🔒 Fixing security issues. 微信模块权限完善，SQL 维护、token 过期提示优化

db/2pigxx.sql

@@ -680,8 +680,8 @@ CREATE TABLE `sys_tenant` (
   `id` int(11) NOT NULL AUTO_INCREMENT COMMENT '租户id',
   `name` varchar(255) DEFAULT NULL,
   `code` varchar(64) DEFAULT NULL,
-  `start_time` timestamp NULL DEFAULT NULL COMMENT '开始时间',
-  `end_time` timestamp NULL DEFAULT NULL COMMENT '结束时间',
+  `start_time` datetime DEFAULT NULL COMMENT '开始时间',
+  `end_time` datetime DEFAULT NULL COMMENT '结束时间',
   `status` char(1) DEFAULT '0',
   `del_flag` char(1) DEFAULT '0',
   `create_time` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建',

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/ResourceAuthExceptionEntryPoint.java

@@ -26,6 +26,7 @@ import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.MediaType;
 import org.springframework.security.authentication.CredentialsExpiredException;
+import org.springframework.security.authentication.InsufficientAuthenticationException;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
@@ -59,7 +60,8 @@ public class ResourceAuthExceptionEntryPoint implements AuthenticationEntryPoint
 		result.setData(authException.getMessage());
 		result.setCode(CommonConstants.FAIL);
 
-		if (authException instanceof CredentialsExpiredException) {
+		if (authException instanceof CredentialsExpiredException
+				|| authException instanceof InsufficientAuthenticationException) {
 			String msg = SpringSecurityMessageSource.getAccessor().getMessage(
 					"AbstractUserDetailsAuthenticationProvider.credentialsExpired", authException.getMessage());
 			result.setMsg(msg);

pigx-visual/pigx-monitor/src/main/java/com/pig4cloud/pigx/monitor/config/JacksonConfig.java

@@ -15,12 +15,12 @@ import java.util.Locale;
 import java.util.TimeZone;
 
 /**
- * JacksonConfig
+ * JacksonConfig 扩展增加 spring boot 默认配置
+ * <p>
+ * 自身序列化机制 {@link de.codecentric.boot.admin.server.utils.jackson.AdminServerModule}
  *
- * @author L.cm
- * @author: lengleng
- * @author: lishangbu
- * @date: 2018/10/22
+ * @author lengleng
+ * @date 2020-06-07
  */
 @Configuration
 @ConditionalOnClass(ObjectMapper.class)
@@ -31,7 +31,7 @@ public class JacksonConfig {
 	 * 覆盖core 模块提供的序列方式，增加springboot admin 序列化
 	 *
 	 * @param adminJacksonModule spring boot admin 提供的序列化
-	 * @return
+	 * @return Jackson customizer
 	 */
 	@Bean
 	public Jackson2ObjectMapperBuilderCustomizer customizer(SimpleModule adminJacksonModule) {

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxAccountFansController.java

@@ -110,6 +110,7 @@ public class WxAccountFansController {
 	 * @return
 	 */
 	@PostMapping("/sync/{appId}")
+	@PreAuthorize("@pms.hasPermission('mp_wxaccountfans_sync')")
 	public R sync(@PathVariable String appId) {
 		return R.ok(wxAccountFansService.syncAccountFans(appId));
 	}

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxAutoReplyController.java

@@ -8,6 +8,7 @@ import com.pig4cloud.pigx.mp.constant.ReplyTypeEnum;
 import com.pig4cloud.pigx.mp.entity.WxAutoReply;
 import com.pig4cloud.pigx.mp.service.WxAutoReplyService;
 import lombok.AllArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
@@ -56,6 +57,7 @@ public class WxAutoReplyController {
 	 * @return R
 	 */
 	@PostMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxautoreply_add')")
 	public R save(@RequestBody WxAutoReply wxAutoReply) {
 		this.jude(wxAutoReply);
 		return R.ok(wxAutoReplyService.save(wxAutoReply));
@@ -68,6 +70,7 @@ public class WxAutoReplyController {
 	 * @return R
 	 */
 	@PutMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxautoreply_edit')")
 	public R updateById(@RequestBody WxAutoReply wxAutoReply) {
 		this.jude(wxAutoReply);
 		return R.ok(wxAutoReplyService.updateById(wxAutoReply));
@@ -80,6 +83,7 @@ public class WxAutoReplyController {
 	 * @return R
 	 */
 	@DeleteMapping("/{id}")
+	@PreAuthorize("@pms.hasPermission('mp_wxautoreply_del')")
 	public R removeById(@PathVariable String id) {
 		return R.ok(wxAutoReplyService.removeById(id));
 	}

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxFansMsgController.java

@@ -23,6 +23,7 @@ import com.pig4cloud.pigx.mp.entity.WxMsg;
 import com.pig4cloud.pigx.mp.service.WxMsgService;
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 
@@ -69,6 +70,7 @@ public class WxFansMsgController {
 	 * @return R
 	 */
 	@PostMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxmsg_add')")
 	public R save(@RequestBody WxMsg wxMsg) {
 		return wxMsgService.saveAndPushMsg(wxMsg);
 	}
@@ -80,6 +82,7 @@ public class WxFansMsgController {
 	 * @return R
 	 */
 	@PutMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxmsg_edit')")
 	public R updateById(@RequestBody WxMsg wxMsg) {
 		return R.ok(wxMsgService.updateById(wxMsg));
 	}
@@ -91,6 +94,7 @@ public class WxFansMsgController {
 	 * @return R
 	 */
 	@DeleteMapping("/{id}")
+	@PreAuthorize("@pms.hasPermission('mp_wxmsg_del')")
 	public R removeById(@PathVariable String id) {
 		return R.ok(wxMsgService.removeById(id));
 	}

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxMaterialController.java

@@ -17,6 +17,7 @@ import me.chanjar.weixin.mp.bean.material.*;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -48,6 +49,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PostMapping("/materialFileUpload")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public R materialFileUpload(@RequestParam("file") MultipartFile mulFile,
 								@RequestParam String appId,
 								@RequestParam("title") String title,
@@ -90,6 +92,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PostMapping("/materialNews")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public R materialNewsUpload(@RequestBody JSONObject data) {
 		try {
 			JSONArray jSONArray = data.getJSONArray("articles");
@@ -118,6 +121,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PutMapping("/materialNews")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public R materialNewsUpdate(@RequestBody JSONObject data) {
 		try {
 			String mediaId = data.getStr("mediaId");
@@ -152,6 +156,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PostMapping("/newsImgUpload")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public String newsImgUpload(@RequestParam("file") MultipartFile mulFile, @RequestParam String appId) throws Exception {
 		File file = FileUtil.createTempFile(FileUtil.getTmpDir());
 		mulFile.transferTo(file);
@@ -171,6 +176,7 @@ public class WxMaterialController {
 	 * @return R
 	 */
 	@DeleteMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_del')")
 	public R materialDel(String appId, String id) {
 		WxMpService wxMpService = WxMpInitConfigRunner.getMpServices().get(appId);
 		WxMpMaterialService wxMpMaterialService = wxMpService.getMaterialService();

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxMenuController.java

@@ -77,6 +77,7 @@ public class WxMenuController {
 	}
 
 	@DeleteMapping("/{appId}")
+	@PreAuthorize("@pms.hasPermission('mp_wxmenu_del')")
 	public R delete(@PathVariable("appId") String appId) {
 		return wxMenuService.delete(appId);
 	}

pom.xml

@@ -42,7 +42,7 @@
 		<maven.compiler.version>3.8.1</maven.compiler.version>
 		<git.commit.version>2.2.5</git.commit.version>
 		<spring-boot-admin.version>2.2.3</spring-boot-admin.version>
-		<hutool.version>5.3.6</hutool.version>
+		<hutool.version>5.3.7</hutool.version>
 		<kaptcha.version>1.2.0</kaptcha.version>
 		<swagger.fox.version>2.9.2</swagger.fox.version>
 		<knife4j.version>2.0.3</knife4j.version>