add:新增webdav相关功能,修复安全隐患

This commit is contained in:
tiansh
2024-01-23 17:41:51 +08:00
parent f02d865389
commit 44814e79b0
19 changed files with 199 additions and 114 deletions
+1 -1
View File
@@ -248,7 +248,7 @@
<configuration>
<testFailureIgnore>true</testFailureIgnore>
</configuration>
</plugin>
</plugin><plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-compiler-plugin</artifactId><configuration><source>8</source><target>8</target></configuration></plugin>
</plugins>
</build>
@@ -7,7 +7,6 @@ import cn.hellohao.service.*;
import cn.hellohao.service.impl.AlbumServiceImpl;
import cn.hellohao.service.impl.UserServiceImpl;
import cn.hellohao.service.impl.deleImages;
import cn.hellohao.utils.Base64Encryption;
import cn.hellohao.utils.SetFiles;
import cn.hellohao.utils.SetText;
import cn.hellohao.utils.progress.MyProgress;
@@ -28,10 +27,7 @@ import org.springframework.web.bind.annotation.ResponseBody;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.UUID;
import java.util.*;
/**
* @author Hellohao
@@ -444,10 +440,11 @@ public class AdminController {
user.setEmail(email);
}
}
user.setPassword(Base64Encryption.encryptBASE64(password.getBytes()));
user.setPassword(Base64.getEncoder().encodeToString(password.getBytes()));
user.setUid(u.getUid());
} else {
user.setPassword(Base64Encryption.encryptBASE64(password.getBytes()));
user.setPassword(Base64.getEncoder().encodeToString(password.getBytes()));
user.setUid(u.getUid());
}
userService.change(user);
@@ -47,6 +47,22 @@ public class AdminRootController {
private ImgreviewService imgreviewService;
@Autowired
private AppClientService appClientService;
@Autowired
private NOSImageupload nOSImageupload;
@Autowired
private OSSImageupload ossImageupload;
@Autowired
private USSImageupload ussImageupload;
@Autowired
private KODOImageupload kodoImageupload;
@Autowired
private COSImageupload cosImageupload;
@Autowired
private FtpServiceImpl ftpService;
@Autowired
private S3Imageupload s3Imageupload;
@Autowired
private WebDAVImageupload webDAVImageupload;
@PostMapping(value = "/getUserList")
@@ -189,19 +205,21 @@ public class AdminRootController {
Keys key = keysService.selectKeys(keyId);
Integer ret = 0;
if (key.getStorageType() == 1) {
ret = NOSImageupload.Initialize(key);
ret = nOSImageupload.Initialize(key);
} else if (key.getStorageType() == 2) {
ret = OSSImageupload.Initialize(key);
ret = ossImageupload.Initialize(key);
} else if (key.getStorageType() == 3) {
ret = USSImageupload.Initialize(key);
ret = ussImageupload.Initialize(key);
} else if (key.getStorageType() == 4) {
ret = KODOImageupload.Initialize(key);
ret = kodoImageupload.Initialize(key);
} else if (key.getStorageType() == 6) {
ret = COSImageupload.Initialize(key);
ret = cosImageupload.Initialize(key);
} else if (key.getStorageType() == 7) {
ret = FtpServiceImpl.Initialize(key);
ret = ftpService.Initialize(key);
} else if (key.getStorageType() == 8) {
ret = S3Imageupload.Initialize(key);
ret = s3Imageupload.Initialize(key);
}else if (key.getStorageType() == 9) {
ret = webDAVImageupload.Initialize(key);
}
Long l = imgService.getsourcememory(keyId);
jsonObject.put("isok", ret);
@@ -224,23 +242,6 @@ public class AdminRootController {
@ResponseBody
public Msg updateStorage(@RequestParam(value = "data", defaultValue = "") String data) {
JSONObject jsonObj = JSONObject.parseObject(data);
// Integer id = jsonObj.getInteger("id");
// String AccessKey = jsonObj.getString("AccessKey");
// String AccessSecret = jsonObj.getString("AccessSecret");
// String Endpoint = jsonObj.getString("Endpoint");
// String Bucketname = jsonObj.getString("Bucketname");
// String RequestAddress = jsonObj.getString("RequestAddress");
// Integer storageType = jsonObj.getInteger("storageType");
// String keyname = jsonObj.getString("keyname");
// Keys keys = new Keys();
// keys.setId(id);
// keys.setAccessKey(AccessKey);
// keys.setAccessSecret(AccessSecret);
// keys.setEndpoint(Endpoint);
// keys.setBucketname(Bucketname);
// keys.setRequestAddress(RequestAddress);
// keys.setStorageType(storageType);
// keys.setKeyname(keyname);
Keys keys = JSON.toJavaObject(jsonObj,Keys.class);
Msg msg = keysService.updateKey(keys);
return msg;
@@ -5,6 +5,7 @@ import cn.hellohao.config.GlobalConstant;
import cn.hellohao.pojo.*;
import cn.hellohao.service.*;
import cn.hellohao.service.impl.UploadServicel;
import cn.hellohao.service.impl.WebDAVImageupload;
import cn.hellohao.service.impl.deleImages;
import cn.hellohao.utils.GetIPS;
import cn.hellohao.utils.MyVersion;
@@ -19,6 +20,8 @@ import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.InputStreamResource;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.*;
@@ -43,7 +46,7 @@ public class IndexController {
@Autowired private deleImages deleimages;
@Autowired private IRedisService iRedisService;
@Autowired private AppClientService appClientService;
@Autowired private WebDAVImageupload webDAVImageupload;
public static String version = "20240111";
@RequestMapping(value = "/")
public String Welcome(Model model, HttpServletRequest httpServletRequest) {
@@ -191,6 +194,14 @@ public class IndexController {
return retMsg;
}
//webdav本地托管
@GetMapping("/w/{shortuuid}")
public ResponseEntity<InputStreamResource> getNextcloudImage(HttpServletRequest request, @PathVariable("shortuuid") String shortuuid) {
ResponseEntity<InputStreamResource> webDAV = webDAVImageupload.getWebDAV(shortuuid);
return webDAV;
}
@RequestMapping(value = "/getUploadInfo")
@ResponseBody
public Msg getUploadInfo() {
@@ -5,7 +5,6 @@ import cn.hellohao.auth.token.JWTUtil;
import cn.hellohao.config.SysName;
import cn.hellohao.pojo.*;
import cn.hellohao.service.*;
import cn.hellohao.utils.Base64Encryption;
import cn.hellohao.utils.NewSendEmail;
import cn.hellohao.utils.Print;
import cn.hellohao.utils.SetText;
@@ -27,6 +26,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.text.SimpleDateFormat;
import java.util.Base64;
import java.util.Date;
import java.util.UUID;
@@ -55,7 +55,7 @@ public class UserController {
JSONObject jsonObj = JSONObject.parseObject(data);
String username = jsonObj.getString("username");
String email = jsonObj.getString("email");
String password = Base64Encryption.encryptBASE64(jsonObj.getString("password").getBytes());
String password = Base64.getEncoder().encodeToString(jsonObj.getString("password").getBytes());
String verifyCodeForRegister = jsonObj.getString("verifyCode");
Object redis_verifyCodeForRegister = iRedisService.getValue("verifyCodeForRegister_"+httpServletRequest.getHeader("verifyCodeForRegister"));
if(!SetText.checkEmail(email)){
@@ -203,7 +203,7 @@ public class UserController {
Msg msg = new Msg();
JSONObject jsonObj = JSONObject.parseObject(data);
String email = jsonObj.getString("email");
String password = Base64Encryption.encryptBASE64(jsonObj.getString("password").getBytes());
String password = Base64.getEncoder().encodeToString(jsonObj.getString("password").getBytes());
String verifyCode = jsonObj.getString("verifyCode");
if(null == email || null == password || null == verifyCode){
msg.setCode("5000");
@@ -385,7 +385,7 @@ public class UserController {
User user = userService.getUsers(u2);
user.setIsok(1);
String new_pass = HexUtil.decodeHexStr(cip);//解密密码
user.setPassword(Base64Encryption.encryptBASE64(new_pass.getBytes()));
user.setPassword(Base64.getEncoder().encodeToString(new_pass.getBytes()));
String uid = UUID.randomUUID().toString().replace("-", "").toLowerCase();
user.setUid(uid);
if (user != null) {
+3
View File
@@ -16,4 +16,7 @@ public class Keys {
private String RootPath;//存入的目录
private Boolean SysTransmit;
public Boolean getSysTransmit() {
return SysTransmit==null?false:SysTransmit;
}
}
@@ -34,6 +34,8 @@ public class FirstJob {
@Autowired
private S3Imageupload s3Imageupload;
@Autowired
private WebDAVImageupload webDAVImageupload;
@Autowired
private FtpServiceImpl ftpService;
@Autowired
ImgTempService imgTempService;
@@ -78,6 +80,8 @@ public class FirstJob {
firstJob.ftpService.delFTP(keys.getId(), images);
}else if(keys.getStorageType()==8){
firstJob.s3Imageupload.deleS3(keys.getId(), images);
}else if(keys.getStorageType()==9){
firstJob.webDAVImageupload.delWebDAV(keys.getId(), images);
}else{
System.err.println("未获取到对象存储参数,上传失败。");
}
@@ -67,7 +67,7 @@ public class ClientService {
return msg;
}
u2.setEmail(email);
u2.setPassword(Base64Encryption.encryptBASE64(pass.getBytes()));
u2.setPassword(Base64.getEncoder().encodeToString(pass.getBytes()));
User u = userMapper.getUsers(u2);
if (null == u || u.getIsok() != 1) {
msg.setCode("4006");
@@ -142,8 +142,10 @@ public class ClientService {
imgnameEd = updatePath + "/" + shortUuid_y + "." + prefix;
imgObj.setImgname(imgnameEd);
if (key.getStorageType().equals(5)) {
imgObj.setImgurl(key.getRequestAddress() + "/ota/" + imgnameEd);
} else {
imgObj.setImgurl(confdata.getString("domain") + "/ota/" + imgnameEd);
} else if(key.getStorageType().equals(9) && key.getSysTransmit()){
imgObj.setImgurl(confdata.getString("domain") + "/w/" + shortUuid_y);
}else {
imgObj.setImgurl(key.getRequestAddress() + "/" + imgnameEd);
}
imgObj.setSizes(Long.toString(file.length()));
@@ -58,6 +58,8 @@ public class InitializationStorage implements CommandLineRunner {
FtpServiceImpl.Initialize(key);
}else if(key.getStorageType()==8){
S3Imageupload.Initialize(key);
}else if(key.getStorageType()==9){
WebDAVImageupload.Initialize(key);
}
}
}
@@ -2,6 +2,7 @@ package cn.hellohao.service.impl;
import cn.hellohao.pojo.Msg;
import cn.hellohao.utils.Print;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -30,6 +31,8 @@ public class KeysServiceImpl implements KeysService {
private FtpServiceImpl ftpService;
@Autowired
private S3Imageupload s3Imageupload;
@Autowired
private WebDAVImageupload webDAVImageupload;
@Override
@@ -51,6 +54,29 @@ public class KeysServiceImpl implements KeysService {
public Msg updateKey(Keys key) {
Msg msg = new Msg();
Integer ret = -2;
//修正一边数据格式,去除末尾的斜杠
if(key.getStorageType()==9 || key.getStorageType()==8){
//s3或者webdav
if(!StringUtils.isBlank(key.getRootPath()) && !key.getRootPath().equals("/")){
if (key.getRootPath().endsWith("/")) {
String rootpath = key.getRootPath();
key.setRootPath(rootpath.substring(0, rootpath.length() - 1));
}
}
}
if(!StringUtils.isBlank(key.getEndpoint())){
final String endpoint = key.getEndpoint();
if (endpoint.endsWith("/")) {
key.setEndpoint(endpoint.substring(0, endpoint.length() - 1));
}
}
if(!StringUtils.isBlank(key.getRequestAddress())){
final String requestAddress = key.getRequestAddress();
if (requestAddress.endsWith("/")) {
key.setRequestAddress(requestAddress.substring(0, requestAddress.length() - 1));
}
}
if(key.getStorageType()==1){
ret =nOSImageupload.Initialize(key);
}else if (key.getStorageType()==2){
@@ -67,6 +93,8 @@ public class KeysServiceImpl implements KeysService {
ret = ftpService.Initialize(key);
}else if(key.getStorageType()==8){
ret = s3Imageupload.Initialize(key);
}else if(key.getStorageType()==9){
ret = webDAVImageupload.Initialize(key);
}else{
Print.Normal("为获取到存储参数,或者使用存储源是本地的。");
}
@@ -148,8 +148,10 @@ public class UploadServicel {
imgnameEd = updatePath + "/" + shortUuid_y + "." + prefix;
imgObj.setImgname(imgnameEd);
if (key.getStorageType().equals(5)) {
imgObj.setImgurl(key.getRequestAddress() + "/ota/" + imgnameEd);
} else {
imgObj.setImgurl(confdata.getString("domain") + "/ota/" + imgnameEd);
} else if(key.getStorageType().equals(9) && key.getSysTransmit()){
imgObj.setImgurl(confdata.getString("domain") + "/w/" + shortUuid_y);
}else {
imgObj.setImgurl(key.getRequestAddress() + "/" + imgnameEd);
}
imgObj.setSizes(Long.toString(file.length()));
@@ -48,8 +48,6 @@ public class WebDAVImageupload {
private static Logger logger = LoggerFactory.getLogger(WebDAVImageupload.class);
public ReturnImage ImageuploadWebDAV(Map<Map<String, String>, File> fileMap, String username,Integer keyID) {
ReturnImage returnImage = new ReturnImage();
CloseableHttpClient httpClient =null;
Keys key = null;
try {
if(null==httpClient || null==key){
System.out.println("WebDAV = 存储源对象为空");
@@ -100,29 +98,29 @@ public class WebDAVImageupload {
//webdav初始化
public static Integer Initialize(Keys k) {
int ret = -1;
if(k.getSysTransmit()==false){
if (StringUtils.isBlank(k.getAccessKey())
|| StringUtils.isBlank(k.getAccessSecret())
|| StringUtils.isBlank(k.getEndpoint())
|| StringUtils.isBlank(k.getRequestAddress())) {
return -1;
}
}else{
if (StringUtils.isBlank(k.getAccessKey())
|| StringUtils.isBlank(k.getAccessSecret())
|| StringUtils.isBlank(k.getEndpoint())) {
return -1;
}
}
String endpoint = k.getEndpoint();
CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
credentialsProvider.setCredentials(
new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT),
new UsernamePasswordCredentials(k.getAccessKey(), k.getAccessSecret()));
CloseableHttpClient httpClientObj = HttpClients.custom()
.setDefaultCredentialsProvider(credentialsProvider)
.build();
try {
if(k.getSysTransmit()==false){
if (StringUtils.isBlank(k.getAccessKey())
|| StringUtils.isBlank(k.getAccessSecret())
|| StringUtils.isBlank(k.getEndpoint())
|| StringUtils.isBlank(k.getRequestAddress())) {
return -1;
}
}else{
if (StringUtils.isBlank(k.getAccessKey())
|| StringUtils.isBlank(k.getAccessSecret())
|| StringUtils.isBlank(k.getEndpoint())) {
return -1;
}
}
String endpoint = k.getEndpoint();
CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
credentialsProvider.setCredentials(
new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT),
new UsernamePasswordCredentials(k.getAccessKey(), k.getAccessSecret()));
CloseableHttpClient httpClientObj = HttpClients.custom()
.setDefaultCredentialsProvider(credentialsProvider)
.build();
HttpUriRequest request = RequestBuilder.create("PROPFIND")
.setUri(endpoint +"/"+ k.getRootPath())
.addHeader("Depth", "1")
@@ -26,6 +26,7 @@ public class deleImages {
@Autowired private USSImageupload ussImageupload;
@Autowired private S3Imageupload s3Imageupload;
@Autowired private FtpServiceImpl ftpService;
@Autowired private WebDAVImageupload webDAVImageupload;
@Autowired private ImgAndAlbumService imgAndAlbumService;
@Autowired private ImgTempService imgTempService;
@Autowired private ImgService imgService;
@@ -75,6 +76,8 @@ public class deleImages {
isDele = ftpService.delFTP(key.getId(), image);
} else if (key.getStorageType() == 8) {
isDele = s3Imageupload.deleS3(key.getId(), image);
}else if (key.getStorageType() == 9) {
isDele = webDAVImageupload.delWebDAV(key.getId(), image);
} else {
System.err.println("未获取到对象存储参数,删除失败。");
}
@@ -149,6 +152,8 @@ public class deleImages {
ftpService.delFTP(key.getId(), image);
} else if (key.getStorageType() == 8) {
s3Imageupload.deleS3(key.getId(), image);
}else if (key.getStorageType() == 9) {
webDAVImageupload.delWebDAV(key.getId(), image);
} else {
System.err.println("未获取到对象存储参数,删除失败。");
}
@@ -1,29 +1,51 @@
package cn.hellohao.utils;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;
import java.io.IOException;
import java.util.Base64;
/**
* Created by Hellohao on 2019-08-27.
*/
public class Base64Encryption {
public static void toBaseCode(String str) {
String data = encryptBASE64(str.getBytes());
}
public static String decryptBASE64(String key) {
byte[] b =null;
try {
b = (new BASE64Decoder()).decodeBuffer(key);
} catch (IOException e) {
e.printStackTrace();
}
return new String(b);
}
public static String encryptBASE64(byte[] key) {
String string = "SGVsbG9oYW8K";
return (new BASE64Encoder()).encodeBuffer(key).replaceAll("\r|\n", "");
}
}
//package cn.hellohao.utils;
//
//import java.io.IOException;
//import java.util.Base64;
//
///**
// * Created by Hellohao on 2019-08-27.
// */
//public class Base64Encryption {
//// public static void toBaseCode(String str) {
//// String data = encryptBASE64(str.getBytes());
//// }
//// public static String decryptBASE64(String key) {
//// byte[] b =null;
//// try {
//// b = (new BASE64Decoder()).decodeBuffer(key);
//// } catch (IOException e) {
//// e.printStackTrace();
//// }
//// return new String(b);
//// }
//// public static String encryptBASE64(byte[] key) {
//// String string = "SGVsbG9oYW8K";
//// return (new BASE64Encoder()).encodeBuffer(key).replaceAll("\r|\n", "");
//// }
//
//
// public static void toBaseCode(String str) {
// String data = encryptBASE64(str.getBytes());
// }
//
// public static String decryptBASE64(String key) {
// byte[] b = null;
// try {
// b = Base64.getDecoder().decode(key);
// } catch (IllegalArgumentException e) {
// e.printStackTrace();
// }
// return new String(b);
// }
//
// public static String encryptBASE64(byte[] key) {
// String string = "SGVsbG9oYW8K";
// return Base64.getEncoder().encodeToString(key);
// }
//
//
//
//
//
//}
@@ -1,9 +1,9 @@
package cn.hellohao.utils;
import org.springframework.web.multipart.MultipartFile;
import sun.misc.BASE64Decoder;
import java.io.*;
import java.util.Base64;
/**
* base64转为multipartFile工具类
@@ -74,21 +74,30 @@ public class Base64ToMultipartFile implements MultipartFile {
* @return
*/
public static MultipartFile base64Convert(String base64) {
String[] baseStrs = base64.split(",");
// String[] baseStrs = base64.split(",");
// BASE64Decoder decoder = new BASE64Decoder();
// byte[] b = new byte[0];
// try {
// b = decoder.decodeBuffer(baseStrs[1]);
// } catch (IOException e) {
// e.printStackTrace();
// }
// for (int i = 0; i < b.length; ++i) {
// if (b[i] < 0) {
// b[i] += 256;
// }
// }
// return new Base64ToMultipartFile (b, baseStrs[0]);
BASE64Decoder decoder = new BASE64Decoder();
byte[] b = new byte[0];
try {
b = decoder.decodeBuffer(baseStrs[1]);
} catch (IOException e) {
e.printStackTrace();
}
String[] baseStrs = base64.split(",");
byte[] b = Base64.getDecoder().decode(baseStrs[1]);
for (int i = 0; i < b.length; ++i) {
if (b[i] < 0) {
b[i] += 256;
}
}
return new Base64ToMultipartFile (b, baseStrs[0]);
return new Base64ToMultipartFile(b, baseStrs[0]);
}
@@ -31,7 +31,8 @@ public class GetSource {
FtpServiceImpl ftpService;
@Autowired
S3Imageupload s3Imageupload;
@Autowired
WebDAVImageupload webDAVImageupload;
public ReturnImage storageSource(Integer type, Map<Map<String, String>, File> fileMap, String userpath,Integer keyID){
ReturnImage returnImage = null;
try {
@@ -52,7 +53,7 @@ public class GetSource {
}else if(type==8){
returnImage = s3Imageupload.ImageuploadS3(fileMap, userpath,keyID);
}else if(type==9){
returnImage = s3Imageupload.ImageuploadS3(fileMap, userpath,keyID);
returnImage = webDAVImageupload.ImageuploadWebDAV(fileMap, userpath,keyID);
}
else{
new StorageSourceInitException("GetSource类捕捉异常:未找到存储源");
+2 -2
View File
@@ -41,10 +41,10 @@
<where>
1=1
<if test="albumkey != null">
and `albumkey` like '%${albumkey}%'
and `albumkey` like CONCAT('%', #{albumkey}, '%')
</if>
<if test="username != null">
and `username` like '%${username}%'
and `username` like CONCAT('%', #{username}, '%')
</if>
<if test="userid != null">
and a.userid = #{userid}
+4 -4
View File
@@ -53,11 +53,11 @@
<choose>
<when test="selecttype==1">
and
a.userid in ( SELECT id from `user` where username LIKE '%${username}%')
a.userid in ( SELECT id from `user` where username LIKE CONCAT('%', #{username}, '%'))
</when>
<otherwise>
and
a.userid not in ( SELECT id from `user` where username LIKE '%${username}%')
a.userid not in ( SELECT id from `user` where username LIKE CONCAT('%', #{username}, '%'))
</otherwise>
</choose>
</if>
@@ -71,10 +71,10 @@
and CONCAT(
imgurl,
idname
) LIKE '%${searchname}%'
) LIKE CONCAT('%', #{searchname}, '%')
</if>
<if test="idname != null and idname !=''">
and idname LIKE '%${idname}%'
and idname LIKE CONCAT('%', #{idname}, '%')
</if>
order by
<choose>
+1 -1
View File
@@ -213,7 +213,7 @@
and CONCAT(
username,
email
) LIKE '%${username}%'
) LIKE CONCAT('%', #{username}, '%')
</if>
order by birthder desc
</select>