diff --git a/blog-api/src/main/java/com/shimh/config/WebMvcConfig.java b/blog-api/src/main/java/com/shimh/config/WebMvcConfig.java index a619e328..a8702e13 100644 --- a/blog-api/src/main/java/com/shimh/config/WebMvcConfig.java +++ b/blog-api/src/main/java/com/shimh/config/WebMvcConfig.java @@ -46,7 +46,7 @@ public void configureMessageConverters(List> converters) ); - List fastMediaTypes = new ArrayList<>(); + List fastMediaTypes = new ArrayList(); fastMediaTypes.add(MediaType.APPLICATION_JSON_UTF8); fastConverter.setFastJsonConfig(fastJsonConfig); diff --git a/blog-api/src/main/java/com/shimh/controller/ArticleController.java b/blog-api/src/main/java/com/shimh/controller/ArticleController.java index b74235d9..2bfd4038 100644 --- a/blog-api/src/main/java/com/shimh/controller/ArticleController.java +++ b/blog-api/src/main/java/com/shimh/controller/ArticleController.java @@ -173,11 +173,15 @@ public Result updateArticle(@RequestBody Article article) { Result r = new Result(); if (null == article.getId()) { - r.setResultCode(ResultCode.USER_NOT_EXIST); + r.setResultCode(ResultCode.PARAM_IS_BLANK); return r; } Integer articleId = articleService.updateArticle(article); + if (null == articleId) { + r.setResultCode(ResultCode.RESULE_DATA_NONE); + return r; + } r.setResultCode(ResultCode.SUCCESS); r.simple().put("articleId", articleId); diff --git a/blog-api/src/main/java/com/shimh/controller/CategoryController.java b/blog-api/src/main/java/com/shimh/controller/CategoryController.java index c1296341..260e1aac 100644 --- a/blog-api/src/main/java/com/shimh/controller/CategoryController.java +++ b/blog-api/src/main/java/com/shimh/controller/CategoryController.java @@ -107,11 +107,15 @@ public Result updateCategory(@RequestBody Category category) { Result r = new Result(); if (null == category.getId()) { - r.setResultCode(ResultCode.USER_NOT_EXIST); + r.setResultCode(ResultCode.PARAM_IS_BLANK); return r; } Integer categoryId = categoryService.updateCategory(category); + if (null == categoryId) { + r.setResultCode(ResultCode.RESULE_DATA_NONE); + return r; + } r.setResultCode(ResultCode.SUCCESS); r.simple().put("categoryId", categoryId); diff --git a/blog-api/src/main/java/com/shimh/controller/CommentController.java b/blog-api/src/main/java/com/shimh/controller/CommentController.java index 46e97d0a..1e1e4898 100644 --- a/blog-api/src/main/java/com/shimh/controller/CommentController.java +++ b/blog-api/src/main/java/com/shimh/controller/CommentController.java @@ -131,6 +131,9 @@ public Result deleteCommentById(@PathVariable("id") Integer id) { public Result saveCommentAndChangeCounts(@RequestBody Comment comment) { Comment savedComment = commentService.saveCommentAndChangeCounts(comment); + if (null == savedComment) { + return Result.error(ResultCode.PARAM_IS_INVALID); + } Result r = Result.success(savedComment); return r; diff --git a/blog-api/src/main/java/com/shimh/controller/TagController.java b/blog-api/src/main/java/com/shimh/controller/TagController.java index 6195cb5b..a20e004c 100644 --- a/blog-api/src/main/java/com/shimh/controller/TagController.java +++ b/blog-api/src/main/java/com/shimh/controller/TagController.java @@ -46,10 +46,10 @@ public Result listTags() { @GetMapping("detail") @LogAnnotation(module = "标签", operation = "获取所有标签，详细") - public Result listCategorysDetail() { - List categorys = tagService.findAllDetail(); + public Result listTagsDetail() { + List tags = tagService.findAllDetail(); - return Result.success(categorys); + return Result.success(tags); } @GetMapping("/hot") @@ -116,11 +116,15 @@ public Result updateTag(@RequestBody Tag tag) { Result r = new Result(); if (null == tag.getId()) { - r.setResultCode(ResultCode.USER_NOT_EXIST); + r.setResultCode(ResultCode.PARAM_IS_BLANK); return r; } Integer tagId = tagService.updateTag(tag); + if (null == tagId) { + r.setResultCode(ResultCode.RESULE_DATA_NONE); + return r; + } r.setResultCode(ResultCode.SUCCESS); r.simple().put("tagId", tagId); diff --git a/blog-api/src/main/java/com/shimh/controller/UploadController.java b/blog-api/src/main/java/com/shimh/controller/UploadController.java index 3256e7fd..4c1924d7 100644 --- a/blog-api/src/main/java/com/shimh/controller/UploadController.java +++ b/blog-api/src/main/java/com/shimh/controller/UploadController.java @@ -14,6 +14,7 @@ import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Value; import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; import org.springframework.web.multipart.MultipartFile; @@ -25,17 +26,53 @@ public class UploadController { private static final Logger logger = LoggerFactory.getLogger(UploadController.class); + private static final java.util.Set ALLOWED_EXTENSIONS = new java.util.HashSet<>(java.util.Arrays.asList( + "jpg", "jpeg", "png", "gif", "bmp", "webp" + )); @Value("${me.upload.path}") private String baseFolderPath; + private String getFileExtension(String filename) { + if (filename == null || filename.lastIndexOf(".") == -1) { + return ""; + } + return filename.substring(filename.lastIndexOf(".") + 1).toLowerCase(); + } + + private boolean isAllowedExtension(String extension) { + return extension != null && ALLOWED_EXTENSIONS.contains(extension); + } + + private String sanitizeFilename(String filename) { + return filename.replaceAll("[^a-zA-Z0-9.\\-_]", "_"); + } + @PostMapping("/upload") @RequiresAuthentication @LogAnnotation(module = "文件上传", operation = "文件上传") - public Result upload(HttpServletRequest request, MultipartFile image) { + public Result upload(HttpServletRequest request, @RequestParam("image") MultipartFile image) { Result r = new Result(); + if (image == null || image.isEmpty()) { + r.setResultCode(ResultCode.PARAM_IS_BLANK); + return r; + } + + String originalFilename = image.getOriginalFilename(); + if (originalFilename == null || originalFilename.isEmpty()) { + r.setResultCode(ResultCode.PARAM_IS_INVALID); + return r; + } + + String extension = getFileExtension(originalFilename); + if (!isAllowedExtension(extension)) { + r.setResultCode(ResultCode.PARAM_IS_INVALID); + r.simple().put("errdetail", "不支持的文件类型"); + return r; + } + SimpleDateFormat sdf = new SimpleDateFormat("yyyyMMdd"); StringBuffer url = new StringBuffer(); @@ -55,11 +92,19 @@ public Result upload(HttpServletRequest request, MultipartFile image) { .append("/") .append(filePath); - String imgName = UUID.randomUUID() + "_" + image.getOriginalFilename().replaceAll(" ", ""); + String safeFilename = sanitizeFilename(originalFilename); + String imgName = UUID.randomUUID().toString() + "_" + safeFilename; try { File dest = new File(baseFolder, imgName); + String canonicalPath = dest.getCanonicalPath(); + if (!canonicalPath.startsWith(baseFolder.getCanonicalPath())) { + r.setResultCode(ResultCode.PARAM_IS_INVALID); + r.simple().put("errdetail", "非法文件路径"); + return r; + } + image.transferTo(dest); url.append("/").append(imgName); diff --git a/blog-api/src/main/java/com/shimh/controller/UserController.java b/blog-api/src/main/java/com/shimh/controller/UserController.java index 8b58ff9f..61def053 100644 --- a/blog-api/src/main/java/com/shimh/controller/UserController.java +++ b/blog-api/src/main/java/com/shimh/controller/UserController.java @@ -106,11 +106,15 @@ public Result updateUser(@RequestBody User user) { Result r = new Result(); if (null == user.getId()) { - r.setResultCode(ResultCode.USER_NOT_EXIST); + r.setResultCode(ResultCode.PARAM_IS_BLANK); return r; } Long userId = userService.updateUser(user); + if (null == userId) { + r.setResultCode(ResultCode.RESULE_DATA_NONE); + return r; + } r.setResultCode(ResultCode.SUCCESS); r.simple().put("userId", userId); diff --git a/blog-api/src/main/java/com/shimh/oauth/OAuthSessionManager.java b/blog-api/src/main/java/com/shimh/oauth/OAuthSessionManager.java index e5bf19e1..fb13543f 100644 --- a/blog-api/src/main/java/com/shimh/oauth/OAuthSessionManager.java +++ b/blog-api/src/main/java/com/shimh/oauth/OAuthSessionManager.java @@ -34,10 +34,13 @@ protected Serializable getSessionId(ServletRequest request, ServletResponse resp HttpServletRequest httpRequest = (HttpServletRequest) request; String id = httpRequest.getHeader(OAUTH_TOKEN); - request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE); - request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id); - request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE); - return id; + if (!StringUtils.isEmpty(id)) { + request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE); + request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id); + request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE); + return id; + } + return super.getSessionId(request, response); } } diff --git a/blog-api/src/main/java/com/shimh/repository/impl/ArticleRepositoryImpl.java b/blog-api/src/main/java/com/shimh/repository/impl/ArticleRepositoryImpl.java index c4546fc2..68f22ec0 100644 --- a/blog-api/src/main/java/com/shimh/repository/impl/ArticleRepositoryImpl.java +++ b/blog-api/src/main/java/com/shimh/repository/impl/ArticleRepositoryImpl.java @@ -17,26 +17,44 @@ import javax.persistence.EntityManager; import javax.persistence.PersistenceContext; +import java.util.Arrays; +import java.util.HashSet; import java.util.List; +import java.util.Set; public class ArticleRepositoryImpl implements ArticleWrapper { @PersistenceContext private EntityManager em; + private static final Set ALLOWED_SORT_FIELDS = new HashSet<>(Arrays.asList( + "id", "title", "createDate", "viewCounts", "commentCounts", "weight" + )); + + private static final Set ALLOWED_SORT_ORDERS = new HashSet<>(Arrays.asList( + "asc", "desc", "ASC", "DESC" + )); + + private boolean isValidSortField(String field) { + return field != null && ALLOWED_SORT_FIELDS.contains(field); + } + + private boolean isValidSortOrder(String order) { + return order != null && ALLOWED_SORT_ORDERS.contains(order); + } + @Override public List
listArticles(PageVo page) { StringBuilder hql = new StringBuilder("from Article"); - if (null != page.getName() && !"".equals(page.getName())) { + if (isValidSortField(page.getName())) { hql.append(" order by "); hql.append(page.getName()); - } - - if (null != page.getSort() && !"".equals(page.getSort())) { - hql.append(" "); - hql.append(page.getSort()); + if (isValidSortOrder(page.getSort())) { + hql.append(" "); + hql.append(page.getSort()); + } } Query query = getSession().createQuery(hql.toString()); @@ -81,14 +99,13 @@ public List
listArticles(ArticleVo article, PageVo page) { hql.append(" and MONTH(a.createDate) = :month"); } - if (null != page.getName() && !"".equals(page.getName())) { + if (isValidSortField(page.getName())) { hql.append(" order by "); hql.append(page.getName()); - } - - if (null != page.getSort() && !"".equals(page.getSort())) { - hql.append(" "); - hql.append(page.getSort()); + if (isValidSortOrder(page.getSort())) { + hql.append(" "); + hql.append(page.getSort()); + } } diff --git a/blog-api/src/main/java/com/shimh/service/impl/ArticleServiceImpl.java b/blog-api/src/main/java/com/shimh/service/impl/ArticleServiceImpl.java index 2b77357b..b0e36b55 100644 --- a/blog-api/src/main/java/com/shimh/service/impl/ArticleServiceImpl.java +++ b/blog-api/src/main/java/com/shimh/service/impl/ArticleServiceImpl.java @@ -52,7 +52,7 @@ public List
findAll() { @Override public Article getArticleById(Integer id) { - return articleRepository.getOne(id); + return articleRepository.findOne(id); } @Override @@ -86,8 +86,10 @@ public Integer saveArticle(Article article) { @Override @Transactional public Integer updateArticle(Article article) { - Article oldArticle = articleRepository.getOne(article.getId()); - + Article oldArticle = articleRepository.findOne(article.getId()); + if (oldArticle == null) { + return null; + } oldArticle.setTitle(article.getTitle()); oldArticle.setSummary(article.getSummary()); oldArticle.setBody(article.getBody()); @@ -122,7 +124,10 @@ public List
listArticlesByCategory(Integer id) { @Transactional public Article getArticleAndAddViews(Integer id) { int count = 1; - Article article = articleRepository.getOne(id); + Article article = articleRepository.findOne(id); + if (article == null) { + return null; + } article.setViewCounts(article.getViewCounts() + count); return article; } diff --git a/blog-api/src/main/java/com/shimh/service/impl/CategoryServiceImpl.java b/blog-api/src/main/java/com/shimh/service/impl/CategoryServiceImpl.java index a3cc6689..4744dad9 100644 --- a/blog-api/src/main/java/com/shimh/service/impl/CategoryServiceImpl.java +++ b/blog-api/src/main/java/com/shimh/service/impl/CategoryServiceImpl.java @@ -30,7 +30,7 @@ public List findAll() { @Override public Category getCategoryById(Integer id) { - return categoryRepository.getOne(id); + return categoryRepository.findOne(id); } @Override @@ -43,8 +43,10 @@ public Integer saveCategory(Category category) { @Override @Transactional public Integer updateCategory(Category category) { - Category oldCategory = categoryRepository.getOne(category.getId()); - + Category oldCategory = categoryRepository.findOne(category.getId()); + if (oldCategory == null) { + return null; + } oldCategory.setCategoryname(category.getCategoryname()); oldCategory.setAvatar(category.getAvatar()); oldCategory.setDescription(category.getDescription()); diff --git a/blog-api/src/main/java/com/shimh/service/impl/CommentServiceImpl.java b/blog-api/src/main/java/com/shimh/service/impl/CommentServiceImpl.java index e89f9a0d..64fadd6e 100644 --- a/blog-api/src/main/java/com/shimh/service/impl/CommentServiceImpl.java +++ b/blog-api/src/main/java/com/shimh/service/impl/CommentServiceImpl.java @@ -42,7 +42,7 @@ public List findAll() { @Override public Comment getCommentById(Integer id) { - return commentRepository.getOne(id); + return commentRepository.findOne(id); } @Override @@ -72,12 +72,14 @@ public Comment saveCommentAndChangeCounts(Comment comment) { int count = 1; Article a = articleRepository.findOne(comment.getArticle().getId()); + if (a == null) { + return null; + } a.setCommentCounts(a.getCommentCounts() + count); comment.setAuthor(UserUtils.getCurrentUser()); comment.setCreateDate(new Date()); - //设置level if(null == comment.getParent()){ comment.setLevel("0"); }else{ @@ -97,9 +99,13 @@ public Comment saveCommentAndChangeCounts(Comment comment) { public void deleteCommentByIdAndChangeCounts(Integer id) { int count = 1; Comment c = commentRepository.findOne(id); + if (c == null) { + return; + } Article a = c.getArticle(); - - a.setCommentCounts(a.getCommentCounts() - count); + if (a != null) { + a.setCommentCounts(a.getCommentCounts() - count); + } commentRepository.delete(c); } diff --git a/blog-api/src/main/java/com/shimh/service/impl/TagServiceImpl.java b/blog-api/src/main/java/com/shimh/service/impl/TagServiceImpl.java index 972da864..8d24bee4 100644 --- a/blog-api/src/main/java/com/shimh/service/impl/TagServiceImpl.java +++ b/blog-api/src/main/java/com/shimh/service/impl/TagServiceImpl.java @@ -30,7 +30,7 @@ public List findAll() { @Override public Tag getTagById(Integer id) { - return tagRepository.getOne(id); + return tagRepository.findOne(id); } @Override @@ -43,8 +43,10 @@ public Integer saveTag(Tag tag) { @Override @Transactional public Integer updateTag(Tag tag) { - Tag oldTag = tagRepository.getOne(tag.getId()); - + Tag oldTag = tagRepository.findOne(tag.getId()); + if (oldTag == null) { + return null; + } oldTag.setTagname(tag.getTagname()); oldTag.setAvatar(tag.getAvatar()); diff --git a/blog-api/src/main/java/com/shimh/service/impl/UserServiceImpl.java b/blog-api/src/main/java/com/shimh/service/impl/UserServiceImpl.java index e517137f..650ca17d 100644 --- a/blog-api/src/main/java/com/shimh/service/impl/UserServiceImpl.java +++ b/blog-api/src/main/java/com/shimh/service/impl/UserServiceImpl.java @@ -57,6 +57,9 @@ public Long saveUser(User user) { @Transactional public Long updateUser(User user) { User oldUser = userRepository.findOne(user.getId()); + if (oldUser == null) { + return null; + } oldUser.setNickname(user.getNickname()); return oldUser.getId(); diff --git a/blog-api/src/main/resources/application.properties b/blog-api/src/main/resources/application.properties index 0d444011..3e7d2315 100644 --- a/blog-api/src/main/resources/application.properties +++ b/blog-api/src/main/resources/application.properties @@ -16,9 +16,9 @@ spring.resources.static-locations=classpath:/META-INF/resources/,classpath:/reso # datasource spring.datasource.type=com.alibaba.druid.pool.DruidDataSource -spring.datasource.url=jdbc:mysql://localhost:3306/blog?allowMultiQueries=true&useUnicode=true&characterEncoding=UTF-8 +spring.datasource.url=jdbc:mysql://gz-cdb-rh50u3k3.sql.tencentcdb.com:26324/blog?allowMultiQueries=true&useUnicode=true&characterEncoding=UTF-8 spring.datasource.username=root -spring.datasource.password=123456 +spring.datasource.password=1qaz@WSX3edc@123 spring.datasource.driver-class-name=com.mysql.jdbc.Driver #spring.datasource.initialize=true