caojiahao/dev_caojiahao
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

!53 修复安全漏洞。优化代码

Browse Source 
Merge pull request !53 from Bulbasaur/feature/pg
This commit is contained in:
Bulbasaur 2021-11-11 10:21:56 +00:00 committed by Gitee
commit 2369b61243
34 changed files with 351 additions and 126 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
admin/pom.xml
View File

@ -27,6 +27,11 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>net.logstash.logback</groupId>
<artifactId>logstash-logback-encoder</artifactId>
<version>${logstash-logback-encoder}</version>
</dependency>
<!-- <dependency>-->
<!-- <groupId>org.springframework.boot</groupId>-->
<!-- <artifactId>spring-boot-starter-mail</artifactId>-->

19
buyer-api/src/main/java/cn/lili/controller/member/CouponBuyerController.java
View File

@ -1,8 +1,8 @@
package cn.lili.controller.member;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.vo.PageVO;
import cn.lili.common.vo.ResultMessage;
import cn.lili.modules.promotion.entity.dos.MemberCoupon;
@ -10,6 +10,7 @@ import cn.lili.modules.promotion.entity.vos.CouponSearchParams;
import cn.lili.modules.promotion.entity.vos.CouponVO;
import cn.lili.modules.promotion.service.CouponService;
import cn.lili.modules.promotion.service.MemberCouponService;
import cn.lili.modules.system.utils.OperationalJudgment;
import com.baomidou.mybatisplus.core.metadata.IPage;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
@ -22,6 +23,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import javax.validation.constraints.NotNull;
import java.util.Objects;
/**
* 买家端,买家优惠券接口
@ -56,14 +58,16 @@ public class CouponBuyerController {
@ApiOperation(value = "获取当前会员的优惠券列表")
@GetMapping("/getCoupons")
public ResultMessage<IPage<MemberCoupon>> getCoupons(CouponSearchParams param, PageVO pageVo) {
param.setMemberId(UserContext.getCurrentUser().getId());
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
param.setMemberId(currentUser.getId());
return ResultUtil.data(memberCouponService.getMemberCoupons(param, pageVo));
}
@ApiOperation(value = "获取当前会员的对于当前商品可使用的优惠券列表")
@GetMapping("/canUse")
public ResultMessage<IPage<MemberCoupon>> getCouponsByCanUse(CouponSearchParams param, Double totalPrice, PageVO pageVo) {
param.setMemberId(UserContext.getCurrentUser().getId());
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
param.setMemberId(currentUser.getId());
return ResultUtil.data(memberCouponService.getMemberCouponsByCanUse(param, totalPrice, pageVo));
}
@ -79,8 +83,9 @@ public class CouponBuyerController {
})
@GetMapping("/receive/{couponId}")
public ResultMessage<Object> receiveCoupon(@NotNull(message = "优惠券ID不能为空") @PathVariable("couponId") String couponId) {
memberCouponService.checkCouponLimit(couponId, UserContext.getCurrentUser().getId());
memberCouponService.receiveCoupon(couponId, UserContext.getCurrentUser().getId(), UserContext.getCurrentUser().getNickName());
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
memberCouponService.checkCouponLimit(couponId, currentUser.getId());
memberCouponService.receiveCoupon(couponId, currentUser.getId(), currentUser.getNickName());
return ResultUtil.success();
}
@ -90,7 +95,7 @@ public class CouponBuyerController {
})
@GetMapping(value = "/get/{id}")
public ResultMessage<MemberCoupon> get(@NotNull(message = "优惠券ID不能为空") @PathVariable("id") String id) {
MemberCoupon memberCoupon = memberCouponService.getById(id);
MemberCoupon memberCoupon = OperationalJudgment.judgment(memberCouponService.getById(id));
return ResultUtil.data(memberCoupon);
}

5
buyer-api/src/main/java/cn/lili/controller/member/MemberAddressBuyerController.java
View File

@ -6,6 +6,7 @@ import cn.lili.common.vo.PageVO;
import cn.lili.common.vo.ResultMessage;
import cn.lili.modules.member.entity.dos.MemberAddress;
import cn.lili.modules.member.service.MemberAddressService;
import cn.lili.modules.system.utils.OperationalJudgment;
import com.baomidou.mybatisplus.core.metadata.IPage;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
@ -14,6 +15,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
import javax.validation.Valid;
import java.util.Objects;
/**
@ -56,7 +58,7 @@ public class MemberAddressBuyerController {
@PostMapping
public ResultMessage<MemberAddress> addShippingAddress(@Valid MemberAddress shippingAddress) {
//添加会员地址
shippingAddress.setMemberId(UserContext.getCurrentUser().getId());
shippingAddress.setMemberId(Objects.requireNonNull(UserContext.getCurrentUser()).getId());
if(shippingAddress.getIsDefault()==null){
shippingAddress.setIsDefault(false);
}
@ -73,6 +75,7 @@ public class MemberAddressBuyerController {
@ApiImplicitParam(name = "id", value = "会员地址ID", dataType = "String", paramType = "path")
@DeleteMapping(value = "/delById/{id}")
public ResultMessage<Object> delShippingAddressById(@PathVariable String id) {
OperationalJudgment.judgment(memberAddressService.getById(id));
memberAddressService.removeMemberAddress(id);
return ResultUtil.success();
}

8
buyer-api/src/main/java/cn/lili/controller/passport/MemberBuyerController.java
View File

@ -1,6 +1,7 @@
package cn.lili.controller.passport;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.vo.ResultMessage;
import cn.lili.modules.member.entity.dos.Member;
import cn.lili.modules.member.entity.dto.MemberEditDTO;
@ -49,6 +50,13 @@ public class MemberBuyerController {
return ResultUtil.data(this.memberService.usernameLogin(username, password));
}
@ApiOperation(value = "注销接口")
@PostMapping("/logout")
public ResultMessage<Object> logout() {
this.memberService.logout(UserEnums.MEMBER);
return ResultUtil.success();
}
@ApiOperation(value = "短信登录接口")
@ApiImplicitParams({
@ApiImplicitParam(name = "mobile", value = "手机号", required = true, paramType = "query"),

9
buyer-api/src/main/java/cn/lili/controller/trade/AfterSaleBuyerController.java
View File

@ -13,6 +13,7 @@ import cn.lili.modules.order.order.service.AfterSaleReasonService;
import cn.lili.modules.order.order.service.AfterSaleService;
import cn.lili.modules.order.trade.entity.dos.AfterSaleLog;
import cn.lili.modules.store.entity.dto.StoreAfterSaleAddressDTO;
import cn.lili.modules.system.utils.OperationalJudgment;
import com.baomidou.mybatisplus.core.metadata.IPage;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
@ -57,7 +58,8 @@ public class AfterSaleBuyerController {
@ApiImplicitParam(name = "sn", value = "售后单号", required = true, paramType = "path")
@GetMapping(value = "/get/{sn}")
public ResultMessage<AfterSaleVO> get(@NotNull(message = "售后单号") @PathVariable("sn") String sn) {
return ResultUtil.data(afterSaleService.getAfterSale(sn));
AfterSaleVO afterSale = OperationalJudgment.judgment(afterSaleService.getAfterSale(sn));
return ResultUtil.data(afterSale);
}
@ApiOperation(value = "分页获取售后服务")
@ -72,7 +74,8 @@ public class AfterSaleBuyerController {
})
@GetMapping(value = "/applyAfterSaleInfo/{sn}")
public ResultMessage<AfterSaleApplyVO> applyAfterSaleInfo(@PathVariable String sn) {
return ResultUtil.data(afterSaleService.getAfterSaleVO(sn));
AfterSaleApplyVO afterSaleApplyVO = OperationalJudgment.judgment(afterSaleService.getAfterSaleVO(sn));
return ResultUtil.data(afterSaleApplyVO);
}
@PostMapping(value = "/save/{orderItemSn}")
@ -95,7 +98,7 @@ public class AfterSaleBuyerController {
public ResultMessage<AfterSale> delivery(@NotNull(message = "售后编号不能为空") @PathVariable("afterSaleSn") String afterSaleSn,
@NotNull(message = "发货单号不能为空") @RequestParam String logisticsNo,
@NotNull(message = "请选择物流公司") @RequestParam String logisticsId,
@NotNull(message = "请选择发货时间") @RequestParam @DateTimeFormat(pattern = "yyyy-MM-dd") Date mDeliverTime) {
@NotNull(message = "请选择发货时间") @RequestParam @DateTimeFormat(pattern = "yyyy-MM-dd") Date mDeliverTime) {
return ResultUtil.data(afterSaleService.buyerDelivery(afterSaleSn, logisticsNo, logisticsId, mDeliverTime));
}

13
buyer-api/src/main/java/cn/lili/controller/trade/OrderBuyerController.java
View File

@ -1,10 +1,10 @@
package cn.lili.controller.trade;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.exception.ServiceException;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.vo.ResultMessage;
import cn.lili.modules.order.order.entity.dos.Order;
import cn.lili.modules.order.order.entity.dto.OrderSearchParams;
@ -12,6 +12,7 @@ import cn.lili.modules.order.order.entity.enums.OrderStatusEnum;
import cn.lili.modules.order.order.entity.vo.OrderDetailVO;
import cn.lili.modules.order.order.entity.vo.OrderSimpleVO;
import cn.lili.modules.order.order.service.OrderService;
import cn.lili.modules.system.utils.OperationalJudgment;
import com.baomidou.mybatisplus.core.metadata.IPage;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
@ -23,6 +24,7 @@ import springfox.documentation.annotations.ApiIgnore;
import javax.validation.constraints.NotBlank;
import javax.validation.constraints.NotNull;
import java.util.Objects;
/**
* 买家端,订单接口
@ -44,7 +46,7 @@ public class OrderBuyerController {
@ApiOperation(value = "查询会员订单列表")
@GetMapping
public ResultMessage<IPage<OrderSimpleVO>> queryMineOrder(OrderSearchParams orderSearchParams) {
AuthUser currentUser = UserContext.getCurrentUser();
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
orderSearchParams.setMemberId(currentUser.getId());
return ResultUtil.data(orderService.queryByParams(orderSearchParams));
}
@ -55,7 +57,9 @@ public class OrderBuyerController {
})
@GetMapping(value = "/{orderSn}")
public ResultMessage<OrderDetailVO> detail(@NotNull(message = "订单编号不能为空") @PathVariable("orderSn") String orderSn) {
return ResultUtil.data(orderService.queryDetail(orderSn));
OrderDetailVO orderDetailVO = orderService.queryDetail(orderSn);
OperationalJudgment.judgment(orderDetailVO.getOrder());
return ResultUtil.data(orderDetailVO);
}
@ApiOperation(value = "确认收货")
@ -93,6 +97,7 @@ public class OrderBuyerController {
})
@DeleteMapping(value = "/{orderSn}")
public ResultMessage<Object> deleteOrder(@PathVariable String orderSn) {
OperationalJudgment.judgment(orderService.getBySn(orderSn));
orderService.deleteOrder(orderSn);
return ResultUtil.success();
}
@ -103,6 +108,7 @@ public class OrderBuyerController {
})
@PostMapping(value = "/getTraces/{orderSn}")
public ResultMessage<Object> getTraces(@NotBlank(message = "订单编号不能为空") @PathVariable String orderSn) {
OperationalJudgment.judgment(orderService.getBySn(orderSn));
return ResultUtil.data(orderService.getTraces(orderSn));
}
@ -113,6 +119,7 @@ public class OrderBuyerController {
})
@PostMapping(value = "/receipt/{orderSn}")
public ResultMessage<Object> invoice(@NotBlank(message = "订单编号不能为空") @PathVariable String orderSn) {
OperationalJudgment.judgment(orderService.getBySn(orderSn));
return ResultUtil.data(orderService.invoice(orderSn));
}

10
buyer-api/src/main/java/cn/lili/controller/trade/OrderComplaintBuyerController.java
View File

@ -13,6 +13,7 @@ import cn.lili.modules.order.order.entity.vo.OrderComplaintSearchParams;
import cn.lili.modules.order.order.entity.vo.OrderComplaintVO;
import cn.lili.modules.order.order.service.OrderComplaintCommunicationService;
import cn.lili.modules.order.order.service.OrderComplaintService;
import cn.lili.modules.system.utils.OperationalJudgment;
import com.baomidou.mybatisplus.core.metadata.IPage;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
@ -22,6 +23,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
import javax.validation.Valid;
import java.util.Objects;
/**
* 买家端,交易投诉接口
@ -51,13 +53,15 @@ public class OrderComplaintBuyerController {
@ApiImplicitParam(name = "id", value = "投诉单ID", required = true, paramType = "path")
@GetMapping(value = "/{id}")
public ResultMessage<OrderComplaintVO> get(@PathVariable String id) {
return ResultUtil.data(orderComplaintService.getOrderComplainById(id));
OrderComplaintVO orderComplaintVO = OperationalJudgment.judgment(orderComplaintService.getOrderComplainById(id));
return ResultUtil.data(orderComplaintVO);
}
@ApiOperation(value = "分页获取")
@GetMapping
public ResultMessage<IPage<OrderComplaint>> get(OrderComplaintSearchParams searchParams, PageVO pageVO) {
searchParams.setMemberId(UserContext.getCurrentUser().getId());
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
searchParams.setMemberId(currentUser.getId());
return ResultUtil.data(orderComplaintService.getOrderComplainByPage(searchParams, pageVO));
}
@ -75,7 +79,7 @@ public class OrderComplaintBuyerController {
})
@PostMapping("/communication")
public ResultMessage<OrderComplaintCommunicationVO> addCommunication(@RequestParam String complainId, @RequestParam String content) {
AuthUser currentUser = UserContext.getCurrentUser();
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
OrderComplaintCommunicationVO communicationVO = new OrderComplaintCommunicationVO(complainId, content, CommunicationOwnerEnum.BUYER.name(), currentUser.getId(), currentUser.getNickName());
orderComplaintCommunicationService.addCommunication(communicationVO);
return ResultUtil.data(communicationVO);

24
common-api/src/main/java/cn/lili/controller/common/UploadController.java
View File

@ -1,18 +1,17 @@
package cn.lili.controller.common;
import cn.hutool.core.util.StrUtil;
import cn.hutool.core.text.CharSequenceUtil;
import cn.lili.cache.Cache;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.exception.ServiceException;
import cn.lili.common.properties.SystemSettingProperties;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.utils.Base64DecodeMultipartFile;
import cn.lili.common.utils.CommonUtil;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.utils.StringUtils;
import cn.lili.common.vo.ResultMessage;
import cn.lili.common.properties.SystemSettingProperties;
import cn.lili.modules.file.entity.File;
import cn.lili.modules.file.plugin.FileManagerPlugin;
import cn.lili.modules.file.service.FileService;
@ -30,6 +29,7 @@ import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.multipart.MultipartFile;
import java.io.InputStream;
import java.util.Objects;
/**
* 文件上传接口
@ -68,16 +68,24 @@ public class UploadController {
throw new ServiceException(ResultCode.USER_AUTHORITY_ERROR);
}
Setting setting = settingService.get(SettingEnum.OSS_SETTING.name());
if (setting == null || StrUtil.isBlank(setting.getSettingValue())) {
if (setting == null || CharSequenceUtil.isBlank(setting.getSettingValue())) {
throw new ServiceException(ResultCode.OSS_NOT_EXIST);
}
if (file == null || CharSequenceUtil.isEmpty(file.getContentType())) {
throw new ServiceException(ResultCode.IMAGE_FILE_EXT_ERROR);
}
if (StringUtils.isNotBlank(base64)) {
if (!CharSequenceUtil.containsAny(file.getContentType().toLowerCase(), "image")) {
throw new ServiceException(ResultCode.FILE_TYPE_NOT_SUPPORT);
}
if (CharSequenceUtil.isNotBlank(base64)) {
//base64上传
file = Base64DecodeMultipartFile.base64Convert(base64);
}
String result = "";
String fileKey = CommonUtil.rename(file.getOriginalFilename());
String result;
String fileKey = CommonUtil.rename(Objects.requireNonNull(file.getOriginalFilename()));
File newFile = new File();
try {
InputStream inputStream = file.getInputStream();

8
consumer/src/main/java/cn/lili/listener/NoticeSendMessageListener.java
View File

@ -2,11 +2,9 @@ package cn.lili.listener;
import cn.hutool.json.JSONUtil;
import cn.lili.common.enums.SwitchEnum;
import cn.lili.rocketmq.tags.OtherTagsEnum;
import cn.lili.modules.system.sms.SmsUtil;
import cn.lili.common.vo.PageVO;
import cn.lili.modules.member.entity.dos.Member;
import cn.lili.modules.member.entity.vo.MemberSearchVO;
import cn.lili.modules.member.entity.vo.MemberVO;
import cn.lili.modules.member.mapper.MemberMapper;
import cn.lili.modules.member.service.MemberService;
import cn.lili.modules.message.entity.dos.MemberMessage;
@ -20,6 +18,8 @@ import cn.lili.modules.message.service.MemberMessageService;
import cn.lili.modules.message.service.StoreMessageService;
import cn.lili.modules.store.entity.dos.Store;
import cn.lili.modules.store.service.StoreService;
import cn.lili.modules.system.sms.SmsUtil;
import cn.lili.rocketmq.tags.OtherTagsEnum;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
import org.apache.rocketmq.common.message.MessageExt;
@ -169,7 +169,7 @@ public class NoticeSendMessageListener implements RocketMQListener<MessageExt> {
PageVO pageVO = new PageVO();
pageVO.setPageSize(pageSize);
pageVO.setPageNumber(i);
IPage<Member> page = memberService.getMemberPage(memberSearchVO, pageVO);
IPage<MemberVO> page = memberService.getMemberPage(memberSearchVO, pageVO);
//循环要保存的信息
page.getRecords().forEach(item -> {
MemberMessage memberMessage = new MemberMessage();

7
framework/pom.xml
View File

@ -302,6 +302,13 @@
<artifactId>commons-text</artifactId>
<version>${commons-text}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer -->
<dependency>
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
<artifactId>owasp-java-html-sanitizer</artifactId>
<version>${owasp-java-html-sanitizer}</version>
</dependency>
</dependencies>

2
framework/src/main/java/cn/lili/common/enums/ResultCode.java
View File

@ -37,6 +37,7 @@ public enum ResultCode {
LIMIT_ERROR(1003, "访问过于频繁，请稍后再试"),
ILLEGAL_REQUEST_ERROR(1004, "非法请求，请重新刷新页面操作"),
IMAGE_FILE_EXT_ERROR(1005, "不支持图片格式"),
FILE_TYPE_NOT_SUPPORT(1010, "不支持上传的文件类型！"),
PLATFORM_NOT_SUPPORTED_IM(1006, "平台未开启IM"),
STORE_NOT_SUPPORTED_IM(1007, "店铺未开启IM"),
/**
@ -155,6 +156,7 @@ public enum ResultCode {
* 购物车
*/
CART_ERROR(30001, "读取结算页的购物车异常"),
CART_NUM_ERROR(30010, "购买数量必须大于0"),
CART_PINTUAN_NOT_EXIST_ERROR(30002, "拼团活动已关闭，请稍后重试"),
CART_PINTUAN_LIMIT_ERROR(30003, "购买数量超过拼团活动限制数量"),
SHIPPING_NOT_APPLY(30005, "购物商品不支持当前收货地址配送"),

10
framework/src/main/java/cn/lili/common/security/context/UserContext.java
View File

@ -47,7 +47,7 @@ public class UserContext {
*/
public static AuthUser getAuthUser(Cache cache, String accessToken) {
try {
if (cache.keys("*" + accessToken).size() == 0) {
if (cache.keys("*" + accessToken).isEmpty()) {
throw new ServiceException(ResultCode.USER_AUTHORITY_ERROR);
}
return getAuthUser(accessToken);
@ -56,6 +56,14 @@ public class UserContext {
}
}
public static String getCurrentUserToken() {
if (RequestContextHolder.getRequestAttributes() != null) {
HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
return request.getHeader(SecurityEnum.HEADER_TOKEN.getValue());
}
return null;
}
/**
* 根据jwt获取token重的用户信息
*

55
framework/src/main/java/cn/lili/common/security/filter/XssHttpServletRequestWrapper.java
View File

@ -4,6 +4,7 @@ package cn.lili.common.security.filter;
import cn.hutool.core.text.CharSequenceUtil;
import cn.hutool.http.HtmlUtil;
import cn.hutool.json.JSONUtil;
import org.owasp.html.Sanitizers;
import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
@ -28,6 +29,7 @@ import java.util.Map;
*/
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
private static final String[] ignoreField = {"logo", "url", "photo", "intro", "content", "name"};
public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
@ -42,13 +44,10 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
if (values == null) {
return new String[0];
}
if (ignoreXss(name)) {
return values;
}
int count = values.length;
String[] encodedValues = new String[count];
for (int i = 0; i < count; i++) {
encodedValues[i] = cleanXSS(values[i]);
encodedValues[i] = filterXss(name, values[i]);
}
return encodedValues;
}
@ -62,7 +61,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
if (value == null) {
return null;
}
return ignoreXss(name) ? value : cleanXSS(value);
return filterXss(name, value);
}
/**
@ -71,11 +70,8 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
@Override
public Object getAttribute(String name) {
Object value = super.getAttribute(name);
if (ignoreXss(name)) {
return value;
}
if (value instanceof String) {
value = cleanXSS((String) value);
value = filterXss(name, (String) value);
}
return value;
}
@ -89,7 +85,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
if (value == null) {
return null;
}
return ignoreXss(name) ? value : cleanXSS(value);
return filterXss(name, value);
}
@Override
@ -103,15 +99,14 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
//根据key获取value
String[] values = entry.getValue();
if (!ignoreXss(entry.getKey())) {
//遍历数组
for (int i = 0; i < values.length; i++) {
String value = values[i];
value = cleanXSS(value);
//将转义后的数据放回数组中
values[i] = value;
}
//遍历数组
for (int i = 0; i < values.length; i++) {
String value = values[i];
value = filterXss(entry.getKey(), value);
//将转义后的数据放回数组中
values[i] = value;
}
//将转义后的数组put到linkMap当中
params.put(entry.getKey(), values);
}
@ -153,9 +148,9 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
Map<String, Object> resultMap = new HashMap<>(map.size());
//遍历数组
for (Map.Entry<String, Object> entry : map.entrySet()) {
//如果map.get(key)获取到的是字符串就需要进行转义，如果不是直接存储resultMap
if (map.get(entry.getKey()) instanceof String && !ignoreXss(entry.getKey())) {
resultMap.put(entry.getKey(), cleanXSS(entry.getValue().toString()));
//如果map.get(key)获取到的是字符串就需要进行处理，如果不是直接存储resultMap
if (map.get(entry.getKey()) instanceof String) {
resultMap.put(entry.getKey(), filterXss(entry.getKey(), entry.getValue().toString()));
} else {
resultMap.put(entry.getKey(), entry.getValue());
}
@ -219,13 +214,25 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
private String cleanXSS(String value) {
if (value != null) {
value = HtmlUtil.escape(value);
value = Sanitizers.FORMATTING.and(Sanitizers.LINKS).sanitize(value);
}
return value;
}
private boolean ignoreXss(String name) {
return CharSequenceUtil.containsAny(name.toLowerCase(Locale.ROOT), "logo", "url", "photo", "intro");
/**
* 过滤xss
*
* @param name 参数名
* @param value 参数值
* @return 参数值
*/
private String filterXss(String name, String value) {
if (CharSequenceUtil.containsAny(name.toLowerCase(Locale.ROOT), ignoreField)) {
// 忽略的处理，（过滤敏感字符）
return HtmlUtil.filter(value);
} else {
return cleanXSS(value);
}
}
}

8
framework/src/main/java/cn/lili/common/security/sensitive/enums/SensitiveStrategy.java
View File

@ -24,6 +24,14 @@ public enum SensitiveStrategy {
* Phone sensitive type.
*/
PHONE(s -> s.replaceAll("(\\d{3})\\d{4}(\\d{4})", "$1****$2")),
/**
* Email sensitive type.
*/
EMAIL(s -> s.replaceAll("(^\\w)[^@]*(@.*$)", "$1****$2")),
/**
* Name sensitive type.
*/
NAME(s -> s.replaceAll("^(.{3}).+(.{3})$", "$1*****$2")),
/**
* Address sensitive type.
*/

88
framework/src/main/java/cn/lili/modules/member/entity/vo/MemberVO.java Normal file
View File

@ -0,0 +1,88 @@
package cn.lili.modules.member.entity.vo;
import cn.lili.common.enums.ClientTypeEnum;
import cn.lili.common.security.sensitive.Sensitive;
import cn.lili.common.security.sensitive.enums.SensitiveStrategy;
import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import org.springframework.format.annotation.DateTimeFormat;
import java.io.Serializable;
import java.util.Date;
/**
* @author paulG
* @since 2021/11/8
**/
@Data
public class MemberVO implements Serializable {
private static final long serialVersionUID = 1810890757303309436L;
@ApiModelProperty(value = "唯一标识", hidden = true)
private String id;
@ApiModelProperty(value = "会员用户名")
private String username;
@ApiModelProperty(value = "昵称")
private String nickName;
@ApiModelProperty(value = "会员性别,1为男，0为女")
private Integer sex;
@JsonFormat(pattern = "yyyy-MM-dd", timezone = "GMT+8")
@DateTimeFormat(pattern = "yyyy-MM-dd")
@ApiModelProperty(value = "会员生日")
private Date birthday;
@ApiModelProperty(value = "会员地址ID")
private String regionId;
@ApiModelProperty(value = "会员地址")
private String region;
@ApiModelProperty(value = "手机号码", required = true)
@Sensitive(strategy = SensitiveStrategy.PHONE)
private String mobile;
@ApiModelProperty(value = "积分数量")
private Long point;
@ApiModelProperty(value = "积分总数量")
private Long totalPoint;
@ApiModelProperty(value = "会员头像")
private String face;
@ApiModelProperty(value = "会员状态")
private Boolean disabled;
@ApiModelProperty(value = "是否开通店铺")
private Boolean haveStore;
@ApiModelProperty(value = "店铺ID")
private String storeId;
@ApiModelProperty(value = "openId")
private String openId;
/**
* @see ClientTypeEnum
*/
@ApiModelProperty(value = "客户端")
private String clientEnum;
@JsonFormat(timezone = "GMT+8", pattern = "yyyy-MM-dd HH:mm:ss")
@ApiModelProperty(value = "最后一次登录时间")
private Date lastLoginDate;
@ApiModelProperty(value = "会员等级ID")
private String gradeId;
@ApiModelProperty(value = "经验值数量")
private Long experience;
}

8
framework/src/main/java/cn/lili/modules/member/mapper/MemberMapper.java
View File

@ -3,7 +3,12 @@ package cn.lili.modules.member.mapper;
import cn.lili.modules.member.entity.dos.Member;
import cn.lili.modules.member.entity.vo.MemberDistributionVO;
import cn.lili.modules.member.entity.vo.MemberVO;
import com.baomidou.mybatisplus.core.conditions.Wrapper;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.core.toolkit.Constants;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import java.util.List;
@ -29,4 +34,7 @@ public interface MemberMapper extends BaseMapper<Member> {
*/
@Select("select client_enum,count(0) as num from li_member group by client_enum")
List<MemberDistributionVO> distribution();
@Select("select * from li_member ${ew.customSqlSegment}")
IPage<MemberVO> pageByMemberVO(IPage<MemberVO> page, @Param(Constants.WRAPPER) Wrapper<Member> queryWrapper);
}

11
framework/src/main/java/cn/lili/modules/member/service/MemberService.java
View File

@ -1,6 +1,7 @@
package cn.lili.modules.member.service;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.security.token.Token;
import cn.lili.common.vo.PageVO;
import cn.lili.modules.connect.entity.dto.ConnectAuthUser;
@ -10,6 +11,7 @@ import cn.lili.modules.member.entity.dto.MemberAddDTO;
import cn.lili.modules.member.entity.dto.MemberEditDTO;
import cn.lili.modules.member.entity.vo.MemberDistributionVO;
import cn.lili.modules.member.entity.vo.MemberSearchVO;
import cn.lili.modules.member.entity.vo.MemberVO;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.service.IService;
@ -141,7 +143,7 @@ public interface MemberService extends IService<Member> {
* @param page 分页
* @return 会员分页
*/
IPage<Member> getMemberPage(MemberSearchVO memberSearchVO, PageVO page);
IPage<MemberVO> getMemberPage(MemberSearchVO memberSearchVO, PageVO page);
/**
* 一键注册会员
@ -209,4 +211,11 @@ public interface MemberService extends IService<Member> {
* @return 会员总数
*/
Integer getMemberNum(MemberSearchVO memberSearchVO);
/**
* 登出
*
* @param userEnums token角色类型
*/
void logout(UserEnums userEnums);
}

10
framework/src/main/java/cn/lili/modules/member/serviceimpl/MemberAddressServiceImpl.java
View File

@ -14,6 +14,8 @@ import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.util.Objects;
/**
* 收货地址业务层实现
*
@ -36,7 +38,7 @@ public class MemberAddressServiceImpl extends ServiceImpl<MemberAddressMapper, M
public MemberAddress getMemberAddress(String id) {
return this.getOne(
new QueryWrapper<MemberAddress>()
.eq("member_id", UserContext.getCurrentUser().getId())
.eq("member_id", Objects.requireNonNull(UserContext.getCurrentUser()).getId())
.eq("id", id));
}
@ -49,7 +51,7 @@ public class MemberAddressServiceImpl extends ServiceImpl<MemberAddressMapper, M
public MemberAddress getDefaultMemberAddress() {
return this.getOne(
new QueryWrapper<MemberAddress>()
.eq("member_id", UserContext.getCurrentUser().getId())
.eq("member_id", Objects.requireNonNull(UserContext.getCurrentUser()).getId())
.eq("is_default", true));
}
@ -67,7 +69,7 @@ public class MemberAddressServiceImpl extends ServiceImpl<MemberAddressMapper, M
public MemberAddress updateMemberAddress(MemberAddress memberAddress) {
MemberAddress originalMemberAddress = this.getMemberAddress(memberAddress.getId());
if (originalMemberAddress != null &&
originalMemberAddress.getMemberId().equals(UserContext.getCurrentUser().getId())) {
originalMemberAddress.getMemberId().equals(Objects.requireNonNull(UserContext.getCurrentUser()).getId())) {
if (memberAddress.getIsDefault() == null) {
memberAddress.setIsDefault(false);
@ -93,7 +95,7 @@ public class MemberAddressServiceImpl extends ServiceImpl<MemberAddressMapper, M
*/
private void removeDefaultAddress(MemberAddress memberAddress) {
//如果不是默认地址不需要处理
if (memberAddress.getIsDefault()) {
if (Boolean.TRUE.equals(memberAddress.getIsDefault())) {
//将会员的地址修改为非默认地址
LambdaUpdateWrapper<MemberAddress> lambdaUpdateWrapper = Wrappers.lambdaUpdate();
lambdaUpdateWrapper.set(MemberAddress::getIsDefault, false);

18
framework/src/main/java/cn/lili/modules/member/serviceimpl/MemberServiceImpl.java
View File

@ -2,6 +2,7 @@ package cn.lili.modules.member.serviceimpl;
import cn.hutool.core.convert.Convert;
import cn.hutool.core.text.CharSequenceUtil;
import cn.lili.cache.Cache;
import cn.lili.cache.CachePrefix;
import cn.lili.common.context.ThreadContextHolder;
@ -11,6 +12,7 @@ import cn.lili.common.exception.ServiceException;
import cn.lili.common.properties.RocketmqCustomProperties;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.security.token.Token;
import cn.lili.common.utils.BeanUtil;
import cn.lili.common.utils.CookieUtil;
@ -30,6 +32,7 @@ import cn.lili.modules.member.entity.dto.MemberPointMessage;
import cn.lili.modules.member.entity.enums.PointTypeEnum;
import cn.lili.modules.member.entity.vo.MemberDistributionVO;
import cn.lili.modules.member.entity.vo.MemberSearchVO;
import cn.lili.modules.member.entity.vo.MemberVO;
import cn.lili.modules.member.mapper.MemberMapper;
import cn.lili.modules.member.service.MemberService;
import cn.lili.modules.member.token.MemberTokenGenerate;
@ -363,7 +366,7 @@ public class MemberServiceImpl extends ServiceImpl<MemberMapper, Member> impleme
}
@Override
public IPage<Member> getMemberPage(MemberSearchVO memberSearchVO, PageVO page) {
public IPage<MemberVO> getMemberPage(MemberSearchVO memberSearchVO, PageVO page) {
QueryWrapper<Member> queryWrapper = Wrappers.query();
//用户名查询
queryWrapper.like(StringUtils.isNotBlank(memberSearchVO.getUsername()), "username", memberSearchVO.getUsername());
@ -375,7 +378,7 @@ public class MemberServiceImpl extends ServiceImpl<MemberMapper, Member> impleme
queryWrapper.eq(StringUtils.isNotBlank(memberSearchVO.getDisabled()), "disabled",
memberSearchVO.getDisabled().equals(SwitchEnum.OPEN.name()) ? 1 : 0);
queryWrapper.orderByDesc("create_time");
return this.page(PageUtil.initPage(page), queryWrapper);
return this.baseMapper.pageByMemberVO(PageUtil.initPage(page), queryWrapper);
}
@Override
@ -573,6 +576,17 @@ public class MemberServiceImpl extends ServiceImpl<MemberMapper, Member> impleme
return this.count(queryWrapper);
}
/**
* 登出
*/
@Override
public void logout(UserEnums userEnums) {
String currentUserToken = UserContext.getCurrentUserToken();
if (CharSequenceUtil.isNotEmpty(currentUserToken)) {
cache.remove(CachePrefix.ACCESS_TOKEN.getPrefix(userEnums) + currentUserToken);
}
}
/**
* 检测会员
*

9
framework/src/main/java/cn/lili/modules/order/cart/service/CartServiceImpl.java
View File

@ -118,6 +118,9 @@ public class CartServiceImpl implements CartService {
@Override
public void add(String skuId, Integer num, String cartType, Boolean cover) {
if (num <= 0) {
throw new ServiceException(ResultCode.CART_NUM_ERROR);
}
CartTypeEnum cartTypeEnum = getCartType(cartType);
GoodsSku dataSku = checkGoods(skuId);
try {
@ -492,6 +495,7 @@ public class CartServiceImpl implements CartService {
@Override
public void selectCoupon(String couponId, String way, boolean use) {
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
//获取购物车，然后重新写入优惠券
CartTypeEnum cartTypeEnum = getCartType(way);
TradeDTO tradeDTO = this.readDTO(cartTypeEnum);
@ -500,6 +504,7 @@ public class CartServiceImpl implements CartService {
memberCouponService.getOne(
new LambdaQueryWrapper<MemberCoupon>()
.eq(MemberCoupon::getMemberCouponStatus, MemberCouponStatusEnum.NEW.name())
.eq(MemberCoupon::getMemberId, currentUser.getId())
.eq(MemberCoupon::getId, couponId));
if (memberCoupon == null) {
throw new ServiceException(ResultCode.COUPON_EXPIRED);
@ -507,7 +512,7 @@ public class CartServiceImpl implements CartService {
//使用优惠券 与否
if (use) {
this.useCoupon(tradeDTO, memberCoupon, cartTypeEnum);
} else if (!use) {
} else {
if (Boolean.TRUE.equals(memberCoupon.getIsPlatform())) {
tradeDTO.setPlatformCoupon(null);
} else {
@ -679,7 +684,7 @@ public class CartServiceImpl implements CartService {
//拼团活动，需要对限购数量进行判定
//获取拼团信息
List<PromotionGoods> currentPromotion = cartSkuVO.getPromotions().stream().filter(
promotionGoods -> (promotionGoods.getPromotionType().equals(PromotionTypeEnum.PINTUAN.name())))
promotionGoods -> (promotionGoods.getPromotionType().equals(PromotionTypeEnum.PINTUAN.name())))
.collect(Collectors.toList());
//拼团活动判定
if (!currentPromotion.isEmpty()) {

4
framework/src/main/java/cn/lili/modules/order/order/entity/dos/Order.java
View File

@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import lombok.EqualsAndHashCode;
import lombok.NoArgsConstructor;
import org.springframework.format.annotation.DateTimeFormat;
@ -33,6 +34,7 @@ import java.util.Optional;
* @author Chopper
* @since 2020/11/17 7:30 下午
*/
@EqualsAndHashCode(callSuper = true)
@Data
@TableName("li_order")
@ApiModel(value = "订单")
@ -88,6 +90,7 @@ public class Order extends BaseEntity {
private Date paymentTime;
@ApiModelProperty(value = "收件人姓名")
@Sensitive(strategy = SensitiveStrategy.USERNAME)
private String consigneeName;
@ApiModelProperty(value = "收件人手机")
@ -107,6 +110,7 @@ public class Order extends BaseEntity {
private String consigneeAddressIdPath;
@ApiModelProperty(value = "详细地址")
@Sensitive(strategy = SensitiveStrategy.ADDRESS)
private String consigneeDetail;
@ApiModelProperty(value = "总价格")

9
framework/src/main/java/cn/lili/modules/order/order/entity/dos/OrderComplaint.java
View File

@ -1,12 +1,15 @@
package cn.lili.modules.order.order.entity.dos;
import cn.lili.mybatis.BaseEntity;
import cn.lili.common.security.sensitive.Sensitive;
import cn.lili.common.security.sensitive.enums.SensitiveStrategy;
import cn.lili.modules.order.order.entity.enums.ComplaintStatusEnum;
import cn.lili.mybatis.BaseEntity;
import com.baomidou.mybatisplus.annotation.TableName;
import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import lombok.EqualsAndHashCode;
import java.util.Date;
@ -16,6 +19,7 @@ import java.util.Date;
* @author paulG
* @since 2020/12/4
**/
@EqualsAndHashCode(callSuper = true)
@Data
@TableName("li_order_complaint")
@ApiModel(value = "订单交易投诉")
@ -96,12 +100,15 @@ public class OrderComplaint extends BaseEntity {
private String memberName;
@ApiModelProperty(value = "收货人")
@Sensitive(strategy = SensitiveStrategy.USERNAME)
private String consigneeName;
@ApiModelProperty(value = "收货地址")
@Sensitive(strategy = SensitiveStrategy.ADDRESS)
private String consigneeAddressPath;
@ApiModelProperty(value = "收货人手机")
@Sensitive(strategy = SensitiveStrategy.PHONE)
private String consigneeMobile;
@ApiModelProperty(value = "仲裁结果")

4
framework/src/main/java/cn/lili/modules/order/order/serviceimpl/AfterSaleServiceImpl.java
View File

@ -32,8 +32,8 @@ import cn.lili.modules.order.order.service.OrderService;
import cn.lili.modules.order.trade.entity.enums.AfterSaleRefundWayEnum;
import cn.lili.modules.order.trade.entity.enums.AfterSaleStatusEnum;
import cn.lili.modules.order.trade.entity.enums.AfterSaleTypeEnum;
import cn.lili.modules.payment.kit.RefundSupport;
import cn.lili.modules.payment.entity.enums.PaymentMethodEnum;
import cn.lili.modules.payment.kit.RefundSupport;
import cn.lili.modules.statistics.entity.dto.StatisticsQueryParam;
import cn.lili.modules.statistics.util.StatisticsDateUtil;
import cn.lili.modules.store.entity.dto.StoreAfterSaleAddressDTO;
@ -404,7 +404,7 @@ public class AfterSaleServiceImpl extends ServiceImpl<AfterSaleMapper, AfterSale
//写入商家信息
OrderItem orderItem = orderItemService.getBySn(afterSaleDTO.getOrderItemSn());
Order order = orderService.getBySn(orderItem.getOrderSn());
Order order = OperationalJudgment.judgment(orderService.getBySn(orderItem.getOrderSn()));
afterSale.setStoreId(order.getStoreId());
afterSale.setStoreName(order.getStoreName());

14
framework/src/main/java/cn/lili/modules/order/order/serviceimpl/OrderComplaintServiceImpl.java
View File

@ -3,11 +3,10 @@ package cn.lili.modules.order.order.serviceimpl;
import cn.hutool.core.util.StrUtil;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.exception.ServiceException;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.utils.BeanUtil;
import cn.lili.modules.system.utils.OperationalJudgment;
import cn.lili.mybatis.util.PageUtil;
import cn.lili.common.utils.StringUtils;
import cn.lili.common.vo.PageVO;
import cn.lili.modules.goods.entity.dos.GoodsSku;
@ -24,6 +23,8 @@ import cn.lili.modules.order.order.service.OrderComplaintCommunicationService;
import cn.lili.modules.order.order.service.OrderComplaintService;
import cn.lili.modules.order.order.service.OrderItemService;
import cn.lili.modules.order.order.service.OrderService;
import cn.lili.modules.system.utils.OperationalJudgment;
import cn.lili.mybatis.util.PageUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
@ -35,6 +36,7 @@ import org.springframework.stereotype.Service;
import java.util.Date;
import java.util.List;
import java.util.Objects;
/**
* 交易投诉业务层实现
@ -120,6 +122,7 @@ public class OrderComplaintServiceImpl extends ServiceImpl<OrderComplaintMapper,
public OrderComplaint addOrderComplain(OrderComplaintDTO orderComplaintDTO) {
try {
AuthUser currentUser = Objects.requireNonNull(UserContext.getCurrentUser());
//查询订单信息
OrderDetailVO orderDetailVO = orderService.queryDetail(orderComplaintDTO.getOrderSn());
List<OrderItem> orderItems = orderDetailVO.getOrderItems();
@ -159,8 +162,8 @@ public class OrderComplaintServiceImpl extends ServiceImpl<OrderComplaintMapper,
orderComplaint.setStoreId(orderDetailVO.getOrder().getStoreId());
orderComplaint.setStoreName(orderDetailVO.getOrder().getStoreName());
orderComplaint.setMemberId(UserContext.getCurrentUser().getId());
orderComplaint.setMemberName(UserContext.getCurrentUser().getUsername());
orderComplaint.setMemberId(currentUser.getId());
orderComplaint.setMemberName(currentUser.getUsername());
//保存订单投诉
this.save(orderComplaint);
@ -213,8 +216,7 @@ public class OrderComplaintServiceImpl extends ServiceImpl<OrderComplaintMapper,
@Override
public boolean cancel(String id) {
OrderComplaint orderComplaint = this.getById(id);
OrderComplaint orderComplaint = OperationalJudgment.judgment(this.getById(id));
//如果以及仲裁，则不可以进行申诉取消
if(orderComplaint.getComplainStatus().equals(ComplaintStatusEnum.COMPLETE.name())){
throw new ServiceException(ResultCode.COMPLAINT_CANCEL_ERROR);

5
framework/src/main/java/cn/lili/modules/page/entity/dos/Feedback.java
View File

@ -1,5 +1,7 @@
package cn.lili.modules.page.entity.dos;
import cn.lili.common.security.sensitive.Sensitive;
import cn.lili.common.security.sensitive.enums.SensitiveStrategy;
import cn.lili.modules.page.entity.enums.FeedbackTypeEnum;
import cn.lili.mybatis.BaseIdEntity;
import com.baomidou.mybatisplus.annotation.FieldFill;
@ -9,6 +11,7 @@ import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import lombok.EqualsAndHashCode;
import org.hibernate.validator.constraints.Length;
import org.springframework.data.annotation.CreatedDate;
import org.springframework.format.annotation.DateTimeFormat;
@ -22,6 +25,7 @@ import java.util.Date;
* @author Bulbasaur
* @since 2020/12/10 17:42
*/
@EqualsAndHashCode(callSuper = true)
@Data
@TableName("li_feedback")
@ApiModel(value = "意见反馈")
@ -46,6 +50,7 @@ public class Feedback extends BaseIdEntity {
@ApiModelProperty(value = "手机号")
@Length(max = 11, message = "手机号不能超过11位")
@Sensitive(strategy = SensitiveStrategy.PHONE)
private String mobile;
@ApiModelProperty(value = "图片，多个图片使用：(，)分割")

11
framework/src/main/java/cn/lili/modules/permission/serviceimpl/AdminUserServiceImpl.java
View File

@ -1,12 +1,11 @@
package cn.lili.modules.permission.serviceimpl;
import cn.lili.modules.system.aspect.annotation.SystemLogPoint;
import cn.hutool.core.text.CharSequenceUtil;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.exception.ServiceException;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.security.token.Token;
import cn.lili.modules.system.token.ManagerTokenGenerate;
import cn.lili.common.utils.BeanUtil;
import cn.lili.common.utils.StringUtils;
import cn.lili.modules.permission.entity.dos.AdminUser;
@ -17,6 +16,8 @@ import cn.lili.modules.permission.entity.dto.AdminUserDTO;
import cn.lili.modules.permission.entity.vo.AdminUserVO;
import cn.lili.modules.permission.mapper.AdminUserMapper;
import cn.lili.modules.permission.service.*;
import cn.lili.modules.system.aspect.annotation.SystemLogPoint;
import cn.lili.modules.system.token.ManagerTokenGenerate;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@ -68,7 +69,7 @@ public class AdminUserServiceImpl extends ServiceImpl<AdminUserMapper, AdminUser
adminUserPage.getRecords().forEach(adminUser -> {
AdminUserVO adminUserVO = new AdminUserVO(adminUser);
if (!StringUtils.isEmpty(adminUser.getDepartmentId())) {
if (!CharSequenceUtil.isEmpty(adminUser.getDepartmentId())) {
try {
adminUserVO.setDepartmentTitle(
departments.stream().filter
@ -208,8 +209,8 @@ public class AdminUserServiceImpl extends ServiceImpl<AdminUserMapper, AdminUser
if (roles.size() > rolesMaxSize) {
throw new ServiceException(ResultCode.PERMISSION_BEYOND_TEN);
}
if (roles.size() > 0) {
dbUser.setRoleIds(StringUtils.join(",", roles));
if (!roles.isEmpty()) {
dbUser.setRoleIds(CharSequenceUtil.join(",", roles));
}
this.save(dbUser);
dbUser = this.findByUsername(dbUser.getUsername());

2
framework/src/main/java/cn/lili/modules/search/serviceimpl/EsGoodsSearchServiceImpl.java
View File

@ -397,7 +397,7 @@ public class EsGoodsSearchServiceImpl implements EsGoodsSearchService {
filterBuilder.must(QueryBuilders.termsQuery(ATTR_BRAND_ID, brands));
}
if (searchDTO.getRecommend() != null) {
filterBuilder.filter(QueryBuilders.termQuery("storeId", searchDTO.getRecommend()));
filterBuilder.filter(QueryBuilders.termQuery("recommend", searchDTO.getRecommend()));
}
//规格项判定
if (searchDTO.getNameIds() != null && !searchDTO.getNameIds().isEmpty()) {

17
framework/src/main/java/cn/lili/modules/store/entity/dto/StoreEditDTO.java
View File

@ -1,5 +1,7 @@
package cn.lili.modules.store.entity.dto;
import cn.lili.common.security.sensitive.Sensitive;
import cn.lili.common.security.sensitive.enums.SensitiveStrategy;
import cn.lili.common.validation.Mobile;
import cn.lili.common.validation.Phone;
import com.baomidou.mybatisplus.annotation.TableField;
@ -37,11 +39,13 @@ public class StoreEditDTO {
@NotBlank(message = "公司名称不能为空")
@Size(min = 2, max = 100, message = "公司名称错误")
@ApiModelProperty(value = "公司名称")
@Sensitive(strategy = SensitiveStrategy.USERNAME)
private String companyName;
@NotBlank(message = "公司地址不能为空")
@Size(min = 1, max = 200, message = "公司地址,长度为1-200字符")
@ApiModelProperty(value = "公司地址")
@Sensitive(strategy = SensitiveStrategy.ADDRESS)
private String companyAddress;
@ApiModelProperty(value = "公司地址地区Id")
@ -52,10 +56,12 @@ public class StoreEditDTO {
@Mobile
@ApiModelProperty(value = "公司电话")
@Sensitive(strategy = SensitiveStrategy.PHONE)
private String companyPhone;
@Email
@ApiModelProperty(value = "电子邮箱")
@Sensitive(strategy = SensitiveStrategy.EMAIL)
private String companyEmail;
@Min(value = 1, message = "员工总数,至少一位")
@ -74,10 +80,12 @@ public class StoreEditDTO {
@NotBlank(message = "手机号不能为空")
@Phone
@ApiModelProperty(value = "联系人电话")
@Sensitive(strategy = SensitiveStrategy.PHONE)
private String linkPhone;
@Size(min = 18, max = 18, message = "营业执照长度为18位字符")
@ApiModelProperty(value = "营业执照号")
@Sensitive(strategy = SensitiveStrategy.NAME)
private String licenseNum;
@Size(min = 1, max = 200, message = "法定经营范围长度为1-200位字符")
@ -91,11 +99,13 @@ public class StoreEditDTO {
@NotBlank(message = "法人姓名不能为空")
@Size(min = 2, max = 20, message = "法人姓名长度为2-20位字符")
@ApiModelProperty(value = "法人姓名")
@Sensitive(strategy = SensitiveStrategy.USERNAME)
private String legalName;
@NotBlank(message = "法人身份证不能为空")
@Size(min = 18, max = 18, message = "法人身份证号长度为18位")
@ApiModelProperty(value = "法人身份证")
@Sensitive(strategy = SensitiveStrategy.ID_CARD)
private String legalId;
@NotBlank(message = "法人身份证不能为空")
@ -105,21 +115,25 @@ public class StoreEditDTO {
@Size(min = 1, max = 200, message = "结算银行开户行名称长度为1-200位")
@NotBlank(message = "结算银行开户行名称不能为空")
@ApiModelProperty(value = "结算银行开户行名称")
@Sensitive(strategy = SensitiveStrategy.NAME)
private String settlementBankAccountName;
@Size(min = 1, max = 200, message = "结算银行开户账号长度为1-200位")
@NotBlank(message = "结算银行开户账号不能为空")
@ApiModelProperty(value = "结算银行开户账号")
@Sensitive(strategy = SensitiveStrategy.NAME)
private String settlementBankAccountNum;
@Size(min = 1, max = 200, message = "结算银行开户支行名称长度为1-200位")
@NotBlank(message = "结算银行开户支行名称不能为空")
@ApiModelProperty(value = "结算银行开户支行名称")
@Sensitive(strategy = SensitiveStrategy.NAME)
private String settlementBankBranchName;
@Size(min = 1, max = 50, message = "结算银行支行联行号长度为1-200位")
@NotBlank(message = "结算银行支行联行号不能为空")
@ApiModelProperty(value = "结算银行支行联行号")
@Sensitive(strategy = SensitiveStrategy.NAME)
private String settlementBankJointName;
@NotBlank(message = "店铺经营类目不能为空")
@ -141,11 +155,12 @@ public class StoreEditDTO {
private String ddCode;
//店铺退货收件地址
@ApiModelProperty(value = "收货人姓名")
@Sensitive(strategy = SensitiveStrategy.USERNAME)
private String salesConsigneeName;
@ApiModelProperty(value = "收件人手机")
@Sensitive(strategy = SensitiveStrategy.PHONE)
private String salesConsigneeMobile;
@ApiModelProperty(value = "地址Id， '，'分割")

2
framework/src/main/java/cn/lili/modules/store/entity/vos/StoreDetailVO.java
View File

@ -3,6 +3,7 @@ package cn.lili.modules.store.entity.vos;
import cn.lili.modules.store.entity.dto.StoreEditDTO;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import lombok.EqualsAndHashCode;
/**
* 店铺详细VO
@ -10,6 +11,7 @@ import lombok.Data;
* @author pikachu
* @since 2020-03-09 21:53:20
*/
@EqualsAndHashCode(callSuper = true)
@Data
public class StoreDetailVO extends StoreEditDTO {

3
manager-api/src/main/java/cn/lili/controller/member/MemberManagerController.java
View File

@ -7,6 +7,7 @@ import cn.lili.modules.member.entity.dos.Member;
import cn.lili.modules.member.entity.dto.ManagerMemberEditDTO;
import cn.lili.modules.member.entity.dto.MemberAddDTO;
import cn.lili.modules.member.entity.vo.MemberSearchVO;
import cn.lili.modules.member.entity.vo.MemberVO;
import cn.lili.modules.member.service.MemberService;
import cn.lili.modules.system.aspect.annotation.DemoSite;
import com.baomidou.mybatisplus.core.metadata.IPage;
@ -35,7 +36,7 @@ public class MemberManagerController {
@ApiOperation(value = "会员分页列表")
@GetMapping
public ResultMessage<IPage<Member>> getByPage(MemberSearchVO memberSearchVO, PageVO page) {
public ResultMessage<IPage<MemberVO>> getByPage(MemberSearchVO memberSearchVO, PageVO page) {
return ResultUtil.data(memberService.getMemberPage(memberSearchVO, page));
}

13
manager-api/src/main/java/cn/lili/controller/passport/AdminUserManagerController.java
View File

@ -5,11 +5,13 @@ import cn.lili.common.enums.ResultUtil;
import cn.lili.common.exception.ServiceException;
import cn.lili.common.security.AuthUser;
import cn.lili.common.security.context.UserContext;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.security.token.Token;
import cn.lili.common.utils.StringUtils;
import cn.lili.common.vo.PageVO;
import cn.lili.common.vo.ResultMessage;
import cn.lili.common.vo.SearchVO;
import cn.lili.modules.member.service.MemberService;
import cn.lili.modules.permission.entity.dos.AdminUser;
import cn.lili.modules.permission.entity.dto.AdminUserDTO;
import cn.lili.modules.permission.entity.vo.AdminUserVO;
@ -51,6 +53,11 @@ public class AdminUserManagerController {
private AdminUserService adminUserService;
@Autowired
private DepartmentService departmentService;
/**
* 会员
*/
@Autowired
private MemberService memberService;
@Autowired
private VerificationService verificationService;
@ -67,6 +74,12 @@ public class AdminUserManagerController {
}
}
@ApiOperation(value = "注销接口")
@PostMapping("/logout")
public ResultMessage<Object> logout() {
this.memberService.logout(UserEnums.MANAGER);
return ResultUtil.success();
}
@ApiOperation(value = "刷新token")
@GetMapping("/refresh/{refreshToken}")

53
manager-api/src/test/java/cn/lili/test/elasticsearch/EsTest.java
View File

@ -1,6 +1,6 @@
package cn.lili.test.elasticsearch;
import cn.hutool.core.util.ReflectUtil;
import cn.hutool.http.HtmlUtil;
import cn.hutool.json.JSONUtil;
import cn.lili.cache.Cache;
import cn.lili.common.vo.PageVO;
@ -20,14 +20,14 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.owasp.html.PolicyFactory;
import org.owasp.html.Sanitizers;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.data.elasticsearch.core.SearchPage;
import org.springframework.test.context.junit.jupiter.SpringExtension;
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.Map;
@ -59,47 +59,12 @@ class EsTest {
public static void main(String[] args) {
EsGoodsIndex goodsIndex = new EsGoodsIndex();
goodsIndex.setGoodsName("1111");
goodsIndex.setBuyCount(99);
goodsIndex.setCommentNum(99);
goodsIndex.setGrade(100D);
goodsIndex.setHighPraiseNum(100);
goodsIndex.setIntro("I'd like a cup of tea, please");
goodsIndex.setIsAuth("1");
goodsIndex.setMarketEnable("1");
goodsIndex.setMobileIntro("I want something cold to drink");
goodsIndex.setPoint(0);
goodsIndex.setSelfOperated(true);
goodsIndex.setThumbnail("picture");
goodsIndex.setStoreCategoryPath("1");
String ignoreField = "serialVersionUID,promotionMap,id,goodsId";
List<EsGoodsIndex> goodsIndices = new ArrayList<>();
Map<String, Field> fieldMap = ReflectUtil.getFieldMap(EsGoodsIndex.class);
for (int i = 0; i < 10; i++) {
EsGoodsIndex a = new EsGoodsIndex();
for (Map.Entry<String, Field> entry : fieldMap.entrySet()) {
Object fieldValue = ReflectUtil.getFieldValue(goodsIndex, entry.getValue());
if (fieldValue != null && !ignoreField.contains(entry.getKey())) {
ReflectUtil.setFieldValue(a, entry.getValue(), fieldValue);
}
}
goodsIndices.add(a);
}
;
// BeanUtil.copyProperties(goodsIndex, a);
System.out.println(cn.hutool.core.date.DateUtil.endOfDay(new Date()));
// ReflectUtil.getFieldValue(goodsIndex, )
// for (Object o : ReflectUtil.getFieldsValue(goodsIndex)) {
// if (o != null) {
// System.out.println(o);
// }
// }
PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
String safeHTML = policy.sanitize("+ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-");
System.out.println(safeHTML);
System.out.println(Sanitizers.FORMATTING.and(Sanitizers.FORMATTING).sanitize("+ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-"));
System.out.println(HtmlUtil.unescape(safeHTML));
System.out.println(HtmlUtil.filter("+ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-"));
}
@Test

1
pom.xml
View File

@ -59,6 +59,7 @@
<xxl-job>2.3.0</xxl-job>
<spotify>1.2.2</spotify>
<spring-boot-admin>2.3.1</spring-boot-admin>
<owasp-java-html-sanitizer>20211018.2</owasp-java-html-sanitizer>
</properties>
<modules>

12
seller-api/src/main/java/cn/lili/controller/passport/StorePassportController.java
View File

@ -4,11 +4,12 @@ package cn.lili.controller.passport;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.enums.ResultUtil;
import cn.lili.common.exception.ServiceException;
import cn.lili.modules.verification.enums.VerificationEnums;
import cn.lili.modules.verification.service.VerificationService;
import cn.lili.common.security.enums.UserEnums;
import cn.lili.common.vo.ResultMessage;
import cn.lili.modules.member.entity.dos.Member;
import cn.lili.modules.member.service.MemberService;
import cn.lili.modules.verification.enums.VerificationEnums;
import cn.lili.modules.verification.service.VerificationService;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiImplicitParam;
import io.swagger.annotations.ApiImplicitParams;
@ -54,6 +55,13 @@ public class StorePassportController {
}
}
@ApiOperation(value = "注销接口")
@PostMapping("/logout")
public ResultMessage<Object> logout() {
this.memberService.logout(UserEnums.STORE);
return ResultUtil.success();
}
@ApiOperation(value = "修改密码")
@ApiImplicitParams({
@ApiImplicitParam(name = "password", value = "旧密码", required = true, paramType = "query"),