From 098d3347a0df808908aab8c554cd7c4febc5e6d9 Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期一, 26 八月 2024 11:43:59 +0800
Subject: [PATCH] !577 发布 5.2.2 正式版 安全性提升 Merge pull request !577 from 疯狂的狮子Li/dev
---
ruoyi-admin/src/main/java/org/dromara/web/service/impl/SmsAuthStrategy.java | 36 +++++++++++++-----------------------
1 files changed, 13 insertions(+), 23 deletions(-)
diff --git a/ruoyi-admin/src/main/java/org/dromara/web/service/impl/SmsAuthStrategy.java b/ruoyi-admin/src/main/java/org/dromara/web/service/impl/SmsAuthStrategy.java
index a4f2017..89f8462 100644
--- a/ruoyi-admin/src/main/java/org/dromara/web/service/impl/SmsAuthStrategy.java
+++ b/ruoyi-admin/src/main/java/org/dromara/web/service/impl/SmsAuthStrategy.java
@@ -21,8 +21,8 @@
import org.dromara.common.redis.utils.RedisUtils;
import org.dromara.common.satoken.utils.LoginHelper;
import org.dromara.common.tenant.helper.TenantHelper;
-import org.dromara.system.domain.SysClient;
import org.dromara.system.domain.SysUser;
+import org.dromara.system.domain.vo.SysClientVo;
import org.dromara.system.domain.vo.SysUserVo;
import org.dromara.system.mapper.SysUserMapper;
import org.dromara.web.domain.vo.LoginVo;
@@ -44,19 +44,18 @@
private final SysUserMapper userMapper;
@Override
- public LoginVo login(String clientId, String body, SysClient client) {
+ public LoginVo login(String body, SysClientVo client) {
SmsLoginBody loginBody = JsonUtils.parseObject(body, SmsLoginBody.class);
ValidatorUtils.validate(loginBody);
String tenantId = loginBody.getTenantId();
String phonenumber = loginBody.getPhonenumber();
String smsCode = loginBody.getSmsCode();
-
- // 閫氳繃鎵嬫満鍙锋煡鎵剧敤鎴�
- SysUserVo user = loadUserByPhonenumber(tenantId, phonenumber);
-
- loginService.checkLogin(LoginType.SMS, tenantId, user.getUserName(), () -> !validateSmsCode(tenantId, phonenumber, smsCode));
- // 姝ゅ鍙牴鎹櫥褰曠敤鎴风殑鏁版嵁涓嶅悓 鑷鍒涘缓 loginUser 灞炴�т笉澶熺敤缁ф壙鎵╁睍灏辫浜�
- LoginUser loginUser = loginService.buildLoginUser(user);
+ LoginUser loginUser = TenantHelper.dynamic(tenantId, () -> {
+ SysUserVo user = loadUserByPhonenumber(phonenumber);
+ loginService.checkLogin(LoginType.SMS, tenantId, user.getUserName(), () -> !validateSmsCode(tenantId, phonenumber, smsCode));
+ // 姝ゅ鍙牴鎹櫥褰曠敤鎴风殑鏁版嵁涓嶅悓 鑷鍒涘缓 loginUser 灞炴�т笉澶熺敤缁ф壙鎵╁睍灏辫浜�
+ return loginService.buildLoginUser(user);
+ });
loginUser.setClientKey(client.getClientKey());
loginUser.setDeviceType(client.getDeviceType());
SaLoginModel model = new SaLoginModel();
@@ -65,17 +64,14 @@
// 渚嬪: 鍚庡彴鐢ㄦ埛30鍒嗛挓杩囨湡 app鐢ㄦ埛1澶╄繃鏈�
model.setTimeout(client.getTimeout());
model.setActiveTimeout(client.getActiveTimeout());
- model.setExtra(LoginHelper.CLIENT_KEY, clientId);
+ model.setExtra(LoginHelper.CLIENT_KEY, client.getClientId());
// 鐢熸垚token
LoginHelper.login(loginUser, model);
-
- loginService.recordLogininfor(loginUser.getTenantId(), user.getUserName(), Constants.LOGIN_SUCCESS, MessageUtils.message("user.login.success"));
- loginService.recordLoginInfo(user.getUserId());
LoginVo loginVo = new LoginVo();
loginVo.setAccessToken(StpUtil.getTokenValue());
loginVo.setExpireIn(StpUtil.getTokenTimeout());
- loginVo.setClientId(clientId);
+ loginVo.setClientId(client.getClientId());
return loginVo;
}
@@ -91,11 +87,8 @@
return code.equals(smsCode);
}
- private SysUserVo loadUserByPhonenumber(String tenantId, String phonenumber) {
- SysUser user = userMapper.selectOne(new LambdaQueryWrapper<SysUser>()
- .select(SysUser::getPhonenumber, SysUser::getStatus)
- .eq(TenantHelper.isEnable(), SysUser::getTenantId, tenantId)
- .eq(SysUser::getPhonenumber, phonenumber));
+ private SysUserVo loadUserByPhonenumber(String phonenumber) {
+ SysUserVo user = userMapper.selectVoOne(new LambdaQueryWrapper<SysUser>().eq(SysUser::getPhonenumber, phonenumber));
if (ObjectUtil.isNull(user)) {
log.info("鐧诲綍鐢ㄦ埛锛歿} 涓嶅瓨鍦�.", phonenumber);
throw new UserException("user.not.exists", phonenumber);
@@ -103,10 +96,7 @@
log.info("鐧诲綍鐢ㄦ埛锛歿} 宸茶鍋滅敤.", phonenumber);
throw new UserException("user.blocked", phonenumber);
}
- if (TenantHelper.isEnable()) {
- return userMapper.selectTenantUserByPhonenumber(phonenumber, tenantId);
- }
- return userMapper.selectUserByPhonenumber(phonenumber);
+ return user;
}
}
--
Gitblit v1.9.3