bonus
/
Bonus-Cloud
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

回滚关于IP伪造代码上的改动

This commit is contained in:
weiweiw 2024-11-13 17:45:02 +08:00
parent 8d668d4d9b
commit 0f1bff9724
9 changed files with 34 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bonus-auth/src/main/java/com/bonus/auth/service/PasswordValidatorService.java
View File

@ -238,7 +238,7 @@ public class PasswordValidatorService {
long startTime = System.currentTimeMillis(); long startTime = System.currentTimeMillis();
try { try {
String blackStr = Convert.toStr(redisService.getCacheObject(CacheConstants.SYS_LOGIN_BLACKIPLIST)); String blackStr = Convert.toStr(redisService.getCacheObject(CacheConstants.SYS_LOGIN_BLACKIPLIST));
String ip = IpUtils.getIpAddr(systemConfig.getTrustedProxyIps()); String ip = IpUtils.getIpAddr();
if (IpUtils.isMatchedIp(blackStr,ip )) { if (IpUtils.isMatchedIp(blackStr,ip )) {
logAndThrowError(username, "访问IP已被列入系统黑名单", "访问IP已被列入系统黑名单"); logAndThrowError(username, "访问IP已被列入系统黑名单", "访问IP已被列入系统黑名单");
} }
@ -270,7 +270,7 @@ public class PasswordValidatorService {
*/ */
public void handleIpValidation(String username, SysUser user) { public void handleIpValidation(String username, SysUser user) {
try { try {
String nowIp = IpUtils.getIpAddr(systemConfig.getTrustedProxyIps()); String nowIp = IpUtils.getIpAddr();
String hisIp = redisService.getCacheObject("IP:" + user.getUserId()); String hisIp = redisService.getCacheObject("IP:" + user.getUserId());
if (!nowIp.equals(hisIp)) { if (!nowIp.equals(hisIp)) {
recordLogService.saveErrorLogs(username, System.currentTimeMillis(), user.getUserId().toString(),"用户连续两次在不同IP登录"); recordLogService.saveErrorLogs(username, System.currentTimeMillis(), user.getUserId().toString(),"用户连续两次在不同IP登录");
@ -286,7 +286,7 @@ public class PasswordValidatorService {
List<Map<String, Object>> cacheList = redisService.getCacheObject(CacheConstants.SYS_LOGIN_BLACKIPLIST); List<Map<String, Object>> cacheList = redisService.getCacheObject(CacheConstants.SYS_LOGIN_BLACKIPLIST);
// 获取客户端的 IP 地址 // 获取客户端的 IP 地址
String ip = IpUtils.getIpAddr(systemConfig.getTrustedProxyIps()); String ip = IpUtils.getIpAddr();
// 遍历黑名单 // 遍历黑名单
for (Map<String, Object> map : cacheList) { for (Map<String, Object> map : cacheList) {

16
bonus-auth/src/main/java/com/bonus/auth/service/SysRecordLogService.java
View File

@ -31,8 +31,6 @@ public class SysRecordLogService
{ {
@Autowired @Autowired
private RemoteLogService remoteLogService; private RemoteLogService remoteLogService;
@Autowired
private SystemConfig systemConfig;
/** /**
* 记录登录信息 * 记录登录信息
@ -46,7 +44,7 @@ public class SysRecordLogService
{ {
SysLogininfor logininfor = new SysLogininfor(); SysLogininfor logininfor = new SysLogininfor();
logininfor.setUserName(username); logininfor.setUserName(username);
logininfor.setIpaddr(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); logininfor.setIpaddr(IpUtils.getIpAddr());
logininfor.setMsg(message); logininfor.setMsg(message);
// 日志状态 // 日志状态
if (StringUtils.equalsAny(status, Constants.LOGIN_SUCCESS, Constants.LOGOUT, Constants.REGISTER)) if (StringUtils.equalsAny(status, Constants.LOGIN_SUCCESS, Constants.LOGOUT, Constants.REGISTER))
@ -74,7 +72,7 @@ public class SysRecordLogService
String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase(); String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase();
sysLogsVo.setLogId(uuid); sysLogsVo.setLogId(uuid);
sysLogsVo.setOperaUserName(username); sysLogsVo.setOperaUserName(username);
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
sysLogsVo.setModel("系统认证模块"); sysLogsVo.setModel("系统认证模块");
sysLogsVo.setOperTime(DateUtils.getTime()); sysLogsVo.setOperTime(DateUtils.getTime());
sysLogsVo.setMethodType(SystemGlobal.POST); sysLogsVo.setMethodType(SystemGlobal.POST);
@ -123,7 +121,7 @@ public class SysRecordLogService
if (StringUtils.isNotEmpty(userId)){ if (StringUtils.isNotEmpty(userId)){
sysLogsVo.setUserId(userId); sysLogsVo.setUserId(userId);
} }
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
sysLogsVo.setResultData("用户登录成功"); sysLogsVo.setResultData("用户登录成功");
sysLogsVo.setTitle("系统登录"); sysLogsVo.setTitle("系统登录");
sysLogsVo.setModel("系统认证模块"); sysLogsVo.setModel("系统认证模块");
@ -132,7 +130,7 @@ public class SysRecordLogService
sysLogsVo.setMethod("login()"); sysLogsVo.setMethod("login()");
sysLogsVo.setLogId(uuid); sysLogsVo.setLogId(uuid);
sysLogsVo.setOperaUserName(username); sysLogsVo.setOperaUserName(username);
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
sysLogsVo.setParams("{\"username\":\""+username+"\"}"); sysLogsVo.setParams("{\"username\":\""+username+"\"}");
sysLogsVo.setOperateDetail("用户登录系统"); sysLogsVo.setOperateDetail("用户登录系统");
sysLogsVo.setErrType(errMessage); sysLogsVo.setErrType(errMessage);
@ -159,7 +157,7 @@ public class SysRecordLogService
String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase(); String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase();
sysLogsVo.setLogId(uuid); sysLogsVo.setLogId(uuid);
sysLogsVo.setOperaUserName(username); sysLogsVo.setOperaUserName(username);
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
sysLogsVo.setModel("系统认证模块"); sysLogsVo.setModel("系统认证模块");
sysLogsVo.setLogType(0); sysLogsVo.setLogType(0);
if (StringUtils.isNotEmpty(userId)){ if (StringUtils.isNotEmpty(userId)){
@ -200,7 +198,7 @@ public class SysRecordLogService
String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase(); String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase();
sysLogsVo.setLogId(uuid); sysLogsVo.setLogId(uuid);
sysLogsVo.setOperaUserName(username); sysLogsVo.setOperaUserName(username);
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
sysLogsVo.setModel("系统认证模块"); sysLogsVo.setModel("系统认证模块");
sysLogsVo.setLogType(0); sysLogsVo.setLogType(0);
if (StringUtils.isNotEmpty(userId)){ if (StringUtils.isNotEmpty(userId)){
@ -233,7 +231,7 @@ public class SysRecordLogService
String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase(); String uuid= UUID.randomUUID().toString().replace("-","").toUpperCase();
sysLogsVo.setLogId(uuid); sysLogsVo.setLogId(uuid);
sysLogsVo.setOperaUserName(username); sysLogsVo.setOperaUserName(username);
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
sysLogsVo.setModel("系统认证模块"); sysLogsVo.setModel("系统认证模块");
sysLogsVo.setLogType(0); sysLogsVo.setLogType(0);
if (StringUtils.isNotEmpty(userId)){ if (StringUtils.isNotEmpty(userId)){

6
bonus-common/bonus-common-config/src/main/java/com/bonus/config/SystemConfig.java
View File

@ -50,12 +50,6 @@ public class SystemConfig {
*/ */
private String websocketurl; private String websocketurl;
/**
* 信任的代理ip list
*/
private List<String> trustedProxyIps;
@Data @Data
@RefreshScope @RefreshScope
public static class LoginConfig { public static class LoginConfig {

24
bonus-common/bonus-common-core/src/main/java/com/bonus/common/core/utils/ip/IpUtils.java
View File

@ -1,12 +1,11 @@
package com.bonus.common.core.utils.ip; package com.bonus.common.core.utils.ip;
import java.net.InetAddress; import java.net.InetAddress;
import java.net.UnknownHostException; import java.net.UnknownHostException;
import java.util.List;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import com.bonus.common.core.utils.ServletUtils; import com.bonus.common.core.utils.ServletUtils;
import com.bonus.common.core.utils.StringUtils; import com.bonus.common.core.utils.StringUtils;
import org.springframework.util.ObjectUtils;
/** /**
* 获取IP方法 * 获取IP方法
@ -37,9 +36,9 @@ public class IpUtils
* *
* @return IP地址 * @return IP地址
*/ */
public static String getIpAddr(List<String> trustedProxy) public static String getIpAddr()
{ {
return getIpAddr(ServletUtils.getRequest(), trustedProxy); return getIpAddr(ServletUtils.getRequest());
} }
/** /**
@ -48,7 +47,7 @@ public class IpUtils
* @param request 请求对象 * @param request 请求对象
* @return IP地址 * @return IP地址
*/ */
public static String getIpAddr(HttpServletRequest request,List<String> trustedProxy) public static String getIpAddr(HttpServletRequest request)
{ {
if (request == null) if (request == null)
{ {
@ -72,17 +71,12 @@ public class IpUtils
ip = request.getHeader("X-Real-IP"); ip = request.getHeader("X-Real-IP");
} }
String remoteAddr = request.getRemoteAddr(); if (ip == null || ip.length() == 0 || IP_UNKNOWN.equalsIgnoreCase(ip))
if (!StringUtils.isEmpty(ip) && !StringUtils.isEmpty(remoteAddr) && !ObjectUtils.isEmpty(trustedProxy)) { {
//使用代理的情况下确定代理是可信的 ip = request.getRemoteAddr();
if (trustedProxy.contains(remoteAddr)) {
return "0:0:0:0:0:0:0:1".equals(ip) ? "127.0.0.1" : getMultistageReverseProxyIp(ip);
}
} }
if (!StringUtils.isEmpty(remoteAddr)) {
return "0:0:0:0:0:0:0:1".equals(remoteAddr) ? "127.0.0.1" : getMultistageReverseProxyIp(remoteAddr); return "0:0:0:0:0:0:0:1".equals(ip) ? "127.0.0.1" : getMultistageReverseProxyIp(ip);
}
return IP_UNKNOWN;
} }
/** /**

5
bonus-common/bonus-common-log/src/main/java/com/bonus/common/log/aspect/LogAspect.java
View File

@ -57,9 +57,6 @@ public class LogAspect
@Autowired @Autowired
private AsyncLogService asyncLogService; private AsyncLogService asyncLogService;
@Resource
private SystemConfig systemConfig;
/** /**
* 处理请求前执行 * 处理请求前执行
*/ */
@ -125,7 +122,7 @@ public class LogAspect
sysLogsVo.setOperateDetail(controllerLog.details()); sysLogsVo.setOperateDetail(controllerLog.details());
} }
sysLogsVo.setIp(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); sysLogsVo.setIp(IpUtils.getIpAddr());
// 设置方法名称 // 设置方法名称
String className = joinPoint.getTarget().getClass().getName(); String className = joinPoint.getTarget().getClass().getName();
String methodName = joinPoint.getSignature().getName(); String methodName = joinPoint.getSignature().getName();

2
bonus-common/bonus-common-security/src/main/java/com/bonus/common/security/auth/AuthLogic.java
View File

@ -184,7 +184,7 @@ public class AuthLogic
public void addErrorLogs(ProceedingJoinPoint joinPoint,RequiresPermissions requiresPermissions){ public void addErrorLogs(ProceedingJoinPoint joinPoint,RequiresPermissions requiresPermissions){
try{ try{
LoginUser loginUser = getLoginUser(); LoginUser loginUser = getLoginUser();
loginUser.setIpaddr(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); loginUser.setIpaddr(IpUtils.getIpAddr());
SysLogsVo vo=SysLogsVo.getExceedAuthorithSysLogsVo(loginUser,joinPoint); SysLogsVo vo=SysLogsVo.getExceedAuthorithSysLogsVo(loginUser,joinPoint);
LogsUtils.setRequestValue(joinPoint,vo,null); LogsUtils.setRequestValue(joinPoint,vo,null);
SysLogsVo sysLogsVo=new SysLogsVo(); SysLogsVo sysLogsVo=new SysLogsVo();

4
bonus-common/bonus-common-security/src/main/java/com/bonus/common/security/feign/FeignRequestInterceptor.java
View File

@ -21,8 +21,6 @@ import feign.RequestTemplate;
@Component @Component
public class FeignRequestInterceptor implements RequestInterceptor public class FeignRequestInterceptor implements RequestInterceptor
{ {
public SystemConfig systemConfig = SpringUtils.getBean(SystemConfig.class);
@Override @Override
public void apply(RequestTemplate requestTemplate) public void apply(RequestTemplate requestTemplate)
{ {
@ -53,7 +51,7 @@ public class FeignRequestInterceptor implements RequestInterceptor
} }
// 配置客户端IP // 配置客户端IP
requestTemplate.header("X-Forwarded-For", IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); requestTemplate.header("X-Forwarded-For", IpUtils.getIpAddr());
} }
} }
} }

2
bonus-common/bonus-common-security/src/main/java/com/bonus/common/security/service/TokenService.java
View File

@ -72,7 +72,7 @@ public class TokenService {
loginUser.setToken(token); loginUser.setToken(token);
loginUser.setUserid(userId); loginUser.setUserid(userId);
loginUser.setUsername(userName); loginUser.setUsername(userName);
loginUser.setIpaddr(IpUtils.getIpAddr(systemConfig.getTrustedProxyIps())); loginUser.setIpaddr(IpUtils.getIpAddr());
refreshToken(loginUser); refreshToken(loginUser);
// Jwt存储信息 // Jwt存储信息
Map<String, Object> claimsMap = new HashMap<String, Object>(16); Map<String, Object> claimsMap = new HashMap<String, Object>(16);

4
bonus-modules/bonus-system/src/main/java/com/bonus/system/service/impl/SysLogServiceImpl.java
View File

@ -49,8 +49,6 @@ public class SysLogServiceImpl implements ISysLogService {
@Autowired @Autowired
private ApplicationEventPublisher eventPublisher; private ApplicationEventPublisher eventPublisher;
@Autowired
private SystemConfig systemConfig;
@Override @Override
@Transactional(rollbackFor = Exception.class) @Transactional(rollbackFor = Exception.class)
@ -86,7 +84,7 @@ public class SysLogServiceImpl implements ISysLogService {
public void saveLogs(SysLogsVo sysLog, HttpServletRequest request) { public void saveLogs(SysLogsVo sysLog, HttpServletRequest request) {
try{ try{
String loginUuid = IdUtils.fastUUID(); String loginUuid = IdUtils.fastUUID();
String ip = IpUtils.getIpAddr(request, systemConfig.getTrustedProxyIps()); String ip = IpUtils.getIpAddr(request);
sysLog.setIp(ip); sysLog.setIp(ip);
sysLog.setLogId(loginUuid); sysLog.setLogId(loginUuid);
sysLog.setGrade("高"); sysLog.setGrade("高");