漏洞扫描修改

mhd-common/mhd-common-core/src/main/java/minio/MinIoUploadService.java

@@ -4,6 +4,7 @@ import com.aliyun.oss.ServiceException;
 import io.minio.MinioClient;
 import io.minio.PutObjectArgs;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.util.UriUtils;
 
@@ -15,19 +16,16 @@ import java.util.Date;
 import java.util.List;
 import java.util.UUID;
 
+@Service
 public class MinIoUploadService {
-    @Autowired
+
     private MinioClient minioClient;
+
     private static String bucket="ngwl";
     private static String host="http://10.102.192.5:6000";
     private static String accessKey="minioadmin";
     private static String secretKey="gmminioadmin";
-    /**
-     * minio 工具客户端
-     */
-    private static MinioClient minioClient1 = null;
 
-    private static String FILE_URL;
 
     /**
      * 上传到minio

mhd-visual/mhd-monitor/src/main/java/com/mhd/modules/monitor/config/WebSecurityConfigurer.java

@@ -1,6 +1,7 @@
 package com.mhd.modules.monitor.config;
 
 import de.codecentric.boot.admin.server.config.AdminServerProperties;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -9,7 +10,7 @@ import org.springframework.security.web.authentication.SavedRequestAwareAuthenti
 
 /**
  * 监控权限配置
- * 
+ *
  * @author mhd
  */
 @EnableWebSecurity
@@ -32,11 +33,23 @@ public class WebSecurityConfigurer
         return httpSecurity
                 .headers().frameOptions().disable()
                 .and().authorizeRequests()
+                .antMatchers("/actuator/health", "/actuator/info").permitAll() //扫描漏洞添加
+                .antMatchers("/actuator/**").authenticated() //扫描漏洞添加
                 .antMatchers(adminContextPath + "/assets/**"
                         , adminContextPath + "/login"
                         , adminContextPath + "/actuator/**"
                         , adminContextPath + "/instances/**"
                 ).permitAll()
+                // 管理端点需要认证
+                .antMatchers("/actuator/**").hasRole("ADMIN")//扫描漏洞添加
+                .antMatchers("/admin/**").hasRole("ADMIN")//扫描漏洞添加
+                .antMatchers("/actuator/env").hasRole("plat_admin") // 仅允许ADMIN角色访问/env端点 //扫描漏洞添加
+                // 允许公开访问的端点
+                .requestMatchers(EndpointRequest.to("health", "info", "prometheus"))//扫描漏洞添加
+                .permitAll()
+                // 敏感端点需要管理员权限
+                .requestMatchers(EndpointRequest.to("env", "configprops", "beans", "mappings"))//扫描漏洞添加
+                .hasRole("ADMIN")
                 .anyRequest().authenticated()
                 .and()
                 .formLogin().loginPage(adminContextPath + "/login")

mhd_finance/src/main/java/com/linke/finance/application/server/approvalDocument/ApprovalDocumentApplicationService.java

@@ -7,11 +7,15 @@ import com.linke.finance.domain.approvalDocument.repository.todo.ApprovalDocumen
 import com.linke.finance.domain.approvalDocument.repository.todo.WorkflowProcessInstancesByIdDO;
 import com.linke.finance.domain.approvalDocument.service.ApprovalDocumentDomainService;
 import com.linke.finance.interfaces.vo.ApprovalStatsVO;
+import com.mhd.common.core.domain.po.UserPo;
 import com.mhd.common.security.utils.SecurityUtils;
 import com.mhd.system.api.model.LoginUser;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.catalina.User;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
+
+import java.rmi.ServerException;
 import java.util.List;
 /**
  * 审批单据ApplicationService
@@ -30,8 +34,12 @@ public class ApprovalDocumentApplicationService {
      * 分页查询审批单据列表
      */
 
-    public List<ApprovalDocumentPO> queryList(ApprovalDocumentDO approvalDocumentDO) {
+    public List<ApprovalDocumentPO> queryList(ApprovalDocumentDO approvalDocumentDO) throws Exception{
         LoginUser loginUser = SecurityUtils.getLoginUser();
+        UserPo userPo=loginUser.getUserPo();
+        if(!userPo.getRoleCode().equals("plat_admin")){
+            throw new ServerException("您没有权限访问");
+        }
         if (loginUser != null){
             Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
             if (topOrganizationId != null && topOrganizationId != 1){

mhd_finance/src/main/java/com/linke/finance/interfaces/facade/approvalDocument/ApprovalDocumentApi.java

@@ -7,6 +7,8 @@ import com.linke.finance.interfaces.dto.approvalDocument.DingDingHuiDiaoDTO;
 import com.linke.finance.interfaces.vo.ApprovalStatsVO;
 import com.linke.finance.until.DingCallbackCrypto;
 import com.mhd.common.core.domain.entity.R;
+
+import java.rmi.ServerException;
 import java.util.List;
 import java.util.Map;
 
@@ -56,8 +58,17 @@ public class ApprovalDocumentApi extends BaseController{
         //转换实体
         ApprovalDocumentDO approvalDocumentDO = approvalDocumentAssembler.toDO(approvalDocumentDTO);
         startPage();
-        List<ApprovalDocumentPO> list = approvalDocumentApplicationService.queryList(approvalDocumentDO);
+        List<ApprovalDocumentPO> list = null;
-        return getDataTable(list);
+        try {
+            list = approvalDocumentApplicationService.queryList(approvalDocumentDO);
+            return getDataTable(list);
+        } catch (ServerException e) {
+            e.printStackTrace();
+            return null;
+        } catch (Exception e) {
+            e.printStackTrace();
+            return null;
+        }
     }
 
     /**

mhd_product/pom.xml

@@ -129,6 +129,17 @@
             <groupId>com.mhd</groupId>
             <artifactId>mhd-common-log</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.minio</groupId>
+            <artifactId>minio</artifactId>
+            <version>8.4.3</version>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp</artifactId>
+            <version>4.8.1</version>
+            <scope>compile</scope>
+        </dependency>
     </dependencies>
 
     <build>

mhd_product/src/main/java/com/linke/product/application/service/menu/MenuApplicationService.java

@@ -46,6 +46,7 @@ import lombok.extern.slf4j.Slf4j;
 import minio.MinIoUploadService;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Repository;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -97,9 +98,10 @@ public class MenuApplicationService {
     private SpecialServiceFeign logisticsServiceFeign;
     @Resource
     private MenuUtils menuUtils;
-    @Autowired
+    @Autowired(required = false)
     private MinIoUploadService minIoUploadService;
 
+
     /**
      * 查询菜单集合
      *

mhd_transport/pom.xml

@@ -101,17 +101,6 @@
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-sleuth</artifactId>
         </dependency>
-        <dependency>
-            <groupId>io.minio</groupId>
-            <artifactId>minio</artifactId>
-            <version>8.4.3</version>
-        </dependency>
-        <dependency>
-            <groupId>com.squareup.okhttp3</groupId>
-            <artifactId>okhttp</artifactId>
-            <version>4.8.1</version>
-            <scope>compile</scope>
-        </dependency>
 
 
         <dependency>