test/Jpom
1
0
Fork 0
mirror of https://gitee.com/dromara/Jpom.git synced 2024-12-10 07:48:06 +08:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

新增白名单目录

Browse Source
This commit is contained in:
jiangzeyin 2019-02-28 22:57:29 +08:00
parent fa9a05ece4
commit 16cd73db8c
25 changed files with 255 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/run.sh
View File

@ -9,7 +9,7 @@ Log="${Path}run.log"
LogBack="${Path}log/"
JVM="-server "
# 修改项目端口号 日志路径
ARGS="--server.port=2122 --jpom.path=${Path} --jpom.log=${Path}log --jpom.showDemo=false"
ARGS="--server.port=2122 --jpom.path=${Path} --jpom.log=${Path}log --jpom.safeMode=false"
echo ${Tag}
RETVAL="0"

9
src/main/java/cn/keepbx/jpom/service/BaseDataService.java → src/main/java/cn/keepbx/jpom/common/BaseDataService.java
View File

@ -1,8 +1,9 @@
package cn.keepbx.jpom.service;
package cn.keepbx.jpom.common;
import cn.hutool.core.io.FileUtil;
import cn.keepbx.jpom.system.ConfigBean;
import cn.keepbx.jpom.util.JsonUtil;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import java.io.IOException;
@ -21,7 +22,7 @@ public abstract class BaseDataService {
* @param filename 文件名
* @return path
*/
private String getDataFilePath(String filename) {
protected String getDataFilePath(String filename) {
return FileUtil.normalize(ConfigBean.getInstance().getDataPath() + "/" + filename);
}
@ -110,4 +111,8 @@ public abstract class BaseDataService {
protected JSONObject getJsonObject(String filename) throws IOException {
return (JSONObject) JsonUtil.readJson(getDataFilePath(filename));
}
protected JSONArray getJSONArray(String filename) throws IOException {
return (JSONArray) JsonUtil.readJson(getDataFilePath(filename));
}
}

3
src/main/java/cn/keepbx/jpom/controller/IndexControl.java
View File

@ -1,14 +1,11 @@
package cn.keepbx.jpom.controller;
import cn.keepbx.jpom.common.interceptor.NotLogin;
import cn.keepbx.jpom.service.UserService;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import javax.annotation.Resource;
/**
* 首页
*

2
src/main/java/cn/keepbx/jpom/controller/InstallController.java
View File

@ -6,7 +6,7 @@ import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.common.interceptor.LoginInterceptor;
import cn.keepbx.jpom.common.interceptor.NotLogin;
import cn.keepbx.jpom.model.UserModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

2
src/main/java/cn/keepbx/jpom/controller/LoginControl.java
View File

@ -5,7 +5,7 @@ import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.common.interceptor.LoginInterceptor;
import cn.keepbx.jpom.common.interceptor.NotLogin;
import cn.keepbx.jpom.model.UserModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Controller;

2
src/main/java/cn/keepbx/jpom/controller/manage/BuildController.java
View File

@ -7,7 +7,7 @@ import cn.jiangzeyin.common.DefaultSystemLog;
import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import cn.keepbx.jpom.service.manage.CommandService;
import cn.keepbx.jpom.service.manage.ManageService;
import cn.keepbx.jpom.service.oss.OssManagerService;

2
src/main/java/cn/keepbx/jpom/controller/manage/ConsoleController.java
View File

@ -6,7 +6,7 @@ import cn.jiangzeyin.common.DefaultSystemLog;
import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import cn.keepbx.jpom.service.manage.ManageService;
import com.alibaba.fastjson.JSONObject;
import org.springframework.http.MediaType;

20
src/main/java/cn/keepbx/jpom/controller/manage/EditProjectController.java
View File

@ -7,8 +7,10 @@ import cn.jiangzeyin.common.DefaultSystemLog;
import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.manage.ManageService;
import cn.keepbx.jpom.service.system.SystemService;
import cn.keepbx.jpom.service.user.UserService;
import com.alibaba.fastjson.JSONArray;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
@ -31,6 +33,8 @@ public class EditProjectController extends BaseController {
private ManageService manageService;
@Resource
private UserService userService;
@Resource
private SystemService systemService;
@RequestMapping(value = "editProject", method = RequestMethod.GET)
public String editProject(String id) throws IOException {
@ -67,6 +71,20 @@ public class EditProjectController extends BaseController {
if (lib.contains("../") || log.contains("../")) {
return JsonMessage.getString(401, "项目lib/log存在提升目录问题");
}
JSONArray jsonArray = systemService.getWhitelistDirectory();
if (jsonArray == null) {
return JsonMessage.getString(401, "还没有配置白名单");
}
int errorCount = 0;
for (Object obj : jsonArray) {
String wPath = obj.toString();
if (!lib.startsWith(wPath) && !log.startsWith(wPath)) {
errorCount++;
}
}
if (errorCount == jsonArray.size()) {
return JsonMessage.getString(401, "项目lib/log 必须在白名单目录下");
}
ProjectInfoModel exits = manageService.getProjectInfo(id);
try {
if (exits == null) {

10
src/main/java/cn/keepbx/jpom/controller/manage/FileControl.java
View File

@ -9,8 +9,8 @@ import cn.jiangzeyin.controller.multipart.MultipartFileBuilder;
import cn.keepbx.jpom.common.PageUtil;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.manage.ManageService;
import cn.keepbx.jpom.service.user.UserService;
import cn.keepbx.jpom.system.ConfigBean;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
@ -164,8 +164,8 @@ public class FileControl extends BaseController {
@RequestMapping(value = "clear", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
@ResponseBody
public String clear(String id) {
if (ConfigBean.getInstance().showDemo) {
return JsonMessage.getString(400, "演示项目不能清除文件");
if (ConfigBean.getInstance().safeMode) {
return JsonMessage.getString(400, "安全模式不能清除文件");
}
boolean manager = userService.isManager(id, getUserName());
if (!manager) {
@ -192,8 +192,8 @@ public class FileControl extends BaseController {
@RequestMapping(value = "deleteFile", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
@ResponseBody
public String deleteFile(String id, String filename) {
if (ConfigBean.getInstance().showDemo) {
return JsonMessage.getString(400, "演示项目不能清除文件");
if (ConfigBean.getInstance().safeMode) {
return JsonMessage.getString(400, "安全模式不能清除文件");
}
try {
ProjectInfoModel pim = manageService.getProjectInfo(id);

2
src/main/java/cn/keepbx/jpom/controller/manage/ManageControl.java
View File

@ -6,7 +6,7 @@ import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.common.PageUtil;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import cn.keepbx.jpom.service.manage.CommandService;
import cn.keepbx.jpom.service.manage.ManageService;
import com.alibaba.fastjson.JSONArray;

66
src/main/java/cn/keepbx/jpom/controller/system/WhitelistDirectoryController.java Normal file
View File

@ -0,0 +1,66 @@
package cn.keepbx.jpom.controller.system;
import cn.hutool.core.io.FileUtil;
import cn.hutool.core.text.StrSpliter;
import cn.hutool.core.util.StrUtil;
import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.service.system.SystemService;
import cn.keepbx.jpom.system.ConfigBean;
import com.alibaba.fastjson.JSONArray;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.annotation.Resource;
import java.util.List;
/**
* 白名单目录
*
* @author jiangzeyin
* @date 2019/2/28
*/
@Controller
@RequestMapping(value = "/system")
public class WhitelistDirectoryController extends BaseController {
@Resource
private SystemService systemService;
/**
* 页面
*/
@RequestMapping(value = "whitelistDirectory", method = RequestMethod.GET, produces = MediaType.TEXT_HTML_VALUE)
public String whitelistDirectory() {
setAttribute("value", systemService.getWhitelistDirectoryLine());
return "system/whitelistDirectory";
}
@RequestMapping(value = "whitelistDirectory_submit", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
@ResponseBody
public String whitelistDirectorySubmit(String value) {
if (StrUtil.isEmpty(value)) {
return JsonMessage.getString(401, "白名单不能为空");
}
List<String> list = StrSpliter.splitTrim(value, "\n", false);
if (list == null || list.size() <= 0) {
return JsonMessage.getString(401, "白名单不能为空");
}
if (ConfigBean.getInstance().safeMode) {
return JsonMessage.getString(401, "安全模式下不能修改白名单目录");
}
if (!userName.isManage()) {
return JsonMessage.getString(401, "你没有权限修改白名单目录");
}
JSONArray jsonArray = new JSONArray();
for (String s : list) {
String val = String.format("/%s/", s);
val = FileUtil.normalize(val);
jsonArray.add(val);
}
systemService.saveWhitelistDirectory(jsonArray);
return JsonMessage.getString(200, "保存成功");
}
}

9
src/main/java/cn/keepbx/jpom/controller/user/UserInfoController.java
View File

@ -4,7 +4,7 @@ import cn.hutool.core.util.StrUtil;
import cn.jiangzeyin.common.DefaultSystemLog;
import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import cn.keepbx.jpom.system.ConfigBean;
import com.alibaba.fastjson.JSONArray;
import org.springframework.http.MediaType;
@ -35,8 +35,8 @@ public class UserInfoController extends BaseController {
*/
@RequestMapping(value = "updatePwd", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public String updatePwd(String oldPwd, String newPwd) {
if (ConfigBean.getInstance().showDemo) {
return JsonMessage.getString(401, "演示模式不允许修改自己的密码");
if (ConfigBean.getInstance().safeMode) {
return JsonMessage.getString(401, "安全模式不允许修改自己的密码");
}
try {
String result = userService.updatePwd(userName.getId(), oldPwd, newPwd);
@ -99,6 +99,9 @@ public class UserInfoController extends BaseController {
if (length < 6) {
return JsonMessage.getString(400, "密码长度为6-12位");
}
if ("true".equals(manage) && ConfigBean.getInstance().safeMode) {
return JsonMessage.getString(401, "安全模式不能创建管理员");
}
boolean b = userService.addUser(id, name, password, "true".equals(manage));
if (b) {
return JsonMessage.getString(200, "添加成功");

2
src/main/java/cn/keepbx/jpom/controller/user/UserListController.java
View File

@ -2,7 +2,7 @@ package cn.keepbx.jpom.controller.user;
import cn.jiangzeyin.common.JsonMessage;
import cn.keepbx.jpom.controller.BaseController;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import com.alibaba.fastjson.JSONArray;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Controller;

2
src/main/java/cn/keepbx/jpom/service/manage/ManageService.java
View File

@ -3,7 +3,7 @@ package cn.keepbx.jpom.service.manage;
import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.StrUtil;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.BaseDataService;
import cn.keepbx.jpom.common.BaseDataService;
import cn.keepbx.jpom.system.ConfigBean;
import com.alibaba.fastjson.JSONObject;
import org.springframework.stereotype.Service;

2
src/main/java/cn/keepbx/jpom/service/oss/OssManagerService.java
View File

@ -4,7 +4,7 @@ import cn.hutool.core.date.DateUtil;
import cn.hutool.core.io.FileUtil;
import cn.jiangzeyin.common.spring.SpringUtil;
import cn.keepbx.jpom.system.ConfigBean;
import cn.keepbx.jpom.service.BaseDataService;
import cn.keepbx.jpom.common.BaseDataService;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.aliyun.oss.OSSClient;

47
src/main/java/cn/keepbx/jpom/service/system/SystemService.java Normal file
View File

@ -0,0 +1,47 @@
package cn.keepbx.jpom.service.system;
import cn.hutool.core.collection.CollUtil;
import cn.jiangzeyin.common.DefaultSystemLog;
import cn.keepbx.jpom.common.BaseDataService;
import cn.keepbx.jpom.system.ConfigBean;
import cn.keepbx.jpom.system.init.CheckRunCommand;
import cn.keepbx.jpom.util.JsonUtil;
import com.alibaba.fastjson.JSONArray;
import org.springframework.stereotype.Service;
import java.io.FileNotFoundException;
/**
* @author jiangzeyin
* @date 2019/2/28
*/
@Service
public class SystemService extends BaseDataService {
public JSONArray getWhitelistDirectory() {
try {
return getJSONArray(ConfigBean.WHITELIST_DIRECTORY);
} catch (FileNotFoundException fileNotFoundException) {
CheckRunCommand.repairData();
return getWhitelistDirectory();
} catch (Exception e) {
DefaultSystemLog.ERROR().error(e.getMessage(), e);
}
return null;
}
public String getWhitelistDirectoryLine() {
try {
JSONArray jsonArray = getWhitelistDirectory();
return CollUtil.join(jsonArray, "\r\n");
} catch (Exception e) {
DefaultSystemLog.ERROR().error(e.getMessage(), e);
}
return "";
}
public void saveWhitelistDirectory(JSONArray jsonArray) {
String path = getDataFilePath(ConfigBean.WHITELIST_DIRECTORY);
JsonUtil.saveJson(path, jsonArray);
}
}

3
src/main/java/cn/keepbx/jpom/service/UserService.java → src/main/java/cn/keepbx/jpom/service/user/UserService.java
View File

@ -1,7 +1,8 @@
package cn.keepbx.jpom.service;
package cn.keepbx.jpom.service.user;
import cn.hutool.core.util.StrUtil;
import cn.jiangzeyin.common.DefaultSystemLog;
import cn.keepbx.jpom.common.BaseDataService;
import cn.keepbx.jpom.model.UserModel;
import cn.keepbx.jpom.system.ConfigBean;
import cn.keepbx.jpom.system.init.CheckRunCommand;

2
src/main/java/cn/keepbx/jpom/socket/LogWebSocketHandle.java
View File

@ -5,7 +5,7 @@ import cn.jiangzeyin.common.JsonMessage;
import cn.jiangzeyin.common.spring.SpringUtil;
import cn.jiangzeyin.pool.ThreadPoolService;
import cn.keepbx.jpom.model.ProjectInfoModel;
import cn.keepbx.jpom.service.UserService;
import cn.keepbx.jpom.service.user.UserService;
import cn.keepbx.jpom.service.manage.CommandService;
import cn.keepbx.jpom.service.manage.ManageService;
import cn.keepbx.jpom.socket.top.TopManager;

7
src/main/java/cn/keepbx/jpom/system/ConfigBean.java
View File

@ -27,6 +27,7 @@ public class ConfigBean {
public static final String USER = "user.json";
public static final String PROJECT = "project.json";
public static final String WHITELIST_DIRECTORY = "whitelistDirectory.json";
public static ConfigBean getInstance() {
@ -37,10 +38,10 @@ public class ConfigBean {
}
/**
* 标记是否为演示模式
* 标记是否为安全模式
*/
@Value("${jpom.showDemo:false}")
public boolean showDemo;
@Value("${jpom.safeMode:false}")
public boolean safeMode;
/**
* 项目运行存储路径

6
src/main/java/cn/keepbx/jpom/system/init/CheckRunCommand.java
View File

@ -65,6 +65,12 @@ public class CheckRunCommand {
DefaultSystemLog.LOG().info("创建默认文件：" + file.getPath());
addDataFile(ConfigBean.PROJECT, file.getPath());
}
file = new File(ConfigBean.getInstance().getDataPath(), ConfigBean.WHITELIST_DIRECTORY);
if (!file.exists()) {
DefaultSystemLog.LOG().info("创建默认文件：" + file.getPath());
addDataFile(ConfigBean.WHITELIST_DIRECTORY, file.getPath());
}
WebAopLog webAopLog = SpringUtil.getBean(WebAopLog.class);
String logPath = SpringUtil.getEnvironment().getProperty("jpom.log");
DefaultSystemLog.LOG().info("日志存储路径：" + webAopLog.getPropertyValue() + " -》 " + logPath);

4
src/main/resources/META-INF/spring-configuration-metadata.json
View File

@ -13,9 +13,9 @@
"defaultValue": "/jpom/"
},
{
"name": "jpom.showDemo",
"name": "jpom.safeMode",
"type": "java.lang.Boolean",
"description": "是否以演示模式运行，演示模式不允许修改自己的秘密",
"description": "是否以安全模式运行，安全模式不允许修改自己的密码等限制",
"defaultValue": false
}
]

2
src/main/resources/application.yml
View File

@ -27,7 +27,7 @@ jpom:
path: /jpom/
log: /jpom/log/
# 演示模式
showDemo: false
safeMode: false
# 静态资源配置
interceptor:
resourceHandler: /static/**

3
src/main/resources/bin/data/whitelistDirectory.json Normal file
View File

@ -0,0 +1,3 @@
[
"/jpom-project/"
]

4
src/main/resources/vm/index.vm
View File

@ -37,6 +37,10 @@
<li class="layui-nav-item">
<a href="javascript:;" data-options="{'id':'user', 'title':'用户管理', 'url':'/user/list'}">用户管理</a>
</li>
<li class="layui-nav-item">
<a href="javascript:;"
data-options="{'id':'whitelistDirectory', 'title':'白名单目录', 'url':'/system/whitelistDirectory'}">白名单目录</a>
</li>
</ul>
</div>
</div>

73
src/main/resources/vm/system/whitelistDirectory.vm Normal file
View File

@ -0,0 +1,73 @@
<!DOCTYPE html>
<html>
<head>
#parse("./common/head.vm")
<title>白名单目录</title>
<style>
.div {
margin-top: 20px;
}
</style>
</head>
<body>
<div class="layui-container div">
<form action="" class="layui-form" id="form_user">
<div class="layui-form-item">
<div class="layui-inline">
<label class="layui-form-label">昵称</label>
<div class="layui-input-block">
<textarea name="value" placeholder="请输入内容" class="layui-textarea">$!value</textarea>
</div>
</div>
</div>
<div class="layui-form-item">
<div class="layui-input-block">
<button class="layui-btn" lay-submit lay-filter="formDemo">立即提交</button>
</div>
</div>
</form>
</div>
</body>
<script type="text/javascript">
layui.use(['form', 'carousel', 'layer'], function () {
var $ = layui.$;
var form = layui.form;
var carousel = layui.carousel;
var layer = layui.layer;
carousel.render({
elem: '#div-carousel',
width: '100%',
height: '100%',
anim: 'fade',
arrow: 'none',
indicator: 'none'
});
form.on('submit(formDemo)', function (data) {
$.ajax({
url: './whitelistDirectory_submit',
type: 'POST',
dataType: 'json',
data: data.field,
success: function (data) {
layer.msg(data.msg);
if (200 == data.code) {
setTimeout(function () {
window.location.reload()
}, 2000);
}
},
error: function (err) {
layer.alert(err.msg);
}
});
return false;
});
});
</script>
</html>