merge

boot-service/src/main/java/com/xwbing/service/rest/CommonService.java

@@ -0,0 +1,23 @@
+package com.xwbing.service.rest;
+
+import com.xwbing.util.DigestsUtil;
+import org.springframework.stereotype.Service;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+
+/**
+ * 项目名称: boot-module-demo
+ * 创建时间: 2018/5/7 8:59
+ * 作者: xiangwb
+ * 说明:
+ */
+@Service
+public class CommonService {
+    public String getSign(HttpServletRequest request) {
+        HttpSession session = request.getSession();
+        String sign = DigestsUtil.getSign();
+        session.setAttribute("sign", sign);
+        return sign;
+    }
+}

boot-service/src/main/java/com/xwbing/service/sys/SysUserService.java

@@ -433,7 +433,7 @@ public class SysUserService {
     private boolean checkPassWord(String passWord, String realPassWord, String salt) {
         // 根据密码盐值 解码
         byte[] saltByte = EncodeUtils.hexDecode(salt);
-        byte[] hashPassword = Digests.sha1(passWord.getBytes(), saltByte, PassWordUtil.HASH_INTERATIONS);
+        byte[] hashPassword = DigestsUtil.sha1(passWord.getBytes(), saltByte, PassWordUtil.HASH_INTERATIONS);
         // 密码 数据库中密码
         String validatePassWord = EncodeUtils.hexEncode(hashPassword);
         //判断密码是否相同

boot-service/src/main/java/com/xwbing/util/DigestsUtil.java

@@ -8,17 +8,20 @@ import org.slf4j.LoggerFactory;
 import java.io.InputStream;
 import java.security.GeneralSecurityException;
 import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
+import java.util.Base64;
+import java.util.Random;
 
 /**
  * 说明:散列算法/摘要算法
  * 作者: xiangwb
  */
-public class Digests {
+public class DigestsUtil {
     private static final String SHA1 = "SHA-1";
     private static final String MD5 = "MD5";
     private static SecureRandom random = new SecureRandom();
-    private static final Logger LOGGER = LoggerFactory.getLogger(Digests.class);
+    private static final Logger LOGGER = LoggerFactory.getLogger(DigestsUtil.class);
 
     /**
      * 生成随机的Byte[]作为salt.
@@ -100,4 +103,21 @@ public class Digests {
             throw new UtilException("加密失败");
         }
     }
+
+    /**
+     * 获取签名
+     *
+     * @return
+     */
+    public static String getSign() {
+        String sign = System.currentTimeMillis() + new Random().nextInt() + "";
+        try {
+            MessageDigest md = MessageDigest.getInstance(MD5);
+            byte[] md5 = md.digest(sign.getBytes());
+            return Base64.getEncoder().encodeToString(md5);
+        } catch (NoSuchAlgorithmException e) {
+            LOGGER.error(e.getMessage());
+            throw new UtilException("获取签名失败");
+        }
+    }
 }

boot-service/src/main/java/com/xwbing/util/PassWordUtil.java

@@ -41,12 +41,12 @@ public class PassWordUtil {
         byte[] salt;
         // 密码盐值 如果是为空，那么随机获取；不为空，解析pwdSalt
         if (StringUtils.isEmpty(pwdSalt)) {
-            salt = Digests.generateSalt(SALT_SIZE);
+            salt = DigestsUtil.generateSalt(SALT_SIZE);
         } else {
             salt = EncodeUtils.hexDecode(pwdSalt);
         }
         // 密码加密
-        byte[] hashPassword = Digests.sha1(password.getBytes(), salt, HASH_INTERATIONS);
+        byte[] hashPassword = DigestsUtil.sha1(password.getBytes(), salt, HASH_INTERATIONS);
         str[0] = password;
         str[1] = EncodeUtils.hexEncode(salt);
         str[2] = EncodeUtils.hexEncode(hashPassword);

boot-web/src/main/java/com/xwbing/configuration/ServletFilterConfig.java

@@ -2,6 +2,7 @@ package com.xwbing.configuration;
 
 import com.alibaba.druid.support.http.StatViewServlet;
 import com.alibaba.druid.support.http.WebStatFilter;
+import com.xwbing.handler.FormSaveFilter;
 import com.xwbing.util.captcha.CaptchaServlet;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -53,4 +54,13 @@ public class ServletFilterConfig {
         filterRegistrationBean.addInitParameter("profileEnable", "true");//监控单个url调用的sql列表
         return filterRegistrationBean;
     }
+
+    @Bean
+    public FilterRegistrationBean formSaveFilter() {
+        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean(new FormSaveFilter());
+        filterRegistrationBean.addUrlPatterns("/*");
+        filterRegistrationBean.addInitParameter("excludePath", "/doc,/captcha,/v2/api-docs,/swagger-resources,/configuration/ui,/configuration/security,/druid");
+        filterRegistrationBean.addInitParameter("excludeType", ".js,.css,.gif,.jpg,.png,.ico,.jsp,.html,/druid/");
+        return filterRegistrationBean;
+    }
 }

boot-web/src/main/java/com/xwbing/controller/sys/CommonControl.java

@@ -0,0 +1,37 @@
+package com.xwbing.controller.sys;
+
+import com.alibaba.fastjson.JSONObject;
+import com.xwbing.annotation.LogInfo;
+import com.xwbing.domain.entity.vo.RestMessageVo;
+import com.xwbing.service.rest.CommonService;
+import com.xwbing.util.JsonResult;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiOperation;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+
+/**
+ * 项目名称: boot-module-demo
+ * 创建时间: 2018/5/7 9:57
+ * 作者: xiangwb
+ * 说明:
+ */
+@Api(tags = "commonApi", description = "公共相关接口")
+@RestController
+@RequestMapping("/common/")
+public class CommonControl {
+    @Resource
+    private CommonService commonService;
+
+    @LogInfo("获取签名")
+    @ApiOperation(value = "获取签名", response = RestMessageVo.class)
+    @GetMapping("getSign")
+    public JSONObject getSign(HttpServletRequest request) {
+        String sign = commonService.getSign(request);
+        return JsonResult.toJSONObj(sign, "");
+    }
+}

boot-web/src/main/java/com/xwbing/controller/sys/SysAuthorityControl.java

@@ -39,6 +39,7 @@ public class SysAuthorityControl {
 
     @LogInfo("添加权限")
     @ApiOperation(value = "添加权限", response = RestMessageVo.class)
+    @ApiImplicitParam(name = "sign", value = "签名", paramType = "header", dataType = "string")
     @PostMapping("save")
     public JSONObject save(@RequestBody SysAuthority sysAuthority) {
         RestMessage save = sysAuthorityService.save(sysAuthority);

boot-web/src/main/java/com/xwbing/controller/sys/SysRoleControl.java

@@ -42,6 +42,7 @@ public class SysRoleControl {
 
     @LogInfo("添加角色")
     @ApiOperation(value = "添加角色", response = RestMessageVo.class)
+    @ApiImplicitParam(name = "sign", value = "签名", paramType = "header", dataType = "string")
     @PostMapping("save")
     public JSONObject save(@RequestBody SysRole sysRole) {
         RestMessage result = sysRoleService.save(sysRole);

boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java

@@ -51,6 +51,7 @@ public class SysUserControl {
 
     @LogInfo("添加用户")
     @ApiOperation(value = "添加用户", response = RestMessageVo.class)
+    @ApiImplicitParam(name = "sign", value = "签名", paramType = "header", dataType = "string")
     @PostMapping("save")
     public JSONObject save(@RequestBody @Valid SysUser sysUser) {
         RestMessage result = sysUserService.save(sysUser);

boot-web/src/main/java/com/xwbing/handler/FormSaveFilter.java

@@ -0,0 +1,81 @@
+package com.xwbing.handler;
+
+import com.alibaba.fastjson.JSON;
+import com.xwbing.util.RestMessage;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.io.OutputStream;
+
+/**
+ * 项目名称: boot-module-demo
+ * 创建时间: 2018/5/7 10:11
+ * 作者: xiangwb
+ * 说明:
+ */
+public class FormSaveFilter implements Filter {
+    private String[] paths;
+    private String[] types;
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+        String excludePath = filterConfig.getInitParameter("excludePath");
+        paths = excludePath.split(",");
+        String excludeType = filterConfig.getInitParameter("excludeType");
+        types = excludeType.split(",");
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+        String path = request.getServletPath();
+        for (String p : paths) {
+            if (path.equals(p)) {
+                chain.doFilter(request, response);
+                return;
+            }
+        }
+        for (String p : types) {
+            if (path.contains(p)) {
+                chain.doFilter(request, response);
+                return;
+            }
+        }
+        if (path.contains("save")) {
+            HttpSession session = request.getSession();
+            Object sign = session.getAttribute("sign");
+            String signValue = request.getHeader("sign");
+            if (sign != null && sign.equals(signValue)) {
+                session.removeAttribute("sign");
+                chain.doFilter(request, response);
+            } else {
+                getOutputStream(response,"请不要重复提交");
+            }
+
+        } else {
+            chain.doFilter(request, response);
+        }
+
+    }
+
+    @Override
+    public void destroy() {
+
+    }
+
+    private void getOutputStream(HttpServletResponse response, String msg) {
+        try {
+            OutputStream outputStream = response.getOutputStream();
+            RestMessage restMessage = new RestMessage();
+            restMessage.setMessage(msg);
+            outputStream.write(JSON.toJSONString(restMessage).getBytes("utf-8"));
+            outputStream.close();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+    }
+}