修复代码

nladmin-common/src/main/java/org/nl/exception/handler/GlobalExceptionHandler.java

@@ -56,7 +56,7 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(value = NotLoginException.class)
     public ResponseEntity<ApiError> notLoginException(Exception e) {
-        log.error(ThrowableUtil.getStackTrace(e));
+//        log.error(ThrowableUtil.getStackTrace(e));
         return buildResponseEntity(ApiError.error(401,"token 失效"));
     }
 

nladmin-system/src/main/java/org/nl/modules/security/rest/AuthorizationController.java

@@ -67,7 +67,6 @@ import java.util.concurrent.TimeUnit;
 @RequiredArgsConstructor
 @Api(tags = "系统：系统授权接口")
 public class AuthorizationController {
-//    private final SecurityProperties properties;
     private final RedisUtils redisUtils;
     private final OnlineUserService onlineUserService;
     private final UserService userService;
@@ -126,7 +125,6 @@ public class AuthorizationController {
         return ResponseEntity.ok(authInfo);
     }
 
-
     @ApiOperation("获取用户信息")
     @GetMapping(value = "/info")
     public ResponseEntity<Object> getUserInfo() {

nladmin-system/src/main/java/org/nl/modules/security/rest/test.java

@@ -4,7 +4,7 @@ import cn.dev33.satoken.secure.SaSecureUtil;
 
 /**
  * @author lyd
- * @description
+ * @description 密码加密测试
  */
 public class test {
     public static void main(String[] args) {

nladmin-system/src/main/java/org/nl/modules/security/satoken/SaTokenConfigure.java

@@ -4,6 +4,8 @@ import cn.dev33.satoken.interceptor.SaInterceptor;
 import cn.dev33.satoken.jwt.StpLogicJwtForSimple;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
@@ -15,26 +17,27 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
  * @description: sa-token的配置路由拦截
  * @Date: 2022-09-20
  */
+@Slf4j
+@RequiredArgsConstructor
 @Configuration
 public class SaTokenConfigure implements WebMvcConfigurer {
 
+    // 白名单
+    private final SecurityProperties securityProperties;
+
     // Sa-Token 整合 jwt (Simple 简单模式)
     @Bean
     public StpLogic getStpLogicJwt() {
         return new StpLogicJwtForSimple();
     }
 
-    String[] whitelist = new String[]{"/auth/login", "/auth/code","auth/logout", "/swagger-ui.html", "/swagger-resources/**",
-            "/webjars/**", "/*/api-docs", "/avatar/**", "/file/**", "/druid/**", "/favicon.ico",
-            "/*.html", "/**/*.html", "/**/*.css", "/**/*.js","/webSocket/**"};
-
     // 注册 Sa-Token 拦截器，打开注解式鉴权功能
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
         // 注册 Sa-Token 拦截器，打开注解式鉴权功能
         registry.addInterceptor(new SaInterceptor(handle -> StpUtil.checkLogin()))
                 .addPathPatterns("/**")
-                .excludePathPatterns(whitelist); // 白名单
+                .excludePathPatterns(securityProperties.getExcludes()); // 白名单
     }
 
     /**

nladmin-system/src/main/java/org/nl/modules/security/satoken/SecurityProperties.java

@@ -0,0 +1,20 @@
+package org.nl.modules.security.satoken;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+/**
+ * @author: lyd
+ * @description: 白名单 - 统一放到yml管理
+ * @Date: 2022/9/22
+ */
+@Data
+@Component
+@ConfigurationProperties(prefix = "security")
+public class SecurityProperties {
+    /**
+     * 排除路径
+     */
+    private String[] excludes;
+}

nladmin-system/src/main/java/org/nl/modules/security/satoken/hint.md

@@ -61,4 +61,9 @@ public class UserDto extends BaseDTO implements Serializable {
 
     private Date pwdResetTime;
 }
+```
+
+### 加密规则
+```
+SaSecureUtil.md5BySalt("123456", "salt")
 ```

nladmin-system/src/main/java/org/nl/modules/security/service/OnlineUserService.java

@@ -37,18 +37,12 @@ import java.util.*;
 @Slf4j
 public class OnlineUserService {
 
-//    private final SecurityProperties properties;
     private final RedisUtils redisUtils;
 
     public OnlineUserService(RedisUtils redisUtils) {
         this.redisUtils = redisUtils;
     }
 
-//    public OnlineUserService(SecurityProperties properties, RedisUtils redisUtils) {
-//        this.properties = properties;
-//        this.redisUtils = redisUtils;
-//    }
-
     /**
      * 保存在线用户信息
      * @param userDto /

nladmin-system/src/main/java/org/nl/modules/system/rest/GridFieldController.java

@@ -1,6 +1,5 @@
 package org.nl.modules.system.rest;
 
-import com.alibaba.fastjson.JSONArray;
 import com.alibaba.fastjson.JSONObject;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;

nladmin-system/src/main/java/org/nl/modules/system/rest/UserController.java

@@ -63,12 +63,10 @@ import java.util.stream.Collectors;
 @RequiredArgsConstructor
 public class UserController {
 
-//    private final PasswordEncoder passwordEncoder;
     private final UserService userService;
     private final DataService dataService;
     private final DeptService deptService;
     private final RoleService roleService;
-//    private final VerifyService verificationCodeService;
 
     @ApiOperation("导出用户数据")
     @GetMapping(value = "/download")
@@ -109,7 +107,6 @@ public class UserController {
     public ResponseEntity<Object> create(@Validated @RequestBody User resources){
         checkLevel(resources);
         // 默认密码 123456
-//        resources.setPassword(passwordEncoder.encode("123456"));
         resources.setPassword(SaSecureUtil.md5BySalt("123456", "salt"));
         userService.create(resources);
         return new ResponseEntity<>(HttpStatus.CREATED);
@@ -140,7 +137,7 @@ public class UserController {
     @ApiOperation("删除用户")
     @DeleteMapping
     @SaCheckPermission("user:del")
-    public ResponseEntity<Object> delete(@RequestBody Set<Long> ids){
+    public ResponseEntity<Object> delete(@RequestBody Set<Long> ids) {
         for (Long id : ids) {
             Integer currentLevel =  Collections.min(roleService.findByUsersId(StpUtil.getLoginIdAsLong()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
             Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
@@ -155,16 +152,17 @@ public class UserController {
     @ApiOperation("修改密码")
     @PostMapping(value = "/updatePass")
     public ResponseEntity<Object> updatePass(@RequestBody UserPassVo passVo) throws Exception {
+        // 解密，得到字符密码
         String oldPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getOldPass());
         String newPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getNewPass());
         UserDto user = userService.findByName(SecurityUtils.getCurrentUsername());
-//        if(!passwordEncoder.matches(oldPass, user.getPassword())){
-//            throw new BadRequestException("修改失败，旧密码错误");
-//        }
-//        if(passwordEncoder.matches(newPass, user.getPassword())){
-//            throw new BadRequestException("新密码不能与旧密码相同");
-//        }
-//        userService.updatePass(user.getUsername(),passwordEncoder.encode(newPass));
+        if (!SaSecureUtil.md5BySalt(user.getPassword(), "salt").equals(SaSecureUtil.md5BySalt(oldPass, "salt"))) {
+            throw new BadRequestException("修改失败，旧密码错误");
+        }
+        if (!SaSecureUtil.md5BySalt(user.getPassword(), "salt").equals(SaSecureUtil.md5BySalt(newPass, "salt"))) {
+            throw new BadRequestException("新密码不能与旧密码相同");
+        }
+        userService.updatePass(user.getUsername(),SaSecureUtil.md5BySalt(newPass, "salt"));
         return new ResponseEntity<>(HttpStatus.OK);
     }
 
@@ -174,19 +172,18 @@ public class UserController {
         return new ResponseEntity<>(userService.updateAvatar(avatar), HttpStatus.OK);
     }
 
-//    @Log("修改邮箱")
-//    @ApiOperation("修改邮箱")
-//    @PostMapping(value = "/updateEmail/{code}")
-//    public ResponseEntity<Object> updateEmail(@PathVariable String code,@RequestBody User user) throws Exception {
-//        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());
-//        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());
-////        if(!passwordEncoder.matches(password, userDto.getPassword())){
-////            throw new BadRequestException("密码错误");
-////        }
-//        verificationCodeService.validated(CodeEnum.EMAIL_RESET_EMAIL_CODE.getKey() + user.getEmail(), code);
-//        userService.updateEmail(userDto.getUsername(),user.getEmail());
-//        return new ResponseEntity<>(HttpStatus.OK);
-//    }
+    @Log("修改邮箱")
+    @ApiOperation("修改邮箱")
+    @PostMapping(value = "/updateEmail/{code}")
+    public ResponseEntity<Object> updateEmail(@PathVariable String code,@RequestBody User user) throws Exception {
+        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());
+        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());
+        if(!SaSecureUtil.md5BySalt(user.getPassword(), "salt").equals(SaSecureUtil.md5BySalt(password, "salt"))){
+            throw new BadRequestException("密码错误");
+        }
+        userService.updateEmail(userDto.getUsername(),user.getEmail());
+        return new ResponseEntity<>(HttpStatus.OK);
+    }
 
     /**
      * 如果当前用户的角色级别低于创建用户的角色级别，则抛出权限不足的错误

nladmin-system/src/main/java/org/nl/modules/system/service/VerifyService.java

@@ -1,41 +0,0 @@
-///*
-// *  Copyright 2019-2020 Zheng Jie
-// *
-// *  Licensed under the Apache License, Version 2.0 (the "License");
-// *  you may not use this file except in compliance with the License.
-// *  You may obtain a copy of the License at
-// *
-// *  http://www.apache.org/licenses/LICENSE-2.0
-// *
-// *  Unless required by applicable law or agreed to in writing, software
-// *  distributed under the License is distributed on an "AS IS" BASIS,
-// *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// *  See the License for the specific language governing permissions and
-// *  limitations under the License.
-// */
-//package org.nl.modules.system.service;
-//
-//import org.nl.domain.vo.EmailVo;
-//
-///**
-// * @author Zheng Jie
-// * @date 2018-12-26
-// */
-//public interface VerifyService {
-//
-//    /**
-//     * 发送验证码
-//     * @param email /
-//     * @param key /
-//     * @return /
-//     */
-//    EmailVo sendEmail(String email, String key);
-//
-//
-//    /**
-//     * 验证
-//     * @param code /
-//     * @param key /
-//     */
-//    void validated(String key, String code);
-//}

nladmin-system/src/main/resources/config/application.yml

@@ -46,3 +46,31 @@ logging:
   file:
     path: C:\log\wms
   config: classpath:logback-spring.xml
+# sa-token白名单配置
+security:
+  # 排除路径
+  excludes:
+    # 认证
+    - /auth/login
+    - /auth/code
+    - /auth/logout
+    # swagger
+    - /swagger-ui.html
+    - /swagger-resources/**
+    - /webjars/**
+    - /file/**
+    - /webSocket/**
+    # 静态资源
+    - /*.html
+    - /**/*.html
+    - /**/*.css
+    - /**/*.js
+    # swagger 文档配置
+    - /favicon.ico
+    - /*/api-docs
+    - /*/api-docs/**
+    # druid 监控配置
+    - /druid/**
+    # actuator 监控配置
+    - /actuator
+    - /actuator/**

nladmin-ui/src/api/tools/alipay.js

@@ -1,25 +0,0 @@
-import request from '@/utils/request'
-
-export function get() {
-  return request({
-    url: 'api/aliPay',
-    method: 'get'
-  })
-}
-
-export function update(data) {
-  return request({
-    url: 'api/aliPay',
-    data,
-    method: 'put'
-  })
-}
-
-// 支付
-export function toAliPay(url, data) {
-  return request({
-    url: 'api/' + url,
-    data,
-    method: 'post'
-  })
-}

nladmin-ui/src/utils/request.js

@@ -62,6 +62,7 @@ service.interceptors.response.use(
       console.log(code)
       if (code) {
         if (code === 401) {
+          // debugger
           store.dispatch('LogOut').then(() => {
             // 用户登录界面提示
             Cookies.set('point', 401)

nladmin-ui/src/views/login.vue

@@ -144,6 +144,7 @@ export default {
     },
     point() {
       const point = Cookies.get('point') !== undefined
+      console.log(point)
       if (point) {
         this.$notify({
           title: '提示',

nladmin-ui/src/views/tools/aliPay/index.vue

@@ -1,48 +0,0 @@
-<!--<template>-->
-<!--  <el-tabs v-model="activeName" style="padding-left: 5px;">-->
-<!--    <el-tab-pane label="参数配置" name="first">-->
-<!--      <Config />-->
-<!--    </el-tab-pane>-->
-<!--    <el-tab-pane label="支付测试" name="second">-->
-<!--      <ToPay />-->
-<!--    </el-tab-pane>-->
-<!--    <el-tab-pane label="使用说明" name="third">-->
-<!--      <div>-->
-<!--        <blockquote class="my-blockquote">注意</blockquote>-->
-<!--        <pre class="my-code">-->
-<!--测试所用参数都是沙箱环境，仅供测试使用，申请地址：<a style="color: #00a0e9" href="https://openhome.alipay.com/platform/appDaily.htm?tab=info" target="_blank">支付宝开发平台</a>-->
-<!--如需付款测试，请使用-->
-<!--账号：uuxesw9745@sandbox.com-->
-<!--密码与支付密码：111111</pre>-->
-<!--        <blockquote class="my-blockquote"> 支付设置</blockquote>-->
-<!--        <pre class="my-code">-->
-<!--// 支付提供两个接口，-->
-<!--// PC端与手机端，并且在前端使用代码识别-->
-<!--if (/(Android)/i.test(navigator.userAgent)){     // 判断是否为Android手机-->
-<!--    url = "/aliPay/toPayAsWeb"-->
-<!--}else if(/(iPhone|iPad|iPod|iOS)/i.test(navigator.userAgent)){  // 判断是否为苹果手机-->
-<!--    url = "/aliPay/toPayAsWeb"-->
-<!--} else {-->
-<!--    url = "/aliPay/toPayAsPC"-->
-<!--}</pre>-->
-<!--      </div>-->
-<!--    </el-tab-pane>-->
-<!--  </el-tabs>-->
-<!--</template>-->
-
-<!--<script>-->
-<!--import Config from './config'-->
-<!--import ToPay from './toPay'-->
-<!--export default {-->
-<!--  name: 'AliPay',-->
-<!--  components: { Config, ToPay },-->
-<!--  data() {-->
-<!--    return {-->
-<!--      activeName: 'second'-->
-<!--    }-->
-<!--  }-->
-<!--}-->
-<!--</script>-->
-
-<!--<style scoped>-->
-<!--</style>-->