Skip to content

G
gdtel-gztel-school-center
Commit 5bd002fc by 陈浩建
Options

API误用 不安全的框架绑定

parent 8ee7ed5e
Showing with 37 additions and 13 deletions
apply-net/src/main/java/com/winsun/controller/SingleBroadToIntegrateController.java
...@@ -180,7 +180,23 @@ public class SingleBroadToIntegrateController { ...@@ -180,7 +180,23 @@ public class SingleBroadToIntegrateController {
*/ */
@PostMapping("sendOrder") @PostMapping("sendOrder")
public ResponseData<Map<String, Object>> sendOrder(HttpServletRequest request, public ResponseData<Map<String, Object>> sendOrder(HttpServletRequest request,
ToIntegrateOrderParam toIntegrateOrderParam) { @RequestParam("name") String name,
@RequestParam("netNumber") String netNumber,
@RequestParam("idCard") String idCard,
@RequestParam("businessNumber") String businessNumber,
@RequestParam("contactPhone") String contactPhone,
@RequestParam("rhTime") String rhTime,
@RequestParam("hehuorenId") String hehuorenId,
@RequestParam("imgUrl") String imgUrl) {
ToIntegrateOrderParam toIntegrateOrderParam = new ToIntegrateOrderParam();
toIntegrateOrderParam.setName(name);
toIntegrateOrderParam.setNetNumber(netNumber);
toIntegrateOrderParam.setIdCard(idCard);
toIntegrateOrderParam.setBusinessNumber(businessNumber);
toIntegrateOrderParam.setContactPhone(contactPhone);
toIntegrateOrderParam.setRhTime(rhTime);
toIntegrateOrderParam.setHehuorenId(hehuorenId);
toIntegrateOrderParam.setImgUrl(imgUrl);
// 正常下单保存到数据库中 // 正常下单保存到数据库中
log.info(JSONObject.toJSONString(toIntegrateOrderParam)); log.info(JSONObject.toJSONString(toIntegrateOrderParam));
......
service-manager/src/main/java/com/winsun/controller/OrderController.java
...@@ -825,6 +825,7 @@ public class OrderController extends BaseController { ...@@ -825,6 +825,7 @@ public class OrderController extends BaseController {
isYzk = true; isYzk = true;
} }
EntityWrapper<Order> wrapper = new EntityWrapper(); EntityWrapper<Order> wrapper = new EntityWrapper();
wrapper.notIn( "user_type", "3,5,9,10");
wrapper.ge(StringUtils.isNotBlank(createTimeStart), "create_time", createTimeStart); wrapper.ge(StringUtils.isNotBlank(createTimeStart), "create_time", createTimeStart);
wrapper.le(StringUtils.isNotBlank(createTimeEnd), "create_time", createTimeEnd); wrapper.le(StringUtils.isNotBlank(createTimeEnd), "create_time", createTimeEnd);
wrapper.ge(StringUtils.isNotBlank(successTimeStart), "success_time", successTimeStart); wrapper.ge(StringUtils.isNotBlank(successTimeStart), "success_time", successTimeStart);
......
service-manager/src/main/java/com/winsun/controller/RecordNumberController.java
...@@ -17,9 +17,7 @@ import org.apache.commons.lang3.StringUtils; ...@@ -17,9 +17,7 @@ import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.data.redis.core.RedisTemplate; import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.*;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;
import java.util.Date; import java.util.Date;
...@@ -49,31 +47,39 @@ public class RecordNumberController extends BaseController { ...@@ -49,31 +47,39 @@ public class RecordNumberController extends BaseController {
/** /**
* 放号登记注册 * 放号登记注册
* @param salesList * @param orderPhone
* @param salesSubst
* @param salesSchool
* @param code * @param code
* @return * @return
*/ */
@RequestMapping(name = "放号登记注册", value = "register", method = RequestMethod.POST) @RequestMapping(name = "放号登记注册", value = "register", method = RequestMethod.POST)
public ResponseData<String> register(SalesList salesList, String code) { public ResponseData<String> register(@RequestParam("orderPhone") String orderPhone,
@RequestParam("salesSubst") String salesSubst,
@RequestParam("salesSchool") String salesSchool,
@RequestParam("code")String code) {
try{ try{
ShiroUser shiroUser = ShiroKit.getUser(); ShiroUser shiroUser = ShiroKit.getUser();
SalesList salesList = new SalesList();
// 登录用户校验 // 登录用户校验
if(shiroUser == null) { if(shiroUser == null) {
return ResponseData.error("请先登录。"); return ResponseData.error("请先登录。");
} }
// 参数校验 // 参数校验
if (StringUtils.isBlank(salesList.getOrderPhone()) || if (StringUtils.isBlank(orderPhone) ||
StringUtils.isBlank(salesList.getSalesSubst()) || StringUtils.isBlank(salesSubst) ||
StringUtils.isBlank(salesList.getSalesSchool())) { StringUtils.isBlank(salesSchool)) {
return ResponseData.error("请填写号码、销售县分、销售学校。"); return ResponseData.error("请填写号码、销售县分、销售学校。");
} }
salesList.setOrderPhone(orderPhone);
salesList.setSalesSubst(salesSubst);
salesList.setSalesSchool(salesSchool);
// 校验网点是否存在 // 校验网点是否存在
boolean isNotNetWork = false; boolean isNotNetWork = false;
Wrapper<NetworkInfo> wrapper = new EntityWrapper<>(); Wrapper<NetworkInfo> wrapper = new EntityWrapper<>();
wrapper.eq("school_name", salesList.getSalesSchool()); wrapper.eq("school_name", salesSchool);
Integer integer = networkInfoMapper.selectCount(wrapper); Integer integer = networkInfoMapper.selectCount(wrapper);
if(integer == null || integer == 0) { if(integer == null || integer == 0) {
...@@ -81,8 +87,8 @@ public class RecordNumberController extends BaseController { ...@@ -81,8 +87,8 @@ public class RecordNumberController extends BaseController {
} }
// 校验验证码 // 校验验证码
AuthCode authCode = authCodeMapper.selectById(salesList.getOrderPhone()); AuthCode authCode = authCodeMapper.selectById(orderPhone);
Object o = redisTemplate.opsForValue().get(salesList.getOrderPhone()); Object o = redisTemplate.opsForValue().get(orderPhone);
if (o == null && authCode == null) { if (o == null && authCode == null) {
return ResponseData.error("请先获取验证码"); return ResponseData.error("请先获取验证码");
} }
......
task/src/main/java/com/winsun/service/ExportService.java
...@@ -109,6 +109,7 @@ public class ExportService extends BaseController { ...@@ -109,6 +109,7 @@ public class ExportService extends BaseController {
EntityWrapper<Order> wrapper = new EntityWrapper(); EntityWrapper<Order> wrapper = new EntityWrapper();
wrapper.notIn("user_type", "3,5,9,10");
wrapper.ge(StringUtils.isNotBlank(createTimeStart), "create_time", createTimeStart); wrapper.ge(StringUtils.isNotBlank(createTimeStart), "create_time", createTimeStart);
wrapper.le(StringUtils.isNotBlank(createTimeEnd), "create_time", createTimeEnd); wrapper.le(StringUtils.isNotBlank(createTimeEnd), "create_time", createTimeEnd);
wrapper.ge(StringUtils.isNotBlank(successTimeStart), "success_time", successTimeStart); wrapper.ge(StringUtils.isNotBlank(successTimeStart), "success_time", successTimeStart);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment