周伟鹏 / cnlive_shenhe · Commits

Commit a68f9644c0c2d0232f710a7a65480daeab02b484

Authored by 李虎
1 parent 22ccc530

审核云越权漏洞

Inline Side-by-side
Showing 11 changed files with 156 additions and 101 deletions
src/main/java/com/cnlive/shenhe/controller/ContentController.java
  View file @a68f964
... ... @@ -127,8 +127,17 @@ public class ContentController extends BaseController {
127 127 * @return
128 128 */
129 129 @GetMapping("/details/{id}")
130   - public String getDetailsContents(@PathVariable Integer id, Model model) {
131   - ShyContent content = contentService.getDetailsContent(id);
  130 + public String getDetailsContents(@PathVariable Integer id, Model model, HttpSession session) {
  131 + SessionUser sessionUser = (SessionUser) session.getAttribute(SessionUser.getSessionKey());
  132 + if (CommonUtils.isNull(sessionUser)) {
  133 + return "redirect:/users/login";
  134 + }
  135 + Integer spid = sessionUser.getSpid();
  136 + logger.info("图文获取spId:{}", spid);
  137 + ShyContent content = contentService.getDetailsContent(id, spid);
  138 + if (CommonUtils.isNull(content)) {
  139 + return "page/error1.html";
  140 + }
132 141 if (!content.getReceive_status().equals(CommonConst.RECEIVE_BEFORE)) {
133 142 String auditorId = content.getAuditor_id();
134 143 String updater = CommonUtils.isEmpty(content.getUpdater()) || "null".equals(content.getUpdater()) ? "白名单" : content.getUpdater();
... ...
src/main/java/com/cnlive/shenhe/controller/VideosController.java
  View file @a68f964
... ... @@ -247,8 +247,17 @@ public class VideosController extends BaseController {
247 247 * @return
248 248 */
249 249 @GetMapping("/details")
250   - public Object getDetailsVideo(Model model, Integer id) {
251   - ShyVideos detailsContent = videosService.getDetailsVideo(id);
  250 + public Object getDetailsVideo(Model model, Integer id, HttpSession session) {
  251 + SessionUser sessionUser = (SessionUser) session.getAttribute(SessionUser.getSessionKey());
  252 + if (CommonUtils.isNull(sessionUser)) {
  253 + return "redirect:/users/login";
  254 + }
  255 + Integer spid = sessionUser.getSpid();
  256 + logger.info("点播获取spId:{}", spid);
  257 + ShyVideos detailsContent = videosService.getDetailsVideo(id, spid);
  258 + if (CommonUtils.isNull(detailsContent)) {
  259 + return "page/error1.html";
  260 + }
252 261 Object images = JSON.parse(detailsContent.getVideo_imgs());
253 262 Object avsampleImgs = JSON.parse(detailsContent.getAvsample_imgs());
254 263 String yuming = "";
... ...
src/main/java/com/cnlive/shenhe/mapper/ShyContentMapper.java
  View file @a68f964
1 1 package com.cnlive.shenhe.mapper;
2 2  
3 3 import com.cnlive.shenhe.entity.ShyContent;
  4 +import org.apache.ibatis.annotations.Param;
4 5 import tk.mybatis.mapper.common.Mapper;
5 6  
6 7 public interface ShyContentMapper extends Mapper<ShyContent> {
  8 + ShyContent selectBySpId(@Param("id") Integer id,
  9 + @Param("spId") Integer spId);
7 10 }
8 11 \ No newline at end of file
... ...
src/main/java/com/cnlive/shenhe/mapper/ShyVideosMapper.java
  View file @a68f964
1 1 package com.cnlive.shenhe.mapper;
2 2  
3 3 import com.cnlive.shenhe.entity.ShyVideos;
  4 +import org.apache.ibatis.annotations.Param;
4 5 import tk.mybatis.mapper.common.Mapper;
5 6  
6 7 public interface ShyVideosMapper extends Mapper<ShyVideos> {
  8 + ShyVideos selectBySpId(@Param("id") Integer id,
  9 + @Param("spId") Integer spId);
7 10 }
8 11 \ No newline at end of file
... ...
src/main/java/com/cnlive/shenhe/service/ContentService.java
  View file @a68f964
... ... @@ -72,7 +72,7 @@ public interface ContentService {
72 72 * @param id
73 73 * @return
74 74 */
75   - ShyContent getDetailsContent(Integer id);
  75 + ShyContent getDetailsContent(Integer id, Integer spId);
76 76  
77 77 /**
78 78 * 回调
... ...
src/main/java/com/cnlive/shenhe/service/VideosService.java
  View file @a68f964
... ... @@ -71,7 +71,7 @@ public interface VideosService {
71 71 * @param id
72 72 * @return
73 73 */
74   - ShyVideos getDetailsVideo(Integer id);
  74 + ShyVideos getDetailsVideo(Integer id, Integer spId);
75 75  
76 76 /**
77 77 * 认领video
... ...
src/main/java/com/cnlive/shenhe/service/serviceImpl/AudioServiceImpl.java
  View file @a68f964
... ... @@ -324,7 +324,6 @@ public class AudioServiceImpl implements AudioService {
324 324 @Override
325 325 public ShyAudio getDetailsAudio(Integer id, Integer spid) {
326 326 ShyAudio shyAudio = shyAudioMapper.getAudioBySpId(id, spid);
327   - logger.info("查询音频实体参数:{}", JSON.toJSON(shyAudio));
328 327 if (CommonUtils.isNotNull(shyAudio)) {
329 328 if (!shyAudio.getState().equals(CommonConst.AUDIT_INTT)) {
330 329 String updater = CommonUtils.isEmpty(shyAudio.getUploader()) || "null".equals(shyAudio.getUploader()) ? "白名单" : shyAudio.getUploader();
... ...
src/main/java/com/cnlive/shenhe/service/serviceImpl/ContentServiceImpl.java
  View file @a68f964
... ... @@ -220,23 +220,26 @@ public class ContentServiceImpl implements ContentService {
220 220 * @return
221 221 */
222 222 @Override
223   - public ShyContent getDetailsContent(Integer id) {
224   - ShyContent content = shyContentMapper.selectByPrimaryKey(id);
225   - if (content.getReceive_status().equals(CommonConst.RECEIVE_AUDIT)) {
226   - String updater = CommonUtils.isEmpty(content.getUpdater()) || "null".equals(content.getUpdater()) ? "白名单" : content.getUpdater();
227   - String auditorId = content.getAuditor_id();
228   - if (CommonUtils.isNotEmpty(auditorId)) {
229   - ShyUsers user = new ShyUsers();
230   - user.setUser_id(auditorId);
231   - user = shyUsersMapper.selectOne(user);
232   - String email = CommonUtils.isEmpty(user.getEmail()) || "null".equals(user.getEmail()) ? "" : user.getEmail();
233   - updater = CommonUtils.isEmpty(user.getUsername()) ? email : user.getUsername();
  223 + public ShyContent getDetailsContent(Integer id, Integer spId) {
  224 + ShyContent content = shyContentMapper.selectBySpId(id, spId);
  225 + //ShyContent content = shyContentMapper.selectByPrimaryKey(id);
  226 + if (CommonUtils.isNotNull(content)) {
  227 + if (content.getReceive_status().equals(CommonConst.RECEIVE_AUDIT)) {
  228 + String updater = CommonUtils.isEmpty(content.getUpdater()) || "null".equals(content.getUpdater()) ? "白名单" : content.getUpdater();
  229 + String auditorId = content.getAuditor_id();
  230 + if (CommonUtils.isNotEmpty(auditorId)) {
  231 + ShyUsers user = new ShyUsers();
  232 + user.setUser_id(auditorId);
  233 + user = shyUsersMapper.selectOne(user);
  234 + String email = CommonUtils.isEmpty(user.getEmail()) || "null".equals(user.getEmail()) ? "" : user.getEmail();
  235 + updater = CommonUtils.isEmpty(user.getUsername()) ? email : user.getUsername();
  236 + }
  237 + content.setUpdater(updater);
  238 + }
  239 + ShySites shySite = sitesService.findspidDescByspid(content.getSp_id());
  240 + if (CommonUtils.isNotNull(shySite)) {
  241 + content.setSp_desc(shySite.getName());
234 242 }
235   - content.setUpdater(updater);
236   - }
237   - ShySites shySite = sitesService.findspidDescByspid(content.getSp_id());
238   - if (CommonUtils.isNotNull(shySite)) {
239   - content.setSp_desc(shySite.getName());
240 243 }
241 244 return content;
242 245 }
... ...
src/main/java/com/cnlive/shenhe/service/serviceImpl/VideosServiceImpl.java
  View file @a68f964
... ... @@ -230,19 +230,22 @@ public class VideosServiceImpl implements VideosService {
230 230 * @return
231 231 */
232 232 @Override
233   - public ShyVideos getDetailsVideo(Integer id) {
234   - ShyVideos shyVideos = shyVideosMapper.selectByPrimaryKey(id);
235   - if (!shyVideos.getState().equals(CommonConst.AUDIT_INTT)) {
236   - String updater = CommonUtils.isEmpty(shyVideos.getUpdater()) || "null".equals(shyVideos.getUpdater()) ? "白名单" : shyVideos.getUpdater();
237   - String auditorId = shyVideos.getAuditor_id();
238   - if (CommonUtils.isNotEmpty(auditorId)) {
239   - ShyUsers user = new ShyUsers();
240   - user.setUser_id(auditorId);
241   - user = shyUsersMapper.selectOne(user);
242   - String email = CommonUtils.isEmpty(user.getEmail()) || "null".equals(user.getEmail()) ? "" : user.getEmail();
243   - updater = CommonUtils.isEmpty(user.getUsername()) ? email : user.getUsername();
  233 + public ShyVideos getDetailsVideo(Integer id, Integer spId) {
  234 + ShyVideos shyVideos = shyVideosMapper.selectBySpId(id, spId);
  235 + //ShyVideos shyVideos = shyVideosMapper.selectByPrimaryKey(id);
  236 + if (CommonUtils.isNotNull(shyVideos)) {
  237 + if (!shyVideos.getState().equals(CommonConst.AUDIT_INTT)) {
  238 + String updater = CommonUtils.isEmpty(shyVideos.getUpdater()) || "null".equals(shyVideos.getUpdater()) ? "白名单" : shyVideos.getUpdater();
  239 + String auditorId = shyVideos.getAuditor_id();
  240 + if (CommonUtils.isNotEmpty(auditorId)) {
  241 + ShyUsers user = new ShyUsers();
  242 + user.setUser_id(auditorId);
  243 + user = shyUsersMapper.selectOne(user);
  244 + String email = CommonUtils.isEmpty(user.getEmail()) || "null".equals(user.getEmail()) ? "" : user.getEmail();
  245 + updater = CommonUtils.isEmpty(user.getUsername()) ? email : user.getUsername();
  246 + }
  247 + shyVideos.setUpdater(updater);
244 248 }
245   - shyVideos.setUpdater(updater);
246 249 }
247 250 return shyVideos;
248 251 }
... ...
src/main/resources/mapper/ShyContentMapper.xml
  View file @a68f964
1 1 <?xml version="1.0" encoding="UTF-8"?>
2 2 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
3 3 <mapper namespace="com.cnlive.shenhe.mapper.ShyContentMapper">
4   - <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyContent">
5   - <!--
6   - WARNING - @mbg.generated
7   - -->
8   - <id column="id" jdbcType="INTEGER" property="id" />
9   - <result column="content_id" jdbcType="VARCHAR" property="content_id" />
10   - <result column="sp_id" jdbcType="INTEGER" property="sp_id" />
11   - <result column="title_image" jdbcType="VARCHAR" property="title_image" />
12   - <result column="content_tag" jdbcType="VARCHAR" property="content_tag" />
13   - <result column="content_url" jdbcType="VARCHAR" property="content_url" />
14   - <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type" />
15   - <result column="content_status" jdbcType="INTEGER" property="content_status" />
16   - <result column="callback" jdbcType="VARCHAR" property="callback" />
17   - <result column="source" jdbcType="VARCHAR" property="source" />
18   - <result column="author" jdbcType="VARCHAR" property="author" />
19   - <result column="video_id" jdbcType="VARCHAR" property="video_id" />
20   - <result column="content_time" jdbcType="TIMESTAMP" property="content_time" />
21   - <result column="create_date" jdbcType="TIMESTAMP" property="create_date" />
22   - <result column="last_update" jdbcType="TIMESTAMP" property="last_update" />
23   - <result column="receive_status" jdbcType="INTEGER" property="receive_status" />
24   - <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id" />
25   - <result column="updater" jdbcType="VARCHAR" property="updater" />
26   - <result column="shenhe_msg" jdbcType="VARCHAR" property="shenhe_msg" />
27   - <result column="title" jdbcType="LONGVARCHAR" property="title" />
28   - <result column="content_pc_url" jdbcType="LONGVARCHAR" property="content_pc_url" />
29   - <result column="content_text" jdbcType="LONGVARCHAR" property="content_text" />
30   - </resultMap>
  4 + <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyContent">
  5 + <!--
  6 + WARNING - @mbg.generated
  7 + -->
  8 + <id column="id" jdbcType="INTEGER" property="id"/>
  9 + <result column="content_id" jdbcType="VARCHAR" property="content_id"/>
  10 + <result column="sp_id" jdbcType="INTEGER" property="sp_id"/>
  11 + <result column="title_image" jdbcType="VARCHAR" property="title_image"/>
  12 + <result column="content_tag" jdbcType="VARCHAR" property="content_tag"/>
  13 + <result column="content_url" jdbcType="VARCHAR" property="content_url"/>
  14 + <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type"/>
  15 + <result column="content_status" jdbcType="INTEGER" property="content_status"/>
  16 + <result column="callback" jdbcType="VARCHAR" property="callback"/>
  17 + <result column="source" jdbcType="VARCHAR" property="source"/>
  18 + <result column="author" jdbcType="VARCHAR" property="author"/>
  19 + <result column="video_id" jdbcType="VARCHAR" property="video_id"/>
  20 + <result column="content_time" jdbcType="TIMESTAMP" property="content_time"/>
  21 + <result column="create_date" jdbcType="TIMESTAMP" property="create_date"/>
  22 + <result column="last_update" jdbcType="TIMESTAMP" property="last_update"/>
  23 + <result column="receive_status" jdbcType="INTEGER" property="receive_status"/>
  24 + <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id"/>
  25 + <result column="updater" jdbcType="VARCHAR" property="updater"/>
  26 + <result column="shenhe_msg" jdbcType="VARCHAR" property="shenhe_msg"/>
  27 + <result column="title" jdbcType="LONGVARCHAR" property="title"/>
  28 + <result column="content_pc_url" jdbcType="LONGVARCHAR" property="content_pc_url"/>
  29 + <result column="content_text" jdbcType="LONGVARCHAR" property="content_text"/>
  30 + </resultMap>
  31 +
  32 + <select id="selectBySpId" resultType="com.cnlive.shenhe.entity.ShyContent">
  33 + select *
  34 + from shy_content
  35 + <where>
  36 + <if test="id != null">
  37 + and id = #{id}
  38 + </if>
  39 + <if test="spId != null and spId != 0">
  40 + and sp_id = #{spId}
  41 + </if>
  42 + </where>
  43 + </select>
31 44 </mapper>
32 45 \ No newline at end of file
... ...
src/main/resources/mapper/ShyVideosMapper.xml
  View file @a68f964
1 1 <?xml version="1.0" encoding="UTF-8"?>
2 2 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
3 3 <mapper namespace="com.cnlive.shenhe.mapper.ShyVideosMapper">
4   - <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyVideos">
5   - <!--
6   - WARNING - @mbg.generated
7   - -->
8   - <id column="id" jdbcType="INTEGER" property="id" />
9   - <result column="video_title" jdbcType="VARCHAR" property="video_title" />
10   - <result column="spid" jdbcType="INTEGER" property="spid" />
11   - <result column="video_url" jdbcType="VARCHAR" property="video_url" />
12   - <result column="video_poster" jdbcType="VARCHAR" property="video_poster" />
13   - <result column="video_imgs" jdbcType="VARCHAR" property="video_imgs" />
14   - <result column="video_tags" jdbcType="VARCHAR" property="video_tags" />
15   - <result column="updater" jdbcType="VARCHAR" property="updater" />
16   - <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id" />
17   - <result column="callback" jdbcType="VARCHAR" property="callback" />
18   - <result column="video_priority" jdbcType="VARCHAR" property="video_priority" />
19   - <result column="attr_tags" jdbcType="VARCHAR" property="attr_tags" />
20   - <result column="msg" jdbcType="VARCHAR" property="msg" />
21   - <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type" />
22   - <result column="state" jdbcType="INTEGER" property="state" />
23   - <result column="video_upload_time" jdbcType="TIMESTAMP" property="video_upload_time" />
24   - <result column="video_keyword" jdbcType="VARCHAR" property="video_keyword" />
25   - <result column="video_desc" jdbcType="VARCHAR" property="video_desc" />
26   - <result column="video_id" jdbcType="VARCHAR" property="video_id" />
27   - <result column="created_at" jdbcType="TIMESTAMP" property="created_at" />
28   - <result column="updated_at" jdbcType="TIMESTAMP" property="updated_at" />
29   - <result column="receive" jdbcType="INTEGER" property="receive" />
30   - <result column="receive_user_id" jdbcType="VARCHAR" property="receive_user_id" />
31   - <result column="avsample" jdbcType="INTEGER" property="avsample" />
32   - <result column="task_id" jdbcType="VARCHAR" property="task_id" />
33   - <result column="bucket" jdbcType="VARCHAR" property="bucket" />
34   - <result column="plat" jdbcType="INTEGER" property="plat" />
35   - <result column="duration" jdbcType="INTEGER" property="duration" />
36   - <result column="category" jdbcType="VARCHAR" property="category" />
37   - <result column="video_user_id" jdbcType="VARCHAR" property="video_user_id" />
38   - <result column="source" jdbcType="VARCHAR" property="source" />
39   - <result column="video_md5" jdbcType="VARCHAR" property="video_md5" />
40   - <result column="avsample_imgs" jdbcType="LONGVARCHAR" property="avsample_imgs" />
41   - <result column="avsample_msg" jdbcType="LONGVARCHAR" property="avsample_msg" />
42   - </resultMap>
  4 + <resultMap id="BaseResultMap" type="com.cnlive.shenhe.entity.ShyVideos">
  5 + <!--
  6 + WARNING - @mbg.generated
  7 + -->
  8 + <id column="id" jdbcType="INTEGER" property="id"/>
  9 + <result column="video_title" jdbcType="VARCHAR" property="video_title"/>
  10 + <result column="spid" jdbcType="INTEGER" property="spid"/>
  11 + <result column="video_url" jdbcType="VARCHAR" property="video_url"/>
  12 + <result column="video_poster" jdbcType="VARCHAR" property="video_poster"/>
  13 + <result column="video_imgs" jdbcType="VARCHAR" property="video_imgs"/>
  14 + <result column="video_tags" jdbcType="VARCHAR" property="video_tags"/>
  15 + <result column="updater" jdbcType="VARCHAR" property="updater"/>
  16 + <result column="auditor_id" jdbcType="VARCHAR" property="auditor_id"/>
  17 + <result column="callback" jdbcType="VARCHAR" property="callback"/>
  18 + <result column="video_priority" jdbcType="VARCHAR" property="video_priority"/>
  19 + <result column="attr_tags" jdbcType="VARCHAR" property="attr_tags"/>
  20 + <result column="msg" jdbcType="VARCHAR" property="msg"/>
  21 + <result column="shenhe_type" jdbcType="INTEGER" property="shenhe_type"/>
  22 + <result column="state" jdbcType="INTEGER" property="state"/>
  23 + <result column="video_upload_time" jdbcType="TIMESTAMP" property="video_upload_time"/>
  24 + <result column="video_keyword" jdbcType="VARCHAR" property="video_keyword"/>
  25 + <result column="video_desc" jdbcType="VARCHAR" property="video_desc"/>
  26 + <result column="video_id" jdbcType="VARCHAR" property="video_id"/>
  27 + <result column="created_at" jdbcType="TIMESTAMP" property="created_at"/>
  28 + <result column="updated_at" jdbcType="TIMESTAMP" property="updated_at"/>
  29 + <result column="receive" jdbcType="INTEGER" property="receive"/>
  30 + <result column="receive_user_id" jdbcType="VARCHAR" property="receive_user_id"/>
  31 + <result column="avsample" jdbcType="INTEGER" property="avsample"/>
  32 + <result column="task_id" jdbcType="VARCHAR" property="task_id"/>
  33 + <result column="bucket" jdbcType="VARCHAR" property="bucket"/>
  34 + <result column="plat" jdbcType="INTEGER" property="plat"/>
  35 + <result column="duration" jdbcType="INTEGER" property="duration"/>
  36 + <result column="category" jdbcType="VARCHAR" property="category"/>
  37 + <result column="video_user_id" jdbcType="VARCHAR" property="video_user_id"/>
  38 + <result column="source" jdbcType="VARCHAR" property="source"/>
  39 + <result column="video_md5" jdbcType="VARCHAR" property="video_md5"/>
  40 + <result column="avsample_imgs" jdbcType="LONGVARCHAR" property="avsample_imgs"/>
  41 + <result column="avsample_msg" jdbcType="LONGVARCHAR" property="avsample_msg"/>
  42 + </resultMap>
  43 +
  44 + <select id="selectBySpId" resultType="com.cnlive.shenhe.entity.ShyVideos">
  45 + select *
  46 + from shy_videos
  47 + <where>
  48 + <if test="id != null">
  49 + and id = #{id}
  50 + </if>
  51 + <if test="spId != null and spId != 0">
  52 + and spid = #{spId}
  53 + </if>
  54 + </where>
  55 + </select>
43 56 </mapper>
44 57 \ No newline at end of file
... ...