🔒 Fixing security issues. 微信模块权限完善，SQL 维护、token 过期提示优化

pigx-visual/pigx-monitor/src/main/java/com/pig4cloud/pigx/monitor/config/JacksonConfig.java

@@ -15,12 +15,12 @@ import java.util.Locale;
 import java.util.TimeZone;
 
 /**
- * JacksonConfig
+ * JacksonConfig 扩展增加 spring boot 默认配置
+ * <p>
+ * 自身序列化机制 {@link de.codecentric.boot.admin.server.utils.jackson.AdminServerModule}
  *
- * @author L.cm
- * @author: lengleng
- * @author: lishangbu
- * @date: 2018/10/22
+ * @author lengleng
+ * @date 2020-06-07
  */
 @Configuration
 @ConditionalOnClass(ObjectMapper.class)
@@ -31,7 +31,7 @@ public class JacksonConfig {
 	 * 覆盖core 模块提供的序列方式，增加springboot admin 序列化
 	 *
 	 * @param adminJacksonModule spring boot admin 提供的序列化
-	 * @return
+	 * @return Jackson customizer
 	 */
 	@Bean
 	public Jackson2ObjectMapperBuilderCustomizer customizer(SimpleModule adminJacksonModule) {

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxAccountFansController.java

@@ -110,6 +110,7 @@ public class WxAccountFansController {
 	 * @return
 	 */
 	@PostMapping("/sync/{appId}")
+	@PreAuthorize("@pms.hasPermission('mp_wxaccountfans_sync')")
 	public R sync(@PathVariable String appId) {
 		return R.ok(wxAccountFansService.syncAccountFans(appId));
 	}

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxAutoReplyController.java

@@ -8,6 +8,7 @@ import com.pig4cloud.pigx.mp.constant.ReplyTypeEnum;
 import com.pig4cloud.pigx.mp.entity.WxAutoReply;
 import com.pig4cloud.pigx.mp.service.WxAutoReplyService;
 import lombok.AllArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
@@ -56,6 +57,7 @@ public class WxAutoReplyController {
 	 * @return R
 	 */
 	@PostMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxautoreply_add')")
 	public R save(@RequestBody WxAutoReply wxAutoReply) {
 		this.jude(wxAutoReply);
 		return R.ok(wxAutoReplyService.save(wxAutoReply));
@@ -68,6 +70,7 @@ public class WxAutoReplyController {
 	 * @return R
 	 */
 	@PutMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxautoreply_edit')")
 	public R updateById(@RequestBody WxAutoReply wxAutoReply) {
 		this.jude(wxAutoReply);
 		return R.ok(wxAutoReplyService.updateById(wxAutoReply));
@@ -80,6 +83,7 @@ public class WxAutoReplyController {
 	 * @return R
 	 */
 	@DeleteMapping("/{id}")
+	@PreAuthorize("@pms.hasPermission('mp_wxautoreply_del')")
 	public R removeById(@PathVariable String id) {
 		return R.ok(wxAutoReplyService.removeById(id));
 	}

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxFansMsgController.java

@@ -23,6 +23,7 @@ import com.pig4cloud.pigx.mp.entity.WxMsg;
 import com.pig4cloud.pigx.mp.service.WxMsgService;
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 
@@ -69,6 +70,7 @@ public class WxFansMsgController {
 	 * @return R
 	 */
 	@PostMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxmsg_add')")
 	public R save(@RequestBody WxMsg wxMsg) {
 		return wxMsgService.saveAndPushMsg(wxMsg);
 	}
@@ -80,6 +82,7 @@ public class WxFansMsgController {
 	 * @return R
 	 */
 	@PutMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxmsg_edit')")
 	public R updateById(@RequestBody WxMsg wxMsg) {
 		return R.ok(wxMsgService.updateById(wxMsg));
 	}
@@ -91,6 +94,7 @@ public class WxFansMsgController {
 	 * @return R
 	 */
 	@DeleteMapping("/{id}")
+	@PreAuthorize("@pms.hasPermission('mp_wxmsg_del')")
 	public R removeById(@PathVariable String id) {
 		return R.ok(wxMsgService.removeById(id));
 	}

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxMaterialController.java

@@ -17,6 +17,7 @@ import me.chanjar.weixin.mp.bean.material.*;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -48,6 +49,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PostMapping("/materialFileUpload")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public R materialFileUpload(@RequestParam("file") MultipartFile mulFile,
 								@RequestParam String appId,
 								@RequestParam("title") String title,
@@ -90,6 +92,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PostMapping("/materialNews")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public R materialNewsUpload(@RequestBody JSONObject data) {
 		try {
 			JSONArray jSONArray = data.getJSONArray("articles");
@@ -118,6 +121,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PutMapping("/materialNews")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public R materialNewsUpdate(@RequestBody JSONObject data) {
 		try {
 			String mediaId = data.getStr("mediaId");
@@ -152,6 +156,7 @@ public class WxMaterialController {
 	 * @return
 	 */
 	@PostMapping("/newsImgUpload")
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_add')")
 	public String newsImgUpload(@RequestParam("file") MultipartFile mulFile, @RequestParam String appId) throws Exception {
 		File file = FileUtil.createTempFile(FileUtil.getTmpDir());
 		mulFile.transferTo(file);
@@ -171,6 +176,7 @@ public class WxMaterialController {
 	 * @return R
 	 */
 	@DeleteMapping
+	@PreAuthorize("@pms.hasPermission('mp_wxmaterial_del')")
 	public R materialDel(String appId, String id) {
 		WxMpService wxMpService = WxMpInitConfigRunner.getMpServices().get(appId);
 		WxMpMaterialService wxMpMaterialService = wxMpService.getMaterialService();

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxMenuController.java

@@ -77,6 +77,7 @@ public class WxMenuController {
 	}
 
 	@DeleteMapping("/{appId}")
+	@PreAuthorize("@pms.hasPermission('mp_wxmenu_del')")
 	public R delete(@PathVariable("appId") String appId) {
 		return wxMenuService.delete(appId);
 	}