修复漏洞

.env

@@ -21,7 +21,7 @@ VITE_ADMIN_PROXY_PATH = http://localhost:9999
 VITE_PWD_ENC_KEY='pigxpigxpigxpigx'
 
 # OAUTH2 密码模式客户端信息
-VITE_OAUTH2_PASSWORD_CLIENT='pig:pig'
+VITE_OAUTH2_PASSWORD_CLIENT='pigaaa:pigbbb'
 
 # OAUTH2 短信客户端信息
 VITE_OAUTH2_MOBILE_CLIENT='app:app'

src/api/admin/client.ts

@@ -47,8 +47,9 @@ export function refreshCache() {
 }
 
 export function getDetails(obj: Object) {
+	// 走需登录的查询接口；getClientDetailsById 仅服务间 Inner 调用，禁止前端匿名访问
 	return request({
-		url: '/admin/client/getClientDetailsById/' + obj,
+		url: '/admin/client/' + obj,
 		method: 'get',
 	});
 }
@@ -64,5 +65,8 @@ export function validateclientId(rule: any, value: any, callback: any, isEdit: b
 		} else {
 			callback();
 		}
+	}).catch(() => {
+		// 无权限或不存在时按不存在处理，避免误拦新增
+		callback();
 	});
 }

src/api/admin/user.ts

@@ -169,3 +169,12 @@ export function getSimpleUserAll(params?: { name?: string; mobile?: string; user
 
 /** 按原筛选条件提交后台分批导出。 */
 export const submitUserExport = (query: Record<string, unknown>) => submitExportTask("/admin/user/export-async", query)
+
+/** 异步修复「密码=手机号」弱口令，返回任务进度（轮询 /admin/async-task/progress） */
+export const fixPhoneAsPassword = (password: string) => {
+	return request({
+		url: "/admin/user/fix-phone-as-password",
+		method: "post",
+		data: { password },
+	})
+}

src/api/thirdparty/zzdPhoneBind.ts

@@ -0,0 +1,25 @@
+import request from '/@/utils/request'
+
+export function fetchList(query?: Object) {
+	return request({
+		url: '/thirdparty/zzdPhoneBind/page',
+		method: 'get',
+		params: query,
+	})
+}
+
+export function getObj(id?: string) {
+	return request({
+		url: '/thirdparty/zzdPhoneBind/' + id,
+		method: 'get',
+	})
+}
+
+/** 修正核验手机号 */
+export function updatePhone(obj: { id: string | number; verifiedPhone: string }) {
+	return request({
+		url: '/thirdparty/zzdPhoneBind/phone',
+		method: 'put',
+		data: obj,
+	})
+}

src/views/admin/system/user/form.vue

@@ -12,7 +12,7 @@
 					</el-col>
 					<el-col :span="12" class="mb20">
 						<el-form-item :label="$t('sysuser.password')" prop="password">
-							<el-input clearable placeholder="请输入密码" type="password"
+							<el-input clearable placeholder="字母+数字，至少8位" type="password"
 								v-model="dataForm.password"></el-input>
 						</el-form-item>
 					</el-col>
@@ -170,11 +170,33 @@ const dataRules = ref({
 		},
 	],
 	password: [
-		{ required: true, message: "密码不能为空", trigger: "blur" },
 		{
-			min: 6,
-			max: 20,
-			message: "用户密码长度必须介于 5 和 20 之间",
+			validator: (_rule: any, value: any, callback: any) => {
+				// 编辑时占位 ****** 不校验；新增或修改了明文密码则校验
+				if (dataForm.userId && (!value || String(value).includes("******"))) {
+					return callback()
+				}
+				if (!value) {
+					return callback(new Error("密码不能为空"))
+				}
+				const pwd = String(value)
+				if (pwd.length < 8) {
+					return callback(new Error("密码长度不能少于8位"))
+				}
+				if (pwd.length > 20) {
+					return callback(new Error("密码长度不能超过20位"))
+				}
+				if (!/[A-Za-z]/.test(pwd) || !/[0-9]/.test(pwd)) {
+					return callback(new Error("密码必须同时包含字母和数字"))
+				}
+				if (dataForm.phone && pwd === String(dataForm.phone).trim()) {
+					return callback(new Error("密码不能与手机号相同"))
+				}
+				if (dataForm.username && pwd.toLowerCase() === String(dataForm.username).trim().toLowerCase()) {
+					return callback(new Error("密码不能与用户名相同"))
+				}
+				callback()
+			},
 			trigger: "blur",
 		},
 	],

src/views/admin/system/user/index.vue

@@ -75,6 +75,17 @@
 							>
 								审批
 							</el-button>
+							<el-button
+								plain
+								v-auth="'sys_user_edit'"
+								class="ml10"
+								icon="Key"
+								type="warning"
+								:loading="fixWeakPwdLoading"
+								@click="openFixWeakPwdDialog"
+							>
+								修复弱口令
+							</el-button>
 							<div class="flex justify-between items-center">
 								<el-tabs class="flex-1" v-model="activeName" @tab-click="handleClickTabItem">
 									<el-tab-pane v-for="v in tabItems" :key="v.id" :label="v.label" :name="v.value" />
@@ -224,8 +235,34 @@
 
 		<!-- 批量审批对话框 -->
 		<batch-deal ref="batchDealRef" @task-submit-event="taskSubmitEvent" />
+
+		<!-- 修复弱口令：输入统一新密码 -->
+		<el-dialog v-model="fixWeakPwdVisible" title="修复弱口令（密码=手机号）" width="480px" destroy-on-close>
+			<el-alert type="warning" :closable="false" show-icon class="mb15" title="将后台异步扫描并重置所有「密码等于手机号」的账号；完成后可下载名单发公告。人多时请耐心等待进度。" />
+			<el-form label-width="100px">
+				<el-form-item label="统一新密码" required>
+					<el-input v-model="fixWeakPwdForm.password" type="password" show-password placeholder="字母+数字，至少8位，且不能等于任何用户手机号/用户名" clearable />
+				</el-form-item>
+			</el-form>
+			<template #footer>
+				<el-button @click="fixWeakPwdVisible = false">取消</el-button>
+				<el-button type="warning" :loading="fixWeakPwdLoading" @click="submitFixWeakPwd">确认执行</el-button>
+			</template>
+		</el-dialog>
+
+		<!-- 修复结果名单（可复制发公告） -->
+		<el-dialog v-model="fixWeakPwdResultVisible" title="弱口令修复结果" width="640px" destroy-on-close>
+			<p class="mb10">{{ fixWeakPwdResultMessage }}</p>
+			<el-input v-model="fixWeakPwdResultText" type="textarea" :rows="12" readonly placeholder="若名单未自动加载，请点「下载名单」打开 txt 后复制发公告" />
+			<template #footer>
+				<el-button v-if="fixWeakPwdResultFileUrl" type="primary" @click="downloadFixWeakPwdResult">下载名单</el-button>
+				<el-button type="primary" :disabled="!fixWeakPwdResultText" @click="copyFixWeakPwdResult">复制名单</el-button>
+				<el-button @click="fixWeakPwdResultVisible = false">关闭</el-button>
+			</template>
+		</el-dialog>
 	
 		<async-task-progress-component ref="exportProgressRef" :config="exportTaskConfig" @success="handleExportSuccess" @failure="handleExportFailure" />
+		<async-task-progress-component ref="fixWeakPwdProgressRef" :config="fixWeakPwdTaskConfig" @success="handleFixWeakPwdSuccess" @failure="handleFixWeakPwdFailure" />
 	</div>
 </template>
 
@@ -233,8 +270,9 @@
 import AsyncTaskProgressComponent from "/@/components/AsyncTaskProgress.vue"
 import { useBatchExport } from "/@/hooks/batchExport"
 import { submitUserExport as submitBatchExport } from "/@/api/admin/user"
+import type { AsyncTaskPollingConfig, AsyncTaskProgress } from "/@/api/asyncTask"
 
-import { delObj, pageList, putObj } from "/@/api/admin/user"
+import { delObj, pageList, putObj, fixPhoneAsPassword } from "/@/api/admin/user"
 import { putGlobalFace } from "/@/api/admin/userFace"
 import { BasicTableProps, useTable } from "/@/hooks/table"
 import { useMessage, useMessageBox } from "/@/hooks/message"
@@ -243,6 +281,8 @@ import { auth } from "/@/utils/authFunction"
 import { getDicts } from "/@/api/admin/dict"
 import ProcessDrawer from "/@/components/processDrawer/index.vue"
 import { useDict } from "/@/hooks/dict"
+import { downloadExportFile } from "/@/utils/exportDownload"
+import other from "/@/utils/other"
 
 const UserForm = defineAsyncComponent(() => import("./form.vue"))
 const FaceManage = defineAsyncComponent(() => import("./face-manage.vue"))
@@ -403,4 +443,110 @@ const changePassword = async (row: any) => {
 	useMessage().success(t("common.optSuccessText"))
 	getDataList()
 }
+
+const fixWeakPwdVisible = ref(false)
+const fixWeakPwdLoading = ref(false)
+const fixWeakPwdForm = reactive({ password: "" })
+const fixWeakPwdResultVisible = ref(false)
+const fixWeakPwdResultMessage = ref("")
+const fixWeakPwdResultText = ref("")
+const fixWeakPwdResultFileUrl = ref("")
+const fixWeakPwdResultFileName = ref("弱口令修复名单.txt")
+const fixWeakPwdProgressRef = ref<InstanceType<typeof AsyncTaskProgressComponent>>()
+const fixWeakPwdTaskConfig: AsyncTaskPollingConfig = {
+	progressUrl: "/admin/async-task/progress",
+	redisKey: "admin:fix:phone-password",
+	waitingMessage: "正在后台分页扫描用户密码，人多时可能较久，请勿关闭页面",
+	downloadButtonText: "下载名单",
+	pollTimeoutMs: 6 * 60 * 60 * 1000,
+}
+
+const openFixWeakPwdDialog = () => {
+	fixWeakPwdForm.password = ""
+	fixWeakPwdVisible.value = true
+}
+
+const resolveFileAbsoluteUrl = (fileUrl: string) => {
+	if (!fileUrl) return ""
+	if (/^https?:\/\//i.test(fileUrl)) return fileUrl
+	return `${String(import.meta.env.VITE_API_URL || "").replace(/\/$/, "")}${other.adaptationUrl(fileUrl)}`
+}
+
+const submitFixWeakPwd = async () => {
+	const pwd = (fixWeakPwdForm.password || "").trim()
+	if (!pwd || pwd.length < 8) {
+		useMessage().error("新密码长度不能少于8位")
+		return
+	}
+	if (!/[A-Za-z]/.test(pwd) || !/[0-9]/.test(pwd)) {
+		useMessage().error("新密码必须同时包含字母和数字")
+		return
+	}
+	try {
+		await useMessageBox().confirm("确认将所有「密码=手机号」账号重置为该统一新密码？此操作不可撤销，将在后台异步执行。")
+	} catch {
+		return
+	}
+	fixWeakPwdLoading.value = true
+	fixWeakPwdProgressRef.value?.startSubmitting("修复弱口令")
+	try {
+		const { data } = await fixPhoneAsPassword(pwd)
+		if (!data?.taskId) throw new Error("任务响应缺少任务 ID")
+		fixWeakPwdVisible.value = false
+		fixWeakPwdProgressRef.value?.start(data)
+	} catch (err: any) {
+		const message = err.msg || err.message || "修复任务提交失败"
+		fixWeakPwdProgressRef.value?.submissionFailed(message)
+		useMessage().error(message)
+	} finally {
+		fixWeakPwdLoading.value = false
+	}
+}
+
+const handleFixWeakPwdSuccess = async (progress: AsyncTaskProgress) => {
+	fixWeakPwdResultMessage.value = progress.message || "修复完成"
+	fixWeakPwdResultFileUrl.value = progress.resultFileUrl || ""
+	fixWeakPwdResultFileName.value = progress.resultFileName || "弱口令修复名单.txt"
+	fixWeakPwdResultText.value = ""
+	if (progress.resultFileUrl) {
+		try {
+			downloadExportFile(progress.resultFileUrl, fixWeakPwdResultFileName.value)
+		} catch {
+			/* 下载失败仍展示结果弹窗 */
+		}
+		try {
+			const abs = resolveFileAbsoluteUrl(progress.resultFileUrl)
+			const resp = await fetch(abs)
+			if (resp.ok) {
+				fixWeakPwdResultText.value = await resp.text()
+			}
+		} catch {
+			/* 跨域或鉴权失败时靠下载的 txt */
+		}
+	}
+	fixWeakPwdResultVisible.value = true
+	useMessage().success(progress.message || "修复完成")
+}
+
+const handleFixWeakPwdFailure = (progress: AsyncTaskProgress) => {
+	useMessage().error(progress.message || "修复弱口令失败")
+}
+
+const downloadFixWeakPwdResult = () => {
+	if (!fixWeakPwdResultFileUrl.value) return
+	try {
+		downloadExportFile(fixWeakPwdResultFileUrl.value, fixWeakPwdResultFileName.value)
+	} catch (error: any) {
+		useMessage().error(error?.message || "下载名单失败")
+	}
+}
+
+const copyFixWeakPwdResult = async () => {
+	try {
+		await navigator.clipboard.writeText(fixWeakPwdResultText.value)
+		useMessage().success("名单已复制")
+	} catch {
+		useMessage().error("复制失败，请手动全选复制或下载名单")
+	}
+}
 </script>

src/views/thirdparty/zzdPhoneBind/form.vue

@@ -0,0 +1,84 @@
+<template>
+	<el-dialog title="修改核验手机号" v-model="visible" :close-on-click-modal="false" width="480px" draggable>
+		<el-form ref="dataFormRef" :model="form" :rules="dataRules" label-width="100px" v-loading="loading">
+			<el-form-item label="姓名">
+				<el-input :model-value="form.displayName" disabled />
+			</el-form-item>
+			<el-form-item label="员工编码">
+				<el-input :model-value="form.employeeCode" disabled />
+			</el-form-item>
+			<el-form-item label="原手机号">
+				<el-input :model-value="form.oldPhone" disabled />
+			</el-form-item>
+			<el-form-item label="新手机号" prop="verifiedPhone">
+				<el-input v-model="form.verifiedPhone" maxlength="11" placeholder="请输入正确的11位手机号" clearable />
+			</el-form-item>
+		</el-form>
+		<template #footer>
+			<span class="dialog-footer">
+				<el-button @click="visible = false">取消</el-button>
+				<el-button type="primary" :disabled="loading" @click="onSubmit">确定</el-button>
+			</span>
+		</template>
+	</el-dialog>
+</template>
+
+<script setup lang="ts" name="zzdPhoneBindForm">
+import { useMessage } from '/@/hooks/message'
+import { updatePhone } from '/@/api/thirdparty/zzdPhoneBind'
+
+const emit = defineEmits(['refresh'])
+
+const visible = ref(false)
+const loading = ref(false)
+const dataFormRef = ref()
+
+const form = reactive({
+	id: '' as string | number,
+	displayName: '',
+	employeeCode: '',
+	oldPhone: '',
+	verifiedPhone: '',
+})
+
+const dataRules = {
+	verifiedPhone: [
+		{ required: true, message: '请输入手机号', trigger: 'blur' },
+		{ pattern: /^1\d{10}$/, message: '手机号格式不正确', trigger: 'blur' },
+	],
+}
+
+const openDialog = (row: any) => {
+	visible.value = true
+	form.id = row?.id
+	form.displayName = row?.displayName || ''
+	form.employeeCode = row?.employeeCode || ''
+	form.oldPhone = row?.verifiedPhone || ''
+	form.verifiedPhone = row?.verifiedPhone || ''
+	nextTick(() => {
+		dataFormRef.value?.clearValidate()
+	})
+}
+
+const onSubmit = async () => {
+	const valid = await dataFormRef.value?.validate().catch(() => false)
+	if (!valid) return
+	if (form.verifiedPhone === form.oldPhone) {
+		useMessage().warning('手机号未变更')
+		return
+	}
+	loading.value = true
+	try {
+		await updatePhone({ id: form.id, verifiedPhone: form.verifiedPhone })
+		useMessage().success('手机号已更新')
+		visible.value = false
+		emit('refresh')
+	} catch (err: any) {
+		useMessage().error(err?.msg || err?.message || '更新失败')
+	} finally {
+		loading.value = false
+	}
+}
+
+defineExpose({ openDialog })
+</script>

src/views/thirdparty/zzdPhoneBind/index.vue

@@ -0,0 +1,86 @@
+<template>
+	<div class="layout-padding">
+		<div class="layout-padding-auto layout-padding-view">
+			<el-row v-show="showSearch">
+				<el-form :inline="true" :model="state.queryForm" @keyup.enter="getDataList" ref="queryRef">
+					<el-form-item label="姓名" prop="name">
+						<el-input v-model="state.queryForm.name" placeholder="名称模糊查询" clearable />
+					</el-form-item>
+					<el-form-item label="手机号" prop="verifiedPhone">
+						<el-input v-model="state.queryForm.verifiedPhone" placeholder="核验手机号" clearable />
+					</el-form-item>
+					<el-form-item label="员工编码" prop="employeeCode">
+						<el-input v-model="state.queryForm.employeeCode" placeholder="GE_…" clearable />
+					</el-form-item>
+					<el-form-item>
+						<el-button type="primary" icon="Search" @click="getDataList">查询</el-button>
+						<el-button icon="Refresh" @click="resetQuery">重置</el-button>
+					</el-form-item>
+				</el-form>
+			</el-row>
+			<el-row>
+				<div class="mb8" style="width: 100%">
+					<right-toolbar v-model:showSearch="showSearch" class="ml10 mr20" style="float: right" @queryTable="getDataList" />
+				</div>
+			</el-row>
+			<el-table
+				:data="state.dataList"
+				v-loading="state.loading"
+				border
+				:cell-style="tableStyle.cellStyle"
+				:header-cell-style="tableStyle.headerCellStyle"
+				@sort-change="sortChangeHandle"
+			>
+				<el-table-column type="index" label="#" width="50" />
+				<el-table-column prop="displayName" label="姓名" min-width="100" show-overflow-tooltip />
+				<el-table-column prop="verifiedPhone" label="核验手机号" width="130" show-overflow-tooltip />
+				<el-table-column prop="employeeCode" label="员工编码" min-width="200" show-overflow-tooltip />
+				<el-table-column prop="openId" label="openid" min-width="160" show-overflow-tooltip />
+				<el-table-column prop="updateTime" label="更新时间" width="170" show-overflow-tooltip />
+				<el-table-column prop="createTime" label="创建时间" width="170" show-overflow-tooltip />
+				<el-table-column label="操作" width="120" fixed="right">
+					<template #default="scope">
+						<el-button
+							icon="edit-pen"
+							text
+							type="primary"
+							v-auth="'thirdparty_zzdPhoneBind_edit'"
+							@click="formDialogRef.openDialog(scope.row)"
+						>
+							改手机号
+						</el-button>
+					</template>
+				</el-table-column>
+			</el-table>
+			<pagination @size-change="sizeChangeHandle" @current-change="currentChangeHandle" v-bind="state.pagination" />
+		</div>
+		<form-dialog ref="formDialogRef" @refresh="getDataList(false)" />
+	</div>
+</template>
+
+<script setup lang="ts" name="thirdpartyZzdPhoneBind">
+import { BasicTableProps, useTable } from '/@/hooks/table'
+import { fetchList } from '/@/api/thirdparty/zzdPhoneBind'
+
+const FormDialog = defineAsyncComponent(() => import('./form.vue'))
+
+const formDialogRef = ref()
+const queryRef = ref()
+const showSearch = ref(true)
+
+const state: BasicTableProps = reactive<BasicTableProps>({
+	queryForm: {
+		name: '',
+		verifiedPhone: '',
+		employeeCode: '',
+	},
+	pageList: fetchList,
+})
+
+const { getDataList, currentChangeHandle, sizeChangeHandle, sortChangeHandle, tableStyle } = useTable(state)
+
+const resetQuery = () => {
+	queryRef.value?.resetFields()
+	getDataList()
+}
+</script>