From 9502203bbee72439c8f54aa692958f443a2ceeeb Mon Sep 17 00:00:00 2001
From: 若依 <yzz_ivy@163.com>
Date: 星期日, 14 三月 2021 16:32:07 +0800
Subject: [PATCH] !187 【漏洞修复】升级commons-collections版本，解决3.2.1版本的反序列化漏洞问题 Merge pull request !187 from Delusive/master
---
ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java | 17 ++++++++++++++---
1 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java
index 36e6c10..e3864c7 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java
@@ -51,8 +51,12 @@
@Override
public boolean isRepeatSubmit(HttpServletRequest request)
{
- RepeatedlyRequestWrapper repeatedlyRequest = (RepeatedlyRequestWrapper) request;
- String nowParams = HttpHelper.getBodyString(repeatedlyRequest);
+ String nowParams = "";
+ if (request instanceof RepeatedlyRequestWrapper)
+ {
+ RepeatedlyRequestWrapper repeatedlyRequest = (RepeatedlyRequestWrapper) request;
+ nowParams = HttpHelper.getBodyString(repeatedlyRequest);
+ }
// body鍙傛暟涓虹┖锛岃幏鍙朠arameter鐨勬暟鎹�
if (StringUtils.isEmpty(nowParams))
@@ -66,8 +70,15 @@
// 璇锋眰鍦板潃锛堜綔涓哄瓨鏀綾ache鐨刱ey鍊硷級
String url = request.getRequestURI();
+ // 鍞竴鍊硷紙娌℃湁娑堟伅澶村垯浣跨敤璇锋眰鍦板潃锛�
+ String submitKey = request.getHeader(header);
+ if (StringUtils.isEmpty(submitKey))
+ {
+ submitKey = url;
+ }
+
// 鍞竴鏍囪瘑锛堟寚瀹歬ey + 娑堟伅澶达級
- String cache_repeat_key = Constants.REPEAT_SUBMIT_KEY + request.getHeader(header);
+ String cache_repeat_key = Constants.REPEAT_SUBMIT_KEY + submitKey;
Object sessionObj = redisCache.getCacheObject(cache_repeat_key);
if (sessionObj != null)
--
Gitblit v1.9.3