xss修改、栏目文章缓存添加

pom.xml

@@ -291,6 +291,36 @@
                     <skipTests>true</skipTests>
                 </configuration>
             </plugin>
+
+            <!-- 加密插件，防止反编译 -->
+            <plugin>
+                <!-- https://gitee.com/roseboy/classfinal -->
+                <groupId>net.roseboy</groupId>
+                <artifactId>classfinal-maven-plugin</artifactId>
+                <version>1.2.1</version>
+                <configuration>
+                    <!--加密密码，如果是#号，则使用无密码模式加密，【加密后没有pom文件，不用担心泄漏】-->
+                    <password>#</password>
+                    <!--加密的包名(可为空,多个用","分割)-->
+                    <packages>com.huoran.iasf</packages>
+                    <!--需要加密的配置文件，一般是classes目录下的yml或properties文件(可为空,多个用","分割)-->
+                    <cfgfiles>*.properties,*.yml</cfgfiles>
+                    <excludes>org.spring</excludes>
+                    <!--外部依赖的jar目录，例如/tomcat/lib(可为空,多个用","分割)-->
+                    <!--<classpath></classpath>-->
+                    <!--运行命令： java -javaagent:iasf-encrypted.jar -jar iasf-encrypted.jar-->
+                    <!--机器码获取命令：java -jar classfinal-fatjar-1.2.1.jar -C -->
+                    <code>FDDEF78DF2FC3D09D733CBEAB15C3AEFD41D8CD98F00B204E9800998ECF8427ED41D8CD98F00B204E9800998ECF8427E</code>
+                </configuration>
+                <executions>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>classFinal</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
 
         <resources>

src/main/java/com/huoran/iasf/common/filter/XssHttpServletRequestWrapper.java

@@ -146,11 +146,19 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
     public ServletInputStream getInputStream() throws IOException {
         // 非文件上传进行过滤
         if (!fileUpload) {
-            // 获取body中的请求参数
+
-            JSONObject json = JSONObject.parseObject(new String(body));
+            try {
-            // 校验并过滤xss攻击和sql注入
+                // 解析请求体为字符串
-            for (String k : json.keySet()) {
+                String bodyStr = new String(body, StandardCharsets.UTF_8);
-                cleanSQLInject(cleanXSS(json.getString(k)));
+
+                // 清理HTML，只允许安全的元素和属性
+                Safelist safelist = Safelist.basicWithImages(); // 自定义safelist
+                String safeHtml = Jsoup.clean(bodyStr, "", safelist, new Document.OutputSettings().prettyPrint(false));
+                cleanSQLInject(safeHtml);
+
+            } catch (Exception e) {
+                // 处理解析或处理过程中的任何异常
+                log.error("Error processing request body {}",  e.getMessage());
             }
         }
         // 将请求体参数流转 -- 流读取一次就会消失,所以我们事先读取之后就存在byte数组里边方便流转

src/main/java/com/huoran/iasf/common/shiro/ShiroConfig.java

@@ -148,7 +148,7 @@ public class ShiroConfig {
         filterChainDefinitionMap.put("/sysContent/queryArticleColumnParent", "anon");
 
         /*filterChainDefinitionMap.put("/index/**", "anon");
-        filterChainDefinitionMap.put("/doc.html", "anon");
+        filterChainDefinitionMap.put("/iasf/doc.html", "anon");
         filterChainDefinitionMap.put("/swagger-resources/**", "anon");
         filterChainDefinitionMap.put("/v2/api-docs", "anon");
         filterChainDefinitionMap.put("/v2/api-docs-ext", "anon");
@@ -156,7 +156,7 @@ public class ShiroConfig {
         filterChainDefinitionMap.put("/static/**", "anon");
         filterChainDefinitionMap.put("/webjars/**", "anon");
         filterChainDefinitionMap.put("/druid/**", "anon");
-        filterChainDefinitionMap.put("/favicon.ico", "anon");
+        filterChainDefinitionMap.put("/iasf/favicon.ico", "anon");
         filterChainDefinitionMap.put("/captcha.jpg", "anon");
         filterChainDefinitionMap.put("/csrf", "anon");
         //文件上传可直接访问

src/main/java/com/huoran/iasf/common/utils/R.java

@@ -5,6 +5,8 @@ import com.huoran.iasf.common.exception.code.ResponseCodeInterface;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
+
 /**
  * 返回值R
  *
@@ -13,7 +15,9 @@ import lombok.Data;
  * @date 2022年7月28日
  */
 @Data
-public class R {
+public class R implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
 
     /**
      * 请求响应code，0为成功 其他为失败

src/main/java/com/huoran/iasf/controller/SysColumnController.java

@@ -19,6 +19,8 @@ import com.huoran.iasf.common.utils.R;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.util.StringUtils;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
@@ -108,7 +110,7 @@ public class SysColumnController {
         return R.success(sysColumn);
     }
 
-    @NoRepeatSubmit
+//    @NoRepeatSubmit
     @PostMapping("/save")
     @ApiOperation(value = "新增", response = SysColumn.class)
     @RequiresPermissions("sys:column:save")
@@ -126,6 +128,7 @@ public class SysColumnController {
     @RequiresPermissions("sys:column:update")
     public R update(@RequestBody SysColumn sysColumn) {
         boolean updateState = service.updateById(sysColumn);
+        service.removeArticles(sysColumn.getId());
         return updateState ? R.success() : R.fail("编辑失败");
     }
 
@@ -184,13 +187,15 @@ public class SysColumnController {
             //删除栏目后删除栏目下的文章
             sysColumnLongPageService.remove(queryWrapper1);
             ret = service.removeByIds(idList);
+            for (Integer columnId : idList) {
+                service.removeArticles(columnId);
+            }
         }
 
 
         return R.success();
     }
 
-
     @PostMapping("/sameLevelJudgment")
     @Decrypt
     @ApiOperation(value = "同级判重", response = ColumnWeightReqVO.class)
@@ -249,7 +254,7 @@ public class SysColumnController {
 
     }
 
-
+    @Cacheable(value = "articles", key = "#id")
     public String getIds(Integer id) {
         //1 创建list集合，用于封装所有删除菜单id值
         List<Integer> idList = new ArrayList<>();

src/main/java/com/huoran/iasf/controller/SysContentController.java

@@ -141,7 +141,7 @@ public class SysContentController {
         }
         sysContent.setSequence(count + 1);*/
         boolean addState = service.save(sysContent);
-
+        columnService.removeArticles(sysContent.getColumnId());
 
         return addState ? R.success(sysContent.getId()) : R.fail("新增失败");
     }
@@ -152,6 +152,7 @@ public class SysContentController {
     @ApiOperation(value = "修改", response = SysContent.class)
     public R update(@RequestBody @ApiParam(name = "文章管理对象", value = "传入json格式", required = true) SysContent sysContent) {
         boolean updateState = service.updateById(sysContent);
+        columnService.removeArticles(sysContent.getColumnId());
         return updateState ? R.success() : R.fail("编辑失败");
     }
 
@@ -166,6 +167,8 @@ public class SysContentController {
         queryWrapper.eq("quote_type", 0);
         queryWrapper.set("is_del", 1);
         sysFilesService.update(queryWrapper);
+        SysContent sysContent = service.getById(id);
+        columnService.removeArticles(sysContent.getColumnId());
         boolean delState = service.removeById(id);
         return delState ? R.success() : R.fail("删除失败");
     }
@@ -176,6 +179,8 @@ public class SysContentController {
     @ApiOperation(value = "批量删除文章", response = SysContent.class)
     public R batchDeletion(@ApiParam(name = "ids", value = "主键", required = true) @RequestBody List<Integer> ids) {
         for (Integer id : ids) {
+            SysContent sysContent = service.getById(id);
+            columnService.removeArticles(sysContent.getColumnId());
             UpdateWrapper<SysFilesEntity> queryWrapper = new UpdateWrapper<>();
             queryWrapper.eq("quote_id", id);
             queryWrapper.eq("quote_type", 0);

src/main/java/com/huoran/iasf/controller/SysContentFileController.java

@@ -48,7 +48,7 @@ public class SysContentFileController {
         return R.success(sysContentFile);
     }
 
-    @NoRepeatSubmit
+//    @NoRepeatSubmit
     @PostMapping("/save")
     @ApiOperation(value = "新增", response = SysContentFile.class)
     public R save(@RequestBody  @ApiParam(name = "文章附件管理表对象", value = "传入json格式", required = true) SysContentFile sysContentFile) {
@@ -64,7 +64,7 @@ public class SysContentFileController {
         return updateState ? R.success() : R.fail("编辑失败");
     }
 
-    @NoRepeatSubmit
+//    @NoRepeatSubmit
     @PostMapping("/delete")
     @ApiOperation(value = "删除", response = SysContentFile.class)
     public R delete(@ApiParam(name = "id", value = "主键", required = true) @RequestParam Integer id) {

src/main/java/com/huoran/iasf/controller/SysFilesController.java

@@ -75,7 +75,7 @@ public class SysFilesController {
         result.put("imageFieldName", "file");
         return result.toJSONString();
     }
-    @NoRepeatSubmit
+//    @NoRepeatSubmit
     @ApiOperation(value = "新增")
     @PostMapping("/upload")
 //    @RequiresPermissions(value = {"sysFiles:add", "sysContent:update", "sysContent:add"}, logical = Logical.OR)
@@ -119,7 +119,7 @@ public class SysFilesController {
     public void preview(@PathVariable String id, HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
         sysFilesService.preview(id, req, res);
     }
-    @NoRepeatSubmit
+//    @NoRepeatSubmit
     @ApiOperation(value = "文件下载")
     @GetMapping("/download/{id}")
     public void download(@PathVariable String id, HttpServletRequest req, HttpServletResponse res) {

src/main/java/com/huoran/iasf/service/SysColumnService.java

@@ -7,6 +7,7 @@ import com.huoran.iasf.vo.req.ColumnWeightReqVO;
 import com.huoran.iasf.vo.req.LongPageColumnReqVO;
 import com.huoran.iasf.vo.req.PageContentReqVO;
 import com.huoran.iasf.vo.req.PaginationColumnReqVO;
+import org.springframework.cache.annotation.CacheEvict;
 
 import java.util.List;
 
@@ -31,7 +32,7 @@ public interface SysColumnService extends IService<SysColumn> {
 
 
     R getsTheSubColumn(Integer parentId,String ids,Integer siteId);
-
+    void removeArticles(Integer columnId);
 
     R getsSublevelColumnsUnderALevel(Integer parentId,String ids,Integer siteId);
 

src/main/java/com/huoran/iasf/service/impl/SysColumnServiceImpl.java

@@ -18,6 +18,8 @@ import com.huoran.iasf.vo.req.PageContentReqVO;
 import com.huoran.iasf.vo.req.PaginationColumnReqVO;
 import com.huoran.iasf.vo.resp.PageContentRespVO;
 import org.springframework.beans.BeanUtils;
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.stereotype.Service;
 import org.springframework.beans.factory.annotation.Autowired;
 
@@ -154,6 +156,12 @@ public class SysColumnServiceImpl extends ServiceImpl<SysColumnMapper, SysColumn
         return R.success(pageList);
     }
 
+    @Override
+    @CacheEvict(value = "articles", key = "#id")
+    public void removeArticles(Integer id) {
+
+    }
+
     @Override
     public R getsTheSubColumn(Integer pid, String ids,Integer siteId) {
 
@@ -182,6 +190,7 @@ public class SysColumnServiceImpl extends ServiceImpl<SysColumnMapper, SysColumn
     }
 
     @Override
+    @Cacheable(value = "articles", key = "#id")
     public R queryArticlesByColumnType(String ids, Integer id) {
 
         Integer count = 0;

src/main/java/com/huoran/iasf/service/impl/SysFilesServiceImpl.java

@@ -21,6 +21,8 @@ import com.huoran.iasf.vo.req.FileParameters;
 import org.apache.commons.io.FileUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Service;
 import org.springframework.web.context.request.RequestContextHolder;
@@ -193,6 +195,8 @@ public class SysFilesServiceImpl extends ServiceImpl<SysFilesMapper, SysFilesEnt
 
 
     @Override
+    // 缓存预览结果，使用id作为缓存键
+    @Cacheable(value = "preview", key = "#id")
     public void preview(String id, HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
         if (id != null) {
             SysFilesEntity entity = this.getById(id);
@@ -210,6 +214,9 @@ public class SysFilesServiceImpl extends ServiceImpl<SysFilesMapper, SysFilesEnt
                     //判断类型，根据不同的类型文件来处理对应的数据
                     res.setContentType(mimeType);
                     res.addHeader("Content-Length", "" + file.length());
+                    res.setHeader("Cache-Control", "public, max-age=31536000");
+                    res.setDateHeader("Expires", System.currentTimeMillis() + 31536000000L);
+
                 }
                 //转换视频流部分
                 req.setAttribute(NonStaticResourceHttpRequestConfig.ATTR_FILE, filePath);
@@ -293,9 +300,15 @@ public class SysFilesServiceImpl extends ServiceImpl<SysFilesMapper, SysFilesEnt
             if (file.exists()) {
                 file.delete();
             }
+            removePreview(entity.getId());
         });
         this.removeByIds(ids);
 
+    }
+    // 删除预览结果的缓存，同样使用id作为键
+    @CacheEvict(value = "preview", key = "#id")
+    public void removePreview(String id) {
+
     }
 
     /**

src/main/java/com/huoran/iasf/vo/resp/DeptRespNodeVO.java

@@ -3,6 +3,7 @@ package com.huoran.iasf.vo.resp;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
 import java.util.List;
 
 /**
@@ -13,7 +14,9 @@ import java.util.List;
  * @date 2022年7月28日
  */
 @Data
-public class DeptRespNodeVO {
+public class DeptRespNodeVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
     @ApiModelProperty(value = "组织id")
     private Integer id;
 

src/main/java/com/huoran/iasf/vo/resp/HomeRespVO.java

@@ -3,6 +3,7 @@ package com.huoran.iasf.vo.resp;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
 import java.util.List;
 
 /**
@@ -13,7 +14,9 @@ import java.util.List;
  * @date 2022年7月28日
  */
 @Data
-public class HomeRespVO {
+public class HomeRespVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
     @ApiModelProperty(value = "用户信息")
     private UserInfoRespVO userInfo;
     @ApiModelProperty(value = "目录菜单")

src/main/java/com/huoran/iasf/vo/resp/LoginRespVO.java

@@ -4,6 +4,7 @@ import com.huoran.iasf.entity.SysPermission;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
 import java.util.List;
 
 /**
@@ -14,7 +15,9 @@ import java.util.List;
  * @date 2022年7月28日
  */
 @Data
-public class LoginRespVO {
+public class LoginRespVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
     @ApiModelProperty(value = "token")
     private String accessToken;
     @ApiModelProperty(value = "用户名")

src/main/java/com/huoran/iasf/vo/resp/PageContentRespVO.java

@@ -7,6 +7,7 @@ import com.huoran.iasf.vo.FatherContentRespVO;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
 import java.util.Date;
 import java.util.List;
 
@@ -16,7 +17,9 @@ import java.util.List;
  * @日期: 2022-08-05
  */
 @Data
-public class PageContentRespVO {
+public class PageContentRespVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
 
 
     @TableId(type = IdType.AUTO)

src/main/java/com/huoran/iasf/vo/resp/PermissionRespNode.java

@@ -3,6 +3,7 @@ package com.huoran.iasf.vo.resp;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
 import java.util.List;
 
 /**
@@ -13,7 +14,9 @@ import java.util.List;
  * @date 2022年7月28日
  */
 @Data
-public class PermissionRespNode {
+public class PermissionRespNode implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
     @ApiModelProperty(value = "id")
     private Integer id;
 

src/main/java/com/huoran/iasf/vo/resp/SortColumnRespVO.java

@@ -16,7 +16,9 @@ import java.util.List;
  * @日期: 2022-08-03
  */
 @Data
-public class SortColumnRespVO {
+public class SortColumnRespVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
 
 
     @TableId(type = IdType.AUTO)

src/main/java/com/huoran/iasf/vo/resp/UserInfoRespVO.java

@@ -3,6 +3,8 @@ package com.huoran.iasf.vo.resp;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
+
 /**
  * UserInfoRespVO
  *
@@ -11,7 +13,9 @@ import lombok.Data;
  * @date 2022年7月28日
  */
 @Data
-public class UserInfoRespVO {
+public class UserInfoRespVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
     @ApiModelProperty(value = "用户id")
     private String id;
     @ApiModelProperty(value = "账号")

src/main/java/com/huoran/iasf/vo/resp/UserListResp.java

@@ -6,6 +6,8 @@ import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.experimental.Accessors;
 
+import java.io.Serializable;
+
 /**
  * @Author chen
  * @DATE 2022/8/15 15:34
@@ -15,7 +17,9 @@ import lombok.experimental.Accessors;
 @EqualsAndHashCode(callSuper = false)
 @Accessors(chain = true)
 @ApiModel(value = "UserListResp", description = "用户列表")
-public class UserListResp {
+public class UserListResp implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
 
     @ApiModelProperty(value = "组织架构ID")
     private String deptArchitectureId;

src/main/java/com/huoran/iasf/vo/resp/UserOwnRoleRespVO.java

@@ -4,6 +4,7 @@ import com.huoran.iasf.entity.SysRole;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 
+import java.io.Serializable;
 import java.util.List;
 
 /**
@@ -14,7 +15,9 @@ import java.util.List;
  * @date 2022年7月28日
  */
 @Data
-public class UserOwnRoleRespVO {
+public class UserOwnRoleRespVO implements Serializable {
+    // 类的内容
+    private static final long serialVersionUID = 1L;
     @ApiModelProperty("所有角色集合")
     private List<SysRole> allRole;
     @ApiModelProperty(value = "用户所拥有角色集合")

src/main/resources/application-dev.yml

@@ -37,10 +37,9 @@ file:
   path: C:/files/
   #文件预览url
   url: /iasf/sysFiles/preview/
-#  ip: http://10.10.11.7
+  #本地开启
+#  url: :10000/iasf/sysFiles/preview/
+#  ip: http://192.168.31.51
   ip: https://new.iasf.ac.cn
 knife4j:
-  production: true #生成环境禁用查看文档
+  production: true #生成环境禁用查看文档
-
-  #本地开启
-#  url: :10000/iasf/sysFiles/preview/