zianxin/pigx
1
0 Fork 0
mirror of http://git.pig4cloud.com/pig/pigx.git synced 2026-11-11 05:19:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

🔒 修复安全问题。 绕过短信验证码

Browse Source
This commit is contained in:
冷冷 committed 2019-02-15 15:09:00 +08:00
1 parent a572dedc33
commit 396ba6989e
5 files changed
+40 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pigx-gateway/src/main/java/com/pig4cloud/pigx/gateway/filter/ValidateCodeGatewayFilter.java
+13 -1
View File
@@ -22,6 +22,7 @@ import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.pig4cloud.pigx.common.core.constant.CommonConstants;
import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
import com.pig4cloud.pigx.common.core.constant.enums.LoginTypeEnum;
import com.pig4cloud.pigx.common.core.exception.ValidateCodeException;
import com.pig4cloud.pigx.common.core.util.R;
import com.pig4cloud.pigx.common.core.util.WebUtils;
@@ -58,7 +59,8 @@ public class ValidateCodeGatewayFilter extends AbstractGatewayFilterFactory {
// 不是登录请求，直接向下执行
if (!StrUtil.containsAnyIgnoreCase(request.getURI().getPath()
, SecurityConstants.OAUTH_TOKEN_URL, SecurityConstants.SMS_TOKEN_URL)) {
, SecurityConstants.OAUTH_TOKEN_URL, SecurityConstants.SMS_TOKEN_URL
, SecurityConstants.SOCIAL_TOKEN_URL)) {
return chain.filter(exchange);
}
@@ -75,6 +77,16 @@ public class ValidateCodeGatewayFilter extends AbstractGatewayFilterFactory {
return chain.filter(exchange);
}
// 如果是社交登录，判断是否包含SMS
if (StrUtil.containsAnyIgnoreCase(request.getURI().getPath(), SecurityConstants.SOCIAL_TOKEN_URL)) {
String mobile = request.getQueryParams().getFirst("mobile");
if (StrUtil.containsAny(mobile, LoginTypeEnum.SMS.getType())) {
throw new ValidateCodeException("验证码不合法");
} else {
return chain.filter(exchange);
}
}
//校验验证码
checkCode(request);
} catch (Exception e) {