third_codes/PowerJob
1
0
Fork 1
mirror of https://github.com/PowerJob/PowerJob.git synced 2025-07-17 00:00:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: arbitrary password modification vulnerability #99

Browse Source
This commit is contained in:
KFCFans 2020-11-14 11:49:00 +08:00
parent c845b0abca
commit 464ce2dc0c
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
powerjob-server/src/main/java/com/github/kfcfans/powerjob/server/web/controller/AppInfoController.java
View File

@ -1,5 +1,6 @@
package com.github.kfcfans.powerjob.server.web.controller; package com.github.kfcfans.powerjob.server.web.controller;
import com.github.kfcfans.powerjob.common.PowerJobException;
import com.github.kfcfans.powerjob.common.response.ResultDTO; import com.github.kfcfans.powerjob.common.response.ResultDTO;
import com.github.kfcfans.powerjob.server.persistence.core.model.AppInfoDO; import com.github.kfcfans.powerjob.server.persistence.core.model.AppInfoDO;
import com.github.kfcfans.powerjob.server.persistence.core.repository.AppInfoRepository; import com.github.kfcfans.powerjob.server.persistence.core.repository.AppInfoRepository;
@ -18,6 +19,7 @@ import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource; import javax.annotation.Resource;
import java.util.Date; import java.util.Date;
import java.util.List; import java.util.List;
import java.util.Objects;
import java.util.stream.Collectors; import java.util.stream.Collectors;
/** /**
@ -50,6 +52,11 @@ public class AppInfoController {
appInfoDO.setGmtCreate(new Date()); appInfoDO.setGmtCreate(new Date());
}else { }else {
appInfoDO = appInfoRepository.findById(id).orElseThrow(() -> new IllegalArgumentException("can't find appInfo by id:" + id)); appInfoDO = appInfoRepository.findById(id).orElseThrow(() -> new IllegalArgumentException("can't find appInfo by id:" + id));
// 对比密码
if (!Objects.equals(req.getOldPassword(), appInfoDO.getPassword())) {
throw new PowerJobException("The password is incorrect.");
}
} }
BeanUtils.copyProperties(req, appInfoDO); BeanUtils.copyProperties(req, appInfoDO);
appInfoDO.setGmtModified(new Date()); appInfoDO.setGmtModified(new Date());

1
powerjob-server/src/main/java/com/github/kfcfans/powerjob/server/web/request/ModifyAppInfoRequest.java
View File

@ -15,6 +15,7 @@ import org.apache.commons.lang3.StringUtils;
public class ModifyAppInfoRequest { public class ModifyAppInfoRequest {
private Long id; private Long id;
private String oldPassword;
private String appName; private String appName;
private String password; private String password;