil.get("http.gps.real.cache.url");  
43 - list = new ArrayList<>();  
44 - httpClient = HttpClients.createDefault();  
45 - get = new HttpGet(url);  
46 - requestConfig = RequestConfig.custom()  
47 - .setConnectTimeout(2500).setConnectionRequestTimeout(2000)  
48 - .setSocketTimeout(2500).build();  
49 - get.setConfig(requestConfig);  
50 - }  
51 -  
52 - public static List<GpsEntity> load(){  
53 - try {  
54 - if(list.size() > 0)  
55 - list.clear();  
56 - logger.info("load start...");  
57 - response = httpClient.execute(get);  
58 - entity = response.getEntity();  
59 - if(null == entity)  
60 - return list;  
61 -  
62 - br = new BufferedReader(new InputStreamReader(entity.getContent()));  
63 - StringBuilder sb = new StringBuilder();  
64 - String str;  
65 - while ((str = br.readLine()) != null)  
66 - sb.append(str);  
67 -  
68 - list = JSON.parseArray(sb.toString(), GpsEntity.class);  
69 -  
70 - logger.info("load end ! size: " + list.size());  
71 - //过滤掉无效的点位  
72 - list = GpsDataUtils.clearInvalid(list);  
73 -  
74 - for (GpsEntity gps : list) {  
75 - gps.setNbbm(BasicData.deviceId2NbbmMap.get(gps.getDeviceId()));  
76 - }  
77 -  
78 - if (null != response)  
79 - response.close();  
80 - } catch (Exception e) {  
81 - logger.error("", e);  
82 - }  
83 -  
84 - return list;  
85 - }  
86 -} 1 +package com.bsth.data.gpsdata_v2.load;
  2 +
  3 +import com.alibaba.fastjson.JSON;
  4 +import com.bsth.data.BasicData;
  5 +import com.bsth.data.SystemParamCache;
  6 +import com.bsth.data.gpsdata_v2.entity.GpsEntity;
  7 +import com.bsth.data.gpsdata_v2.utils.GpsDataUtils;
  8 +import org.apache.http.HttpEntity;
  9 +import org.apache.http.client.config.RequestConfig;
  10 +import org.apache.http.client.methods.CloseableHttpResponse;
  11 +import org.apache.http.client.methods.HttpGet;
  12 +import org.apache.http.impl.client.CloseableHttpClient;
  13 +import org.apache.http.impl.client.HttpClients;
  14 +import org.slf4j.Logger;
  15 +import org.slf4j.LoggerFactory;
  16 +import org.springframework.beans.factory.InitializingBean;
  17 +import org.springframework.stereotype.Component;
  18 +
  19 +import java.io.BufferedReader;
  20 +import java.io.InputStreamReader;
  21 +import java.util.ArrayList;
  22 +import java.util.List;
  23 +
  24 +/**
  25 + * 从专用的socket client 加载数据
  26 + * Created by panzhao on 2017/11/15.
  27 + */
  28 +@Component
  29 +public class SocketClientLoader implements InitializingBean {
  30 +
  31 + static Logger logger = LoggerFactory.getLogger(SocketClientLoader.class);
  32 +
  33 + static String url;
  34 + static List<GpsEntity> list;
  35 + static CloseableHttpClient httpClient = null;
  36 + static HttpGet get;
  37 + static RequestConfig requestConfig;
  38 + static CloseableHttpResponse response;
  39 + static HttpEntity entity;
  40 + static BufferedReader br;
  41 +
  42 + public static List<GpsEntity> load(){
  43 + try {
  44 + if(list.size() > 0)
  45 + list.clear();
  46 + logger.info("load start...");
  47 + response = httpClient.execute(get);
  48 + entity = response.getEntity();
  49 + if(null == entity)
  50 + return list;
  51 +
  52 + br = new BufferedReader(new InputStreamReader(entity.getContent()));
  53 + StringBuilder sb = new StringBuilder();
  54 + String str;
  55 + while ((str = br.readLine()) != null)
  56 + sb.append(str);
  57 +
  58 + list = JSON.parseArray(sb.toString(), GpsEntity.class);
  59 +
  60 + logger.info("load end ! size: " + list.size());
  61 + //过滤掉无效的点位
  62 + list = GpsDataUtils.clearInvalid(list);
  63 +
  64 + for (GpsEntity gps : list) {
  65 + gps.setNbbm(BasicData.deviceId2NbbmMap.get(gps.getDeviceId()));
  66 + }
  67 +
  68 + if (null != response)
  69 + response.close();
  70 + } catch (Exception e) {
  71 + logger.error("", e);
  72 + }
  73 +
  74 + return list;
  75 + }
  76 +
  77 + @Override
  78 + public void afterPropertiesSet() throws Exception {
  79 + url = SystemParamCache.getUrlHttpGpsRealCache();
  80 + list = new ArrayList<>();
  81 + httpClient = HttpClients.createDefault();
  82 + get = new HttpGet(url);
  83 + requestConfig = RequestConfig.custom()
  84 + .setConnectTimeout(2500).setConnectionRequestTimeout(2000)
  85 + .setSocketTimeout(2500).build();
  86 + get.setConfig(requestConfig);
  87 + }
  88 +}
src/main/java/com/bsth/entity/sys/SysUser.java
  View file @07243d3
1 package com.bsth.entity.sys; 1 package com.bsth.entity.sys;
2 2
  3 +import com.fasterxml.jackson.annotation.JsonIgnore;
3 import com.fasterxml.jackson.annotation.JsonIgnoreProperties; 4 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
  5 +import org.springframework.format.annotation.DateTimeFormat;
  6 +import org.springframework.util.StringUtils;
4 import org.joda.time.DateTime; 7 import org.joda.time.DateTime;
5 -  
6 import javax.persistence.*; 8 import javax.persistence.*;
7 import java.util.Date; 9 import java.util.Date;
  10 +import java.util.HashSet;
8 import java.util.LinkedHashSet; 11 import java.util.LinkedHashSet;
9 import java.util.Set; 12 import java.util.Set;
10 13
@@ -25,16 +28,21 @@ public class SysUser { @@ -25,16 +28,21 @@ public class SysUser {
25 private String userName; 28 private String userName;
26 29
27 private String name; 30 private String name;
28 - 31 +
  32 + @JsonIgnore
29 private String password; 33 private String password;
30 34
31 @Column(updatable = false, name = "create_date", columnDefinition = "TIMESTAMP DEFAULT CURRENT_TIMESTAMP") 35 @Column(updatable = false, name = "create_date", columnDefinition = "TIMESTAMP DEFAULT CURRENT_TIMESTAMP")
32 private Date createDate; 36 private Date createDate;
33 -  
34 - @Column(name = "last_loginDate", columnDefinition = "timestamp DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP") 37 +
  38 + @Column(name = "update_date", columnDefinition = "timestamp DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP")
  39 + private Date updateDate;
  40 +
  41 + @DateTimeFormat(pattern = "yyyy-MM-dd")
35 private Date lastLoginDate; 42 private Date lastLoginDate;
36 43
37 /** 最近密码更新时间 */ 44 /** 最近密码更新时间 */
  45 + @DateTimeFormat(pattern = "yyyy-MM-dd")
38 private Date lastPwdDate; 46 private Date lastPwdDate;
39 /** 密码有效期 */ 47 /** 密码有效期 */
40 private Integer pwdValidPeriod; 48 private Integer pwdValidPeriod;
@@ -84,6 +92,14 @@ public class SysUser { @@ -84,6 +92,14 @@ public class SysUser {
84 this.createDate = createDate; 92 this.createDate = createDate;
85 } 93 }
86 94
  95 + public Date getUpdateDate() {
  96 + return updateDate;
  97 + }
  98 +
  99 + public void setUpdateDate(Date updateDate) {
  100 + this.updateDate = updateDate;
  101 + }
  102 +
87 public Date getLastLoginDate() { 103 public Date getLastLoginDate() {
88 return lastLoginDate; 104 return lastLoginDate;
89 } 105 }
@@ -124,6 +140,27 @@ public class SysUser { @@ -124,6 +140,27 @@ public class SysUser {
124 this.roles = roles; 140 this.roles = roles;
125 } 141 }
126 142
  143 + public Set<String> getLinks() {
  144 + Set<String> links = new HashSet<>();
  145 + if (links.size() == 0) {
  146 + for (Role role : roles) {
  147 + for (Module module : role.getModules()) {
  148 + String symbol = module.getMappSymbol();
  149 + if (!StringUtils.isEmpty(symbol)) {
  150 + String[] symbols = symbol.split(";");
  151 + for (String temp : symbols) {
  152 + if (!StringUtils.isEmpty(temp)) {
  153 + links.add(temp);
  154 + }
  155 + }
  156 + }
  157 + }
  158 + }
  159 + }
  160 +
  161 + return links;
  162 + }
  163 +
127 public Date getLastPwdDate() { 164 public Date getLastPwdDate() {
128 return lastPwdDate; 165 return lastPwdDate;
129 } 166 }
src/main/java/com/bsth/filter/AuthorityFilter.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.filter;
  2 +
  3 +import com.bsth.common.Constants;
  4 +import com.bsth.common.ResponseCode;
  5 +import com.bsth.data.SystemParamCache;
  6 +import com.fasterxml.jackson.databind.ObjectMapper;
  7 +import org.slf4j.Logger;
  8 +import org.slf4j.LoggerFactory;
  9 +
  10 +import javax.servlet.*;
  11 +import javax.servlet.http.HttpServletRequest;
  12 +import javax.servlet.http.HttpServletResponse;
  13 +import java.io.IOException;
  14 +import java.util.HashMap;
  15 +import java.util.Map;
  16 +import java.util.Set;
  17 +
  18 +/**
  19 + * 权限过滤器
  20 + * @author Hill
  21 + */
  22 +public class AuthorityFilter extends BaseFilter {
  23 +
  24 + Logger logger = LoggerFactory.getLogger(this.getClass());
  25 +
  26 + private ObjectMapper mapper = new ObjectMapper();
  27 +
  28 + private final String rootUri = "/";
  29 +
  30 + private final String scheduleReferer = "/real_control/v2";
  31 +
  32 + private String[] pubUrls = new String[]{ "/sockjs/", "/pages/", "/error", "/dictionary/all", "/user/isWeakCipher", "/user/isRealName", "/user/currentUser", "/user/companyData", "/module/findByCurrentUser", "/eci/validate_get_destroy_info", "/business", "/personnel/all_py", "/companyAuthority/all", "/line/all", "/basic/refresh_person_data", "/downloadFile", "/report/lineList", "/adminUtils", "/metronic_v4.5.4", "/assets" };
  33 +
  34 + @Override
  35 + public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
  36 + if (!SystemParamCache.getEnableFilterAuthority()) {
  37 + chain.doFilter(request, response);
  38 + return;
  39 + }
  40 +
  41 + String uri = request.getRequestURI(), referer = request.getHeader("Referer");
  42 + Set<String> links = (Set<String>) request.getSession().getAttribute(Constants.RESOURCE_AUTHORITYS);
  43 + if (rootUri.equals(uri) || (referer != null && referer.indexOf(scheduleReferer) > 0) || isPubURL(uri)) {
  44 + chain.doFilter(request, response);
  45 + return;
  46 + }
  47 + if (links != null) {
  48 + boolean matched = false;
  49 + for (String link : links) {
  50 + if (uri.startsWith(link)) {
  51 + matched = true;
  52 + break;
  53 + }
  54 + }
  55 + if (!matched) {
  56 + Map<String, Object> result = new HashMap<>();
  57 + result.put("status", ResponseCode.ERROR);
  58 + result.put("msg", "未授权的访问");
  59 + response.setContentType("text/html;charset=utf-8");
  60 + response.getWriter().write(mapper.writeValueAsString(result));
  61 + return;
  62 + }
  63 + }
  64 +
  65 + chain.doFilter(request, response);
  66 + }
  67 +
  68 + protected boolean isPubURL(String url) {
  69 + for (String pubUrl : pubUrls) {
  70 + if (url.startsWith(pubUrl)) {
  71 + return true;
  72 + }
  73 + }
  74 +
  75 + return false;
  76 + }
  77 +}
src/main/java/com/bsth/filter/SQLInjectFilter.java 0 → 100644
  View file @07243d3
  1 +package com.bsth.filter;
  2 +
  3 +import com.bsth.data.SystemParamCache;
  4 +import org.springframework.stereotype.Component;
  5 +
  6 +import javax.servlet.FilterChain;
  7 +import javax.servlet.ServletException;
  8 +import javax.servlet.http.HttpServletRequest;
  9 +import javax.servlet.http.HttpServletResponse;
  10 +import java.io.IOException;
  11 +import java.util.Enumeration;
  12 +
  13 +@Component
  14 +public class SQLInjectFilter extends BaseFilter{
  15 +
  16 + private static String injStr = "'|and|exec|create|insert|select|delete|update|count|*|%|chr|mid|master|truncate|drop|char|declare";
  17 +
  18 + private final static String specialUri = "adminUtils";
  19 +
  20 + @Override
  21 + public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
  22 + throws IOException, ServletException {
  23 + if (!SystemParamCache.getEnabledFilterSqlInjection()) {
  24 + chain.doFilter(request, response);
  25 + return;
  26 + }
  27 +
  28 + //获取请求对象中的参数名称
  29 + Enumeration enu = request.getParameterNames();
  30 + String uri = request.getRequestURI();
  31 +
  32 + if (uri.indexOf(specialUri) > -1) {
  33 + chain.doFilter(request, response);
  34 + return;
  35 + }
  36 +
  37 + //遍历枚举
  38 + while (enu.hasMoreElements()) {
  39 + //取参数名
  40 + String paraName = (String)enu.nextElement();
  41 +
  42 + //取参数值并校验
  43 + if (isSqlInject(request.getParameter(paraName))) {
  44 + return;
  45 + }
  46 + }
  47 + //校验完毕，放行
  48 + chain.doFilter(request, response);
  49 + }
  50 +
  51 + private static boolean isSqlInject(String injectStr) {
  52 + String injStrArr[] = injStr.split("\\|");
  53 + injectStr = injectStr.toLowerCase();
  54 + for (int i = 0; i < injStrArr.length; i++) {
  55 + if (injectStr.indexOf(injStrArr[i]) >= 0) {
  56 + return true;
  57 + }
  58 + }
  59 + return false;
  60 + }
  61 +
  62 + public static String getInjStr() {
  63 + return injStr;
  64 + }
  65 +
  66 + public static void setInjStr(String injStr) {
  67 + SQLInjectFilter.injStr = injStr;
  68 + }
  69 +}
src/main/java/com/bsth/security/WebSecurityConfig.java
  View file @07243d3
1 -package com.bsth.security;  
2 -  
3 -import org.springframework.beans.factory.annotation.Autowired;  
4 -import org.springframework.boot.context.embedded.ServletListenerRegistrationBean;  
5 -import org.springframework.context.annotation.Bean;  
6 -import org.springframework.context.annotation.Configuration;  
7 -import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;  
8 -import org.springframework.security.config.annotation.web.builders.HttpSecurity;  
9 -import org.springframework.security.config.annotation.web.builders.WebSecurity;  
10 -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;  
11 -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;  
12 -import org.springframework.security.core.session.SessionRegistry;  
13 -import org.springframework.security.core.session.SessionRegistryImpl;  
14 -import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;  
15 -import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;  
16 -import org.springframework.security.web.session.HttpSessionEventPublisher;  
17 -  
18 -import com.bsth.common.Constants;  
19 -import com.bsth.security.filter.LoginInterceptor;  
20 -  
21 -@Configuration  
22 -@EnableWebSecurity  
23 -public class WebSecurityConfig extends WebSecurityConfigurerAdapter {  
24 -  
25 - @Autowired  
26 - UserDetailServiceImpl customUserDetailService;  
27 -  
28 - @Autowired  
29 - CustomAccessDecisionManager customAccessDecisionManager;  
30 -  
31 - @Autowired  
32 - SecurityMetadataSourceService securityMetadataSourceService;  
33 -  
34 -  
35 - @Override  
36 - public void configure(WebSecurity web) throws Exception {  
37 - // 白名单  
38 - web.ignoring().antMatchers(Constants.LOGIN_PAGE, Constants.LOGIN, Constants.ASSETS_URL, Constants.FAVICON_URL, Constants.CAPTCHA,  
39 - Constants.SERVICE_INTERFACE, Constants.METRONIC_URL, Constants.LOGIN_FAILURE, Constants.UPSTREAM_URL, Constants.XD_CHILD_PAGES, Constants.STATIONSIGNO_URL, Constants.UP_RFID_URL,Constants.STATION_AND_SECTION_COUNT);  
40 - }  
41 -  
42 - @Override  
43 - protected void configure(AuthenticationManagerBuilder auth)  
44 - throws Exception {  
45 - auth.userDetailsService(customUserDetailService).passwordEncoder(  
46 - new BCryptPasswordEncoder(4));  
47 - }  
48 -  
49 - @Override  
50 - protected void configure(HttpSecurity http) throws Exception {  
51 - http.authorizeRequests().antMatchers("/").permitAll().anyRequest()  
52 - .authenticated().and()  
53 - .formLogin()  
54 - //指定登录页  
55 - .loginPage(Constants.LOGIN_PAGE)  
56 - .loginProcessingUrl(Constants.LOGIN).permitAll()  
57 - .and().logout()  
58 - //禁用CXRF  
59 - .and().csrf().disable()  
60 - //禁用匿名用户功能  
61 - .anonymous().disable()  
62 - //允许 iframe  
63 - .headers().frameOptions().disable();  
64 -  
65 - // 同时只保持一个回话  
66 - http.sessionManagement().maximumSessions(1)  
67 - .expiredUrl(Constants.LOGIN_PAGE + "?error=true")  
68 - .maxSessionsPreventsLogin(false)//让之前的登录过期  
69 - .sessionRegistry(sessionRegistry());  
70 -  
71 - http.addFilterBefore(new LoginInterceptor(), FilterSecurityInterceptor.class);  
72 - http.addFilter(filterSecurityInterceptor());  
73 - }  
74 -  
75 - private FilterSecurityInterceptor filterSecurityInterceptor()  
76 - throws Exception {  
77 - FilterSecurityInterceptor filterSecurityInterceptor = new FilterSecurityInterceptor();  
78 - filterSecurityInterceptor  
79 - .setAccessDecisionManager(customAccessDecisionManager);  
80 - filterSecurityInterceptor  
81 - .setSecurityMetadataSource(securityMetadataSourceService);  
82 - filterSecurityInterceptor  
83 - .setAuthenticationManager(authenticationManager());  
84 - return filterSecurityInterceptor;  
85 - }  
86 -  
87 -/* @Bean  
88 - public LoginSuccessHandler loginSuccessHandler(){  
89 - return new LoginSuccessHandler();  
90 - }*/  
91 -  
92 -/* @Bean  
93 - public LogoutHandler logoutHandler(){  
94 - return new CustomLogoutHandler();  
95 - }*/  
96 -  
97 - @Bean  
98 - public SessionRegistry sessionRegistry() {  
99 - SessionRegistry sessionRegistry = new SessionRegistryImpl();  
100 - return sessionRegistry;  
101 - }  
102 -  
103 - @Bean  
104 - public static ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {  
105 - return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(  
106 - new HttpSessionEventPublisher());  
107 - }  
108 -} 1 +package com.bsth.security;
  2 +
  3 +import com.bsth.filter.AuthorityFilter;
  4 +import org.springframework.beans.factory.annotation.Autowired;
  5 +import org.springframework.boot.context.embedded.ServletListenerRegistrationBean;
  6 +import org.springframework.context.annotation.Bean;
  7 +import org.springframework.context.annotation.Configuration;
  8 +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  9 +import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  10 +import org.springframework.security.config.annotation.web.builders.WebSecurity;
  11 +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  12 +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  13 +import org.springframework.security.core.session.SessionRegistry;
  14 +import org.springframework.security.core.session.SessionRegistryImpl;
  15 +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  16 +import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
  17 +import org.springframework.security.web.session.HttpSessionEventPublisher;
  18 +
  19 +import com.bsth.common.Constants;
  20 +import com.bsth.security.filter.LoginInterceptor;
  21 +
  22 +@Configuration
  23 +@EnableWebSecurity
  24 +public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  25 +
  26 + @Autowired
  27 + UserDetailServiceImpl customUserDetailService;
  28 +
  29 + @Autowired
  30 + CustomAccessDecisionManager customAccessDecisionManager;
  31 +
  32 + @Autowired
  33 + SecurityMetadataSourceService securityMetadataSourceService;
  34 +
  35 +
  36 + @Override
  37 + public void configure(WebSecurity web) throws Exception {
  38 + // 白名单
  39 + web.ignoring().antMatchers(Constants.LOGIN_PAGE, Constants.LOGIN, Constants.ASSETS_URL, Constants.FAVICON_URL, Constants.CAPTCHA,
  40 + Constants.SERVICE_INTERFACE, Constants.METRONIC_URL, Constants.LOGIN_FAILURE, Constants.UPSTREAM_URL, Constants.XD_CHILD_PAGES, Constants.STATIONSIGNO_URL, Constants.UP_RFID_URL,Constants.STATION_AND_SECTION_COUNT);
  41 + }
  42 +
  43 + @Override
  44 + protected void configure(AuthenticationManagerBuilder auth)
  45 + throws Exception {
  46 + auth.userDetailsService(customUserDetailService).passwordEncoder(
  47 + new BCryptPasswordEncoder(4));
  48 + }
  49 +
  50 + @Override
  51 + protected void configure(HttpSecurity http) throws Exception {
  52 + http.authorizeRequests().antMatchers("/").permitAll().anyRequest()
  53 + .authenticated().and()
  54 + .formLogin()
  55 + //指定登录页
  56 + .loginPage(Constants.LOGIN_PAGE)
  57 + .loginProcessingUrl(Constants.LOGIN).permitAll()
  58 + .and().logout()
  59 + //禁用CXRF
  60 + .and().csrf().disable()
  61 + //禁用匿名用户功能
  62 + .anonymous().disable()
  63 + //允许 iframe
  64 + .headers().frameOptions().disable();
  65 +
  66 + // 同时只保持一个回话
  67 + http.sessionManagement().maximumSessions(1)
  68 + .expiredUrl(Constants.LOGIN_PAGE + "?error=true")
  69 + .maxSessionsPreventsLogin(false)//让之前的登录过期
  70 + .sessionRegistry(sessionRegistry());
  71 +
  72 + http.addFilterBefore(new LoginInterceptor(), FilterSecurityInterceptor.class);
  73 + http.addFilterBefore(new AuthorityFilter(), FilterSecurityInterceptor.class);
  74 + http.addFilter(filterSecurityInterceptor());
  75 + }
  76 +
  77 + private FilterSecurityInterceptor filterSecurityInterceptor()
  78 + throws Exception {
  79 + FilterSecurityInterceptor filterSecurityInterceptor = new FilterSecurityInterceptor();
  80 + filterSecurityInterceptor
  81 + .setAccessDecisionManager(customAccessDecisionManager);
  82 + filterSecurityInterceptor
  83 + .setSecurityMetadataSource(securityMetadataSourceService);
  84 + filterSecurityInterceptor
  85 + .setAuthenticationManager(authenticationManager());
  86 + return filterSecurityInterceptor;
  87 + }
  88 +
  89 +/* @Bean
  90 + public LoginSuccessHandler loginSuccessHandler(){
  91 + return new LoginSuccessHandler();
  92 + }*/
  93 +
  94 +/* @Bean
  95 + public LogoutHandler logoutHandler(){
  96 + return new CustomLogoutHandler();
  97 + }*/
  98 +
  99 + @Bean
  100 + public SessionRegistry sessionRegistry() {
  101 + SessionRegistry sessionRegistry = new SessionRegistryImpl();
  102 + return sessionRegistry;
  103 + }
  104 +
  105 + @Bean
  106 + public static ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
  107 + return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(
  108 + new HttpSessionEventPublisher());
  109 + }
  110 +}
src/main/java/com/bsth/service/SystemParamService.java
  View file @07243d3
@@ -6,4 +6,8 @@ import com.bsth.entity.SystemParam; @@ -6,4 +6,8 @@ import com.bsth.entity.SystemParam;
6 * @author Hill 6 * @author Hill
7 */ 7 */
8 public interface SystemParamService extends BaseService<SystemParam, Integer> { 8 public interface SystemParamService extends BaseService<SystemParam, Integer> {
  9 +
  10 + void refresh();
  11 +
  12 + String getValue(String key);
9 } 13 }
src/main/java/com/bsth/service/impl/SystemParamServiceImpl.java
  View file @07243d3
1 package com.bsth.service.impl; 1 package com.bsth.service.impl;
2 2
3 import com.bsth.entity.SystemParam; 3 import com.bsth.entity.SystemParam;
  4 +import com.bsth.repository.SystemParamRepository;
4 import com.bsth.service.SystemParamService; 5 import com.bsth.service.SystemParamService;
  6 +import org.springframework.beans.factory.annotation.Autowired;
  7 +import org.springframework.scheduling.annotation.EnableScheduling;
  8 +import org.springframework.scheduling.annotation.Scheduled;
  9 +import org.springframework.stereotype.Service;
  10 +
  11 +import java.util.HashMap;
  12 +import java.util.Map;
5 13
6 /** 14 /**
7 * @author Hill 15 * @author Hill
8 */ 16 */
  17 +@Service
  18 +@EnableScheduling
9 public class SystemParamServiceImpl extends BaseServiceImpl<SystemParam, Integer> implements SystemParamService { 19 public class SystemParamServiceImpl extends BaseServiceImpl<SystemParam, Integer> implements SystemParamService {
10 -} 20 +
  21 + @Autowired
  22 + private SystemParamRepository systemParamRepository;
  23 +
  24 + private Map<String, String> pairs = new HashMap<>();
  25 +
  26 + @Scheduled(cron = "0 0/30 * * * ?")
  27 + public void refresh() {
  28 + for (SystemParam sp : systemParamRepository.findAll()) {
  29 + pairs.put(sp.getKey(), sp.getValue());
  30 + }
  31 + }
  32 +
  33 + public String getValue(String key) {
  34 + return pairs.get(key);
  35 + }
  36 +}
11 \ No newline at end of file 37 \ No newline at end of file