优化西宁浦发银行 渗透测试漏洞解决

wuxw

2023-10-23 16d1b061d8462aa5da6792cd65e36819b21f9d3f

 service-user/src/main/java/com/java110/user/cmd/owner/EditOwnerCmd.java

@@ -9,21 +9,21 @@
import com.java110.core.event.cmd.CmdEvent;
import com.java110.core.factory.GenerateCodeFactory;
import com.java110.doc.annotation.*;
import com.java110.dto.account.AccountDto;
import com.java110.dto.file.FileDto;
import com.java110.dto.file.FileRelDto;
import com.java110.dto.owner.OwnerAppUserDto;
import com.java110.dto.owner.OwnerDto;
import com.java110.intf.acct.IAccountInnerServiceSMO;
import com.java110.intf.common.IFileInnerServiceSMO;
import com.java110.intf.common.IFileRelInnerServiceSMO;
import com.java110.intf.user.IOwnerV1InnerServiceSMO;
import com.java110.intf.user.IOwnerAppUserInnerServiceSMO;
import com.java110.intf.user.IOwnerAppUserV1InnerServiceSMO;
import com.java110.intf.user.IOwnerAttrInnerServiceSMO;
import com.java110.intf.user.IOwnerInnerServiceSMO;
import com.java110.intf.user.*;
import com.java110.po.account.AccountPo;
import com.java110.po.file.FileRelPo;
import com.java110.po.owner.OwnerAppUserPo;
import com.java110.po.owner.OwnerAttrPo;
import com.java110.po.owner.OwnerPo;
import com.java110.po.user.UserPo;
import com.java110.utils.cache.MappingCache;
import com.java110.utils.exception.CmdException;
import com.java110.utils.util.Assert;
@@ -65,7 +65,7 @@
)

@Java110ExampleDoc(
        reqBody="{\n" +
        reqBody = "{\n" +
                "\t\"name\": \"王王\",\n" +
                "\t\"age\": \"\",\n" +
                "\t\"link\": \"18909718888\",\n" +
@@ -78,7 +78,7 @@
                "\t\"idCard\": \"\",\n" +
                "\t\"communityId\": \"2022121921870161\"\n" +
                "}",
        resBody="{\"code\":0,\"msg\":\"成功\"}"
        resBody = "{\"code\":0,\"msg\":\"成功\"}"
)
@Java110Cmd(serviceCode = "owner.editOwner")
public class EditOwnerCmd extends Cmd {
@@ -103,6 +103,12 @@

    @Autowired
    private IFileInnerServiceSMO fileInnerServiceSMOImpl;

    @Autowired
    private IAccountInnerServiceSMO accountInnerServiceSMOImpl;

    @Autowired
    private IUserV1InnerServiceSMO userV1InnerServiceSMOImpl;

    @Override
    public void validate(CmdEvent event, ICmdDataFlowContext cmdDataFlowContext, JSONObject reqJson) throws CmdException {
@@ -192,9 +198,11 @@
        if (reqJson.containsKey("ownerPhoto") && !StringUtils.isEmpty(reqJson.getString("ownerPhoto"))) {
            editOwnerPhoto(reqJson);
        }
        //todo 修改 业主信息
        editOwner(reqJson);

        JSONArray attrs = reqJson.getJSONArray("attrs");
        if (attrs == null && attrs.size() < 1) {
        if (attrs == null || attrs.size() < 1) {
            return;
        }
        JSONObject attr = null;
@@ -218,7 +226,13 @@
                throw new CmdException("修改业主属性失败");
            }
        }

        //todo 如果 业主做了绑定则修改绑定的手机号
        updateOwnerAppUser(reqJson);


    }


    public void editOwner(JSONObject paramInJson) {

@@ -244,28 +258,29 @@
        if (flag < 1) {
            throw new CmdException("修改业主失败");
        }
        OwnerAppUserDto ownerAppUserDto = new OwnerAppUserDto();
        ownerAppUserDto.setMemberId(paramInJson.getString("ownerId"));

        //查询app用户表
        List<OwnerAppUserDto> ownerAppUserDtos = ownerAppUserInnerServiceSMOImpl.queryOwnerAppUsers(ownerAppUserDto);
        if (ownerAppUserDtos != null && ownerAppUserDtos.size() > 0) {
            for (OwnerAppUserDto ownerAppUser : ownerAppUserDtos) {
                OwnerAppUserPo ownerAppUserPo = BeanConvertUtil.covertBean(ownerAppUser, OwnerAppUserPo.class);
                ownerAppUserPo.setLink(paramInJson.getString("link"));
                ownerAppUserPo.setIdCard(paramInJson.getString("idCard"));
                flag = ownerAppUserV1InnerServiceSMOImpl.updateOwnerAppUser(ownerAppUserPo);
                if (flag < 1) {
                    throw new CmdException("修改业主失败");
                }
            }
        //todo 判断业主手机号和账户手机号是否相同，不相同修改账户手机号
        AccountDto accountDto = new AccountDto();
        accountDto.setObjId(ownerDtos.get(0).getMemberId());
        accountDto.setPartId(ownerDtos.get(0).getCommunityId());
        List<AccountDto> accountDtos = accountInnerServiceSMOImpl.queryAccounts(accountDto);
        if(accountDtos == null || accountDtos.size()< 1){
            return ;
        }
        if(accountDtos.get(0).getLink().equals(ownerDtos.get(0).getLink())){
            return;
        }

        AccountPo accountPo = new AccountPo();
        accountPo.setLink(ownerDtos.get(0).getLink());
        accountPo.setAcctId(accountDtos.get(0).getAcctId());
        accountInnerServiceSMOImpl.updateAccount(accountPo);
    }

    public void editOwnerPhoto(JSONObject paramInJson) {

        String _photo = paramInJson.getString("ownerPhoto");
        if(_photo.length()> 512){
        if (_photo.length() > 512) {
            FileDto fileDto = new FileDto();
            fileDto.setFileId(GenerateCodeFactory.getGeneratorId(GenerateCodeFactory.CODE_PREFIX_file_id));
            fileDto.setFileName(fileDto.getFileId());
@@ -306,4 +321,40 @@
            throw new CmdException("保存文件失败");
        }
    }


    /**
     * 如果 业主做了绑定则修改绑定的手机号
     * @param reqJson
     */
    private void updateOwnerAppUser(JSONObject reqJson) {

        OwnerAppUserDto ownerAppUserDto = new OwnerAppUserDto();
        ownerAppUserDto.setMemberId(reqJson.getString("memberId"));

        //todo 查询app用户表
        List<OwnerAppUserDto> ownerAppUserDtos = ownerAppUserInnerServiceSMOImpl.queryOwnerAppUsers(ownerAppUserDto);
        if (ownerAppUserDtos == null || ownerAppUserDtos.size() < 1) {
            return;
        }
        for (OwnerAppUserDto ownerAppUser : ownerAppUserDtos) {
            OwnerAppUserPo ownerAppUserPo = BeanConvertUtil.covertBean(ownerAppUser, OwnerAppUserPo.class);
            ownerAppUserPo.setLink(reqJson.getString("link"));
            ownerAppUserV1InnerServiceSMOImpl.updateOwnerAppUser(ownerAppUserPo);

            if (StringUtil.isEmpty(ownerAppUser.getUserId())) {
                continue;
            }
            if (ownerAppUser.getUserId().startsWith("-")) {
                continue;
            }
            // todo 修改用户信息
            UserPo userPo = new UserPo();
            userPo.setUserId(ownerAppUserDtos.get(0).getUserId());
            userPo.setTel(reqJson.getString("link"));
            userV1InnerServiceSMOImpl.updateUser(userPo);
        }


    }
}