周伟鹏 / cnlive_shenhe · Commits

Commit 880669c11c833ab10e13da301a11802722e75746

Authored by 李虎
1 parent 3f105f6e

审核云越权漏洞

Inline Side-by-side
Showing 3 changed files with 61 additions and 46 deletions
src/main/java/com/cnlive/shenhe/mapper/ShyAudioMapper.java
  View file @880669c
@@ -15,4 +15,6 @@ public interface ShyAudioMapper extends Mapper<ShyAudio> { @@ -15,4 +15,6 @@ public interface ShyAudioMapper extends Mapper<ShyAudio> {
15 */ 15 */
16 ShyAudio getAudioMsg(@Param(value = "audioId") String audioId); 16 ShyAudio getAudioMsg(@Param(value = "audioId") String audioId);
17 17
  18 + ShyAudio getAudioBySpId(@Param(value = "id") Integer id,
  19 + @Param(value = "spId") Integer spId);
18 } 20 }
19 \ No newline at end of file 21 \ No newline at end of file
src/main/java/com/cnlive/shenhe/service/serviceImpl/AudioServiceImpl.java
  View file @880669c
@@ -323,13 +323,14 @@ public class AudioServiceImpl implements AudioService { @@ -323,13 +323,14 @@ public class AudioServiceImpl implements AudioService {
323 323
324 @Override 324 @Override
325 public ShyAudio getDetailsAudio(Integer id, Integer spid) { 325 public ShyAudio getDetailsAudio(Integer id, Integer spid) {
326 - ShyAudio audio = new ShyAudio();  
327 - audio.setId(id);  
328 - if (spid != 0) {  
329 - audio.setSpId(spid);  
330 - }  
331 //ShyAudio shyAudio = shyAudioMapper.selectByPrimaryKey(id); 326 //ShyAudio shyAudio = shyAudioMapper.selectByPrimaryKey(id);
332 - ShyAudio shyAudio = shyAudioMapper.selectByPrimaryKey(audio); 327 + /*Example example = new Example(ShyAudio.class);
  328 + example.createCriteria().andEqualTo("id", id)
  329 + .andEqualTo("spId", spid);
  330 +
  331 + List<ShyAudio> shyAudios = shyAudioMapper.selectByExample(example);*/
  332 + //ShyAudio shyAudio = shyAudioMapper.selectOne(audio);
  333 + ShyAudio shyAudio = shyAudioMapper.getAudioBySpId(id, spid);
333 logger.info("查询音频实体参数:{}", JSON.toJSON(shyAudio)); 334 logger.info("查询音频实体参数:{}", JSON.toJSON(shyAudio));
334 if (CommonUtils.isNotNull(shyAudio)) { 335 if (CommonUtils.isNotNull(shyAudio)) {
335 if (!shyAudio.getState().equals(CommonConst.AUDIT_INTT)) { 336 if (!shyAudio.getState().equals(CommonConst.AUDIT_INTT)) {
src/main/resources/mapper/ShyAudioMapper.xml
  View file @880669c
1 <?xml version="1.0" encoding="UTF-8"?> 1 <?xml version="1.0" encoding="UTF-8"?>
2 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd"> 2 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
3 <mapper namespace="com.cnlive.shenhe.mapper.ShyAudioMapper"> 3 <mapper namespace="com.cnlive.shenhe.mapper.ShyAudioMapper">
4 - <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyAudio">  
5 - <!--  
6 - WARNING - @mbg.generated  
7 - -->  
8 - <id column="id" jdbcType="INTEGER" property="id" />  
9 - <result column="multiplecategory" jdbcType="VARCHAR" property="multiplecategory" />  
10 - <result column="audioClipsName" jdbcType="VARCHAR" property="audioClipsName" />  
11 - <result column="soure" jdbcType="INTEGER" property="soure" />  
12 - <result column="audioId" jdbcType="VARCHAR" property="audioId" />  
13 - <result column="audioTitle" jdbcType="VARCHAR" property="audioTitle" />  
14 - <result column="audioUrl" jdbcType="VARCHAR" property="audioUrl" />  
15 - <result column="audioCoverUrl" jdbcType="VARCHAR" property="audioCoverUrl" />  
16 - <result column="audioIntro" jdbcType="VARCHAR" property="audioIntro" />  
17 - <result column="audioTag" jdbcType="VARCHAR" property="audioTag" />  
18 - <result column="audioKeyword" jdbcType="VARCHAR" property="audioKeyword" />  
19 - <result column="uploadTime" jdbcType="TIMESTAMP" property="uploadTime" />  
20 - <result column="priority" jdbcType="INTEGER" property="priority" />  
21 - <result column="callback" jdbcType="VARCHAR" property="callback" />  
22 - <result column="spId" jdbcType="INTEGER" property="spId" />  
23 - <result column="bucketName" jdbcType="VARCHAR" property="bucketName" />  
24 - <result column="bucketType" jdbcType="INTEGER" property="bucketType" />  
25 - <result column="duration" jdbcType="INTEGER" property="duration" />  
26 - <result column="uploader" jdbcType="VARCHAR" property="uploader" />  
27 - <result column="contactInfo" jdbcType="VARCHAR" property="contactInfo" />  
28 - <result column="extendField" jdbcType="VARCHAR" property="extendField" />  
29 - <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id" />  
30 - <result column="attr_tags" jdbcType="VARCHAR" property="attr_tags" />  
31 - <result column="msg" jdbcType="VARCHAR" property="msg" />  
32 - <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type" />  
33 - <result column="state" jdbcType="INTEGER" property="state" />  
34 - <result column="createTime" jdbcType="TIMESTAMP" property="createTime" />  
35 - <result column="updateTime" jdbcType="TIMESTAMP" property="updateTime" />  
36 - <result column="receive" jdbcType="INTEGER" property="receive" />  
37 - <result column="receive_user_id" jdbcType="VARCHAR" property="receive_user_id" />  
38 - </resultMap> 4 + <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyAudio">
  5 + <!--
  6 + WARNING - @mbg.generated
  7 + -->
  8 + <id column="id" jdbcType="INTEGER" property="id"/>
  9 + <result column="multiplecategory" jdbcType="VARCHAR" property="multiplecategory"/>
  10 + <result column="audioClipsName" jdbcType="VARCHAR" property="audioClipsName"/>
  11 + <result column="soure" jdbcType="INTEGER" property="soure"/>
  12 + <result column="audioId" jdbcType="VARCHAR" property="audioId"/>
  13 + <result column="audioTitle" jdbcType="VARCHAR" property="audioTitle"/>
  14 + <result column="audioUrl" jdbcType="VARCHAR" property="audioUrl"/>
  15 + <result column="audioCoverUrl" jdbcType="VARCHAR" property="audioCoverUrl"/>
  16 + <result column="audioIntro" jdbcType="VARCHAR" property="audioIntro"/>
  17 + <result column="audioTag" jdbcType="VARCHAR" property="audioTag"/>
  18 + <result column="audioKeyword" jdbcType="VARCHAR" property="audioKeyword"/>
  19 + <result column="uploadTime" jdbcType="TIMESTAMP" property="uploadTime"/>
  20 + <result column="priority" jdbcType="INTEGER" property="priority"/>
  21 + <result column="callback" jdbcType="VARCHAR" property="callback"/>
  22 + <result column="spId" jdbcType="INTEGER" property="spId"/>
  23 + <result column="bucketName" jdbcType="VARCHAR" property="bucketName"/>
  24 + <result column="bucketType" jdbcType="INTEGER" property="bucketType"/>
  25 + <result column="duration" jdbcType="INTEGER" property="duration"/>
  26 + <result column="uploader" jdbcType="VARCHAR" property="uploader"/>
  27 + <result column="contactInfo" jdbcType="VARCHAR" property="contactInfo"/>
  28 + <result column="extendField" jdbcType="VARCHAR" property="extendField"/>
  29 + <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id"/>
  30 + <result column="attr_tags" jdbcType="VARCHAR" property="attr_tags"/>
  31 + <result column="msg" jdbcType="VARCHAR" property="msg"/>
  32 + <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type"/>
  33 + <result column="state" jdbcType="INTEGER" property="state"/>
  34 + <result column="createTime" jdbcType="TIMESTAMP" property="createTime"/>
  35 + <result column="updateTime" jdbcType="TIMESTAMP" property="updateTime"/>
  36 + <result column="receive" jdbcType="INTEGER" property="receive"/>
  37 + <result column="receive_user_id" jdbcType="VARCHAR" property="receive_user_id"/>
  38 + </resultMap>
39 39
40 - <select id="getAudioMsg" resultType="com.cnlive.shenhe.entity.ShyAudio">  
41 - SELECT *  
42 - FROM shy_audio  
43 - where audioId = #{audioId,jdbcType=VARCHAR};  
44 - </select> 40 + <select id="getAudioMsg" resultType="com.cnlive.shenhe.entity.ShyAudio">
  41 + SELECT *
  42 + FROM shy_audio
  43 + where audioId = #{audioId,jdbcType=VARCHAR};
  44 + </select>
45 45
  46 + <select id="getAudioBySpId" resultType="com.cnlive.shenhe.entity.ShyAudio">
  47 + select *
  48 + from shy_audio
  49 + <where>
  50 + <if test="id != null">
  51 + and id = #{id}
  52 + </if>
  53 + <if test="spId != null and spId != 0">
  54 + and spId = #{spId}
  55 + </if>
  56 + </where>
  57 + </select>
46 </mapper> 58 </mapper>
47 \ No newline at end of file 59 \ No newline at end of file