From f52bb9b1b755cbd1c1b02660c9544b93c6928133 Mon Sep 17 00:00:00 2001
From: xieb <vip_xiaobin810@163.com>
Date: Thu, 10 Aug 2023 09:49:10 +0800
Subject: [PATCH] IAM推送新增验签
---
skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/sync/controller/UserPushController.java | 85 ++++++++++++++----------------------------
1 files changed, 29 insertions(+), 56 deletions(-)
diff --git a/skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/sync/controller/UserPushController.java b/skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/sync/controller/UserPushController.java
index 6663ef3..bef89c0 100644
--- a/skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/sync/controller/UserPushController.java
+++ b/skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/sync/controller/UserPushController.java
@@ -4,13 +4,12 @@
import cn.gistack.system.user.service.IUserService;
import cn.gistack.system.user.sync.dto.AccountBean;
import cn.gistack.system.user.sync.dto.ApiPushDTO;
+import cn.gistack.system.user.sync.exception.ErrorCode;
import cn.gistack.system.user.sync.util.*;
-import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import lombok.AllArgsConstructor;
import org.springblade.core.mp.support.Condition;
import org.springblade.core.tenant.annotation.NonDS;
-import org.springblade.core.tool.api.R;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
@@ -42,14 +41,29 @@
@PostMapping("/userpush")
public Object userPush(@RequestBody ApiPushDTO apiPushDTO, HttpServletRequest request) {
- System.out.println("请求参数：" + JSON.toJSONString(apiPushDTO));
- System.out.println("clientId：" + request.getParameter("clientId"));
- System.out.println("timestamp：" + request.getParameter("timestamp"));
- System.out.println("sign：" + request.getParameter("sign"));
- System.out.println("salt：" + request.getParameter("salt"));
- System.out.println("request rui：" + request.getRequestURL());
- System.out.println("request.getQueryString()：" + request.getQueryString());
-// String queryStr = request.getQueryString();
+ Map<String, Object> ret = new HashMap<>();
+
+ String clientId = request.getParameter("clientId");
+ String timestamp = request.getParameter("timestamp");
+ String sign = request.getParameter("sign");
+ String salt = request.getParameter("salt");
+
+ // 校验签名防止篡改参数
+ String sign2 = SignBuilder.create(appId, MD5Util.getMD5String(appSecret))
+ .requestPath("/api/blade-user/sync/userpush")
+ .requestMethod("POST")
+ .salt(salt)
+ .timestamp(Long.valueOf(timestamp))
+ .sign();
+
+ if (!clientId.equals(appId) || !sign.equals(sign2)) {
+ ret.put("code", ErrorCode.SIGN_CHECK_ERROR.getCode());
+ ret.put("msg", ErrorCode.SIGN_CHECK_ERROR.getMsg());
+ ret.put("data", "");
+ return ret;
+ }
+
+ // 解密syncData
String syncData = SecurityUtil.decryptAES(apiPushDTO.getSyncData(), MD5Util.getMD5String(appSecret));
List<AccountBean> accountBeanList = JSONArray.parseArray(syncData, AccountBean.class);
@@ -60,9 +74,9 @@
params.setPhone(accountBean.getPrincipalId());
User one = userService.getOne(Condition.getQueryWrapper(params));
- if (one == null){
+ if (one == null) {
//不在，看status状态，若为1则不操作。0添加进库
- if (accountBean.getStatus().equals("0")){
+ if (accountBean.getStatus().equals("0")) {
User saveUser = new User();
//设置id为手机号
@@ -80,9 +94,9 @@
saveUser.setTenantId("000000");
userService.save(saveUser);
}
- }else {
+ } else {
//在，看status状态，若为1则删除用户。0更新？
- if (accountBean.getStatus().equals("1")){
+ if (accountBean.getStatus().equals("1")) {
userService.removeUser(accountBean.getPrincipalId());
} else { //更新
//设置姓名
@@ -91,52 +105,11 @@
}
}
});
- Map<String,Object> ret = new HashMap<>();
+
ret.put("code", 1000);
ret.put("msg", "成功");
ret.put("data", apiPushDTO.getSign());
return ret;
}
-
-// public static void main(String[] args) {
-//// Map<String,String> attributes = new HashMap<>();
-//// // "staffCode": "15563378977",
-//// // "realName": "zhliu",
-//// // "email": null,
-//// // "phone": "15563378977",
-//// // "employeeNum": "zhliu",
-//// // "idCard": null,
-//// // "employeeStatus": "1",
-//// // "userType": "0",
-//// // "sort": "1"
-//// attributes.put("staffCode","15563378977");
-//// attributes.put("realName","zhliu");
-//// attributes.put("email",null);
-//// attributes.put("phone","15563378977");
-//// attributes.put("employeeNum","zhliu");
-//// attributes.put("idCard", null);
-//// attributes.put("employeeStatus","1");
-//// attributes.put("userType","0");
-//// attributes.put("sort","1");
-//// String syncData = SecurityUtil.encryptAES(JSON.toJSONString(attributes), MD5Util.getMD5String(appSecret));
-//// System.out.println("加密后：" + syncData);
-//// String jiemi = SecurityUtil.decryptAES(syncData, MD5Util.getMD5String(appSecret));
-//// System.out.printf("解密后：" + jiemi);
-//
-//// String tmp = "XmcEvdSFwXYvpAcoDZW5NKYmx1IyvXEJLdRnwLFTBUAhN0DheUZnVMb5y3IuMoASUsBrb82PrbKefa754brKNgvgmKvJxehhkLAWALy/33jX7lA+YjXLzWqLrr/fp6AEVEcLuz8rf+ZvkHcJsyAzPclaxPvd6R0LV0KIiyalnVbhfGCjPPvhYNnOBZh3vNPssn1Z+REywWtHD15G9/zEhpuEno6gPtNxtk1PoqxebCuxZvKRGT2DM/KL0GO4dpY8ksm6bgDcHXcB5oKIdwxb1N7yRQ5DJsIZkz9e/Zo720ObReXCLI9KdErQyOM/uxTqnHE7FVeGP3f5sebTH2WeKyI2mefwGrZYrnGAfxbZOr8pDpXiDs/SF35SHdvC5rRAgfEMm9r1pA74xtb9vplcmvQQqB7aDMbRLQWOo3R9U4KqwU2yvq1L6pZLeWbFVKH5ei40APzcdGS3K8QpcfyzkU5BuR4VgHvNMS9xEkIAbZ9flLBEPE08CReEQ9rJQr8AP5SZ4d394aIxJnJHRxwCNUuMMEdj0/C8UDfwwQMxUQPDlc4tA+DHDjgAwc641gu8IVTqmWjb5+kT3v0Xe9pEPgg4C9kDn0JOoZxsG0UpHdWU5QObGhI+i/j9Ip1T2pcvJdy0eAU0HSAtfBu56i/Li9L97jqtWSog05H3ni3mLjbFrDBARfEd4mOSW9F89fya7ORMM/SnW0qD+Db9dS8Uu/eKdpct/xm4i74HbknnUEdr85txKh0QSNahkirT88yot4YJTPNKOMRQQKrLgj5nAopZIqaoOHvHaTNR6ii0Se8TLrUeUwEYdoW/dpB/3ql5nt34igYLSdll7jw3jRHTHZ6oqvd7CGyQvqSdimcq/BCitx2TkorxMDvoawjYm++eCjW6CDHC2gl4P4e8yf2R5yIjEMxBlU7daMZAcGjY2IO0/WXmW0lbpBXwydHiSSW3oTEL/pwGEFszW2mocMmyB5V2jce8xt4Kog2s1hjNuISZ7J5QIWph0SXONELyCpMud1wFxWpj6o1nZGSV/yzZhTfgk+yEItgRYlDnAEew8lTKSTaOX97/G2Xc1fJZFYYzOuVhtzakrJ3LUjxYEOKr5+NkEx0utKt3UV7o5oH7RB2lvpjREZ5vnvZDIDAWpBnH0thYaq2s2a7KJj92gbgWAjbyFVK2RIOREs3Lw0SxWUh2hfwCPNj7oXzS+X7vwmf4R3aw2vfI20sLKbhyezGKFgmtHQkn1lvdbMDj7hNfNXG6UE698Fa6Fq2Vr7DhPdlAZVmrHiPPaRSKi6QlOaeNtGe8J3PrJpYbtlDV/e8+DRA0kAcrofhktiOFjQcOMY0Gu3qJt6tV4L1ODndZCHdmWIytMsyAB+tEoeEFhIMpWZAzosCws+Kx78L/Uy7t/LwDP+vlN5RoFQnjeAdZTMtriNDmG+8KqrOWOz4EM5uMICro7bbuMBxpAZkV348dlUoQZkzd8jog0f2NkAygL+qIWeQtcOrjYU5S00q9LVd2swK1szpOIaRFbq8YIWLKaEWhPDZIJmtYYhlKIHJ3D0bJ0HoiENjSLyYYEEVmQF4j9wmIBvcyIr46NDF47Jo9K8hVNJObc41qecxh2kiqNh3lST50rgdma5uOJH1dsnS4gYCYWM6jY/8JMLEoqhTO//ljcI9XpnvzSN3F1jkhCJtV7yhBN20wczEdSB63VFxwQU5C5MEbfiLs0kXhgogXQ4e9";
-//// String jiemi2 = SecurityUtil.decryptAES(tmp, MD5Util.getMD5String(appSecret));
-//// System.out.printf("解密后：" + jiemi2);
-//
-//
-// String sign = SignBuilder.create(appId, MD5Util.getMD5String(appSecret))
-// .requestPath("/api/blade-user/sync/userpush")
-// .requestMethod("POST")
-// .salt("0.9719235633868601")
-// .timestamp(1691574410682l)
-// .sign();
-//
-// System.out.println("sign：" + sign);
-//
-// }
}
--
Gitblit v1.9.3