渗透测试修改;

mhd-modules/mhd-system/src/main/java/com/mhd/system/controller/SysConfigController.java

@@ -40,14 +40,14 @@ public class SysConfigController extends BaseController
     /**
      * 获取参数配置列表
      */
-    @RequiresPermissions("system:config:list")
+//    @RequiresPermissions("system:config:list")
-    @GetMapping("/list")
+//    @GetMapping("/list")
-    public TableDataInfo list(SysConfig config)
+//    public TableDataInfo list(SysConfig config)
-    {
+//    {
-        startPage();
+//        startPage();
-        List<SysConfig> list = configService.selectConfigList(config);
+//        List<SysConfig> list = configService.selectConfigList(config);
-        return getDataTable(list);
+//        return getDataTable(list);
-    }
+//    }
 
     @Log(title = "参数管理", businessType = BusinessType.EXPORT)
     @RequiresPermissions("system:config:export")
@@ -71,11 +71,11 @@ public class SysConfigController extends BaseController
     /**
      * 根据参数键名查询参数值
      */
-    @GetMapping(value = "/configKey/{configKey}")
+//    @GetMapping(value = "/configKey/{configKey}")
-    public AjaxResult getConfigKey(@PathVariable String configKey)
+//    public AjaxResult getConfigKey(@PathVariable String configKey)
-    {
+//    {
-        return AjaxResult.success(configService.selectConfigByKey(configKey));
+//        return AjaxResult.success(configService.selectConfigByKey(configKey));
-    }
+//    }
 
     /**
      * 新增参数配置

mhd-modules/mhd-system/src/main/java/com/mhd/system/controller/SysUserController.java

@@ -85,6 +85,9 @@ public class SysUserController extends BaseController
             }
         }
         List<SysUser> list = userService.selectUserList(user);
+        for (SysUser sysUser : list) {
+            sysUser.setPassword("******");
+        }
         return getDataTable(list);
     }
 

mhd-user-center/src/main/java/com/mhd/user/application/service/UserApplicationService.java

@@ -3428,6 +3428,24 @@ public class UserApplicationService {
             if (!ObjectUtil.equal(String.valueOf(object), verificationCode) && !ObjectUtil.equal(verificationCode, SmsConstants.universalCode)) {
                 throw new ServiceException("验证码错误");
             }*/
+            String oldUserPassword = userDO.getOldUserPassword();
+            if (oldUserPassword==null||oldUserPassword=="") {
+                throw new ServiceException("旧密码不能为空");
+            }
+            String userPassword1 = userPo.getUserPassword();
+            String oldDecrypt = AESUtil.decrypt(oldUserPassword);
+            String nowDecrypt = AESUtil.decrypt(userPassword1);
+            if (!oldDecrypt.equals(nowDecrypt)) {
+               throw new ServiceException("旧密码错误");
+            }
+            String newUserPassword = userDO.getUserPassword();
+            // 校验新密码复杂度：必须同时包含大写字母、小写字母、数字和特殊符号
+            if (StringUtils.isNotEmpty(newUserPassword)) {
+                String decryptedNewPassword = AESUtil.decrypt(newUserPassword);
+                if (!decryptedNewPassword.matches("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^a-zA-Z0-9]).+$")) {
+                    throw new ServiceException("新密码必须同时包含大写字母、小写字母、数字和特殊符号");
+                }
+            }
             //用户密码传值
             if (StringUtils.isNotEmpty(userDO.getUserPassword())) {
                 String userPassword = AESUtil.decrypt(userDO.getUserPassword());
@@ -3444,25 +3462,25 @@ public class UserApplicationService {
                 userDomainService.updateUser(userDO);
             }
         }else {
-            String userPassword1 = userDO.getUserPassword();
+//            String userPassword1 = userDO.getUserPassword();
-            for (Long id : userDO.getUserIds()) {
+//            for (Long id : userDO.getUserIds()) {
-                UserPo userPo1 = userDomainService.selectByUserId(id);
+//                UserPo userPo1 = userDomainService.selectByUserId(id);
-                //用户密码传值
+//                //用户密码传值
-                if (StringUtils.isNotEmpty(userDO.getUserPassword())) {
+//                if (StringUtils.isNotEmpty(userDO.getUserPassword())) {
-                    String userPassword = AESUtil.decrypt(userPassword1);
+//                    String userPassword = AESUtil.decrypt(userPassword1);
-                    // 生成随机8位数盐
+//                    // 生成随机8位数盐
-                    String salt = OConvertUtils.randomGen(8);
+//                    String salt = OConvertUtils.randomGen(8);
-                    userDO.setUserSalt(salt);
+//                    userDO.setUserSalt(salt);
-                    //加密算法，PBEWithMD5AndDES，
+//                    //加密算法，PBEWithMD5AndDES，
-                    String passwordEncode = PasswordUtil.encrypt(userPo1.getUserAccount(), userPassword, salt);
+//                    String passwordEncode = PasswordUtil.encrypt(userPo1.getUserAccount(), userPassword, salt);
-                    userDO.setUserPassword(passwordEncode);
+//                    userDO.setUserPassword(passwordEncode);
-                }
+//                }
-
+//
-                if (ObjectUtil.isNotNull(userPo1)) {
+//                if (ObjectUtil.isNotNull(userPo1)) {
-                    userDO.setUserId(userPo1.getUserId());
+//                    userDO.setUserId(userPo1.getUserId());
-                    userDomainService.updateUser(userDO);
+//                    userDomainService.updateUser(userDO);
-                }
+//                }
-            }
+//            }
         }
         return true;
     }
@@ -3874,6 +3892,18 @@ public class UserApplicationService {
         //新支付密码
         String payPassword = userDTO.getUserPayPassword();
 
+        String userPayPassword = userPo.getUserPayPassword();
+        String nowPayPassword = AESUtil.decrypt(userPayPassword);
+        String oldUserPassword = userDTO.getOldUserPayPassword();
+        if(oldUserPassword == null || "".equals(oldUserPassword)) {
+            throw new ServiceException("旧密码不能为空");
+        }
+        String oldPayPassword = AESUtil.decrypt(oldUserPassword);
+        if(!nowPayPassword.equals(oldPayPassword)) {
+            throw new ServiceException("旧密码不正确");
+        }
+
+
         //验证码登录校验验证码
         String key = CacheConstants.SMS_PAY_CHANGE + userPhone;
         Object object = redisService.getCacheObject(key) == null ? "" : redisService.getCacheObject(key);

mhd-user-center/src/main/java/com/mhd/user/domain/userAggregate/repository/todo/UserDO.java

@@ -49,6 +49,8 @@ public class UserDO extends BaseVOEntity {
     private String userMemberCode;
     @ApiModelProperty(name = "登录密码")
     private String userPassword;
+    @ApiModelProperty(name = "老登录密码")
+    private String oldUserPassword;
     @ApiModelProperty(name = "确认登录密码")
     private String copyUserPassword;
     @ApiModelProperty(name = "盐")

mhd-user-center/src/main/java/com/mhd/user/interfaces/dto/addDTO/UserDTO.java

@@ -49,6 +49,8 @@ public class UserDTO extends BaseVOEntity {
     private String userSalt;
     @ApiModelProperty(name = "支付密码")
     private String userPayPassword;
+    @ApiModelProperty(name = "旧支付密码")
+    private String oldUserPayPassword;
     @ApiModelProperty(name = "身份证号")
     private String userIdcardNumber;
     @ApiModelProperty(name = "身份证号加密")