Commit 8a8c5a42 authored by 技术部-任文超's avatar 技术部-任文超

免密访问接口不应对白名单赋特权,删除白名单逻辑

parent 5dc3aeca
......@@ -6,7 +6,6 @@ import cn.quantgroup.xyqb.model.JsonResult;
import cn.quantgroup.xyqb.model.session.SessionStruct;
import cn.quantgroup.xyqb.session.XyqbSessionContextHolder;
import cn.quantgroup.xyqb.util.IPUtil;
import cn.quantgroup.xyqb.util.ValidationUtil;
import org.apache.commons.lang3.StringUtils;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
......@@ -57,7 +56,7 @@ public class PasswordFreeAccessValidateAdvisor {
@Around("passwordFreeAccess()")
private Object checkToken(ProceedingJoinPoint pjp) throws Throwable {
HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
boolean valid = tokenValid(request) || ipValid(request);
boolean valid = tokenValid(request);
if (valid) {
return pjp.proceed();
}
......@@ -111,28 +110,4 @@ public class PasswordFreeAccessValidateAdvisor {
return valid;
}
/**
* 校验免密访问
* 规则:来访IP与白名单匹配
* @return True or False
*/
private boolean ipValid(HttpServletRequest request) {
Objects.requireNonNull(request, "无效请求");
// 客户端IP
String clientIp = IPUtil.getRemoteIP(request);
// 校对来访IP是否与白名单匹配
boolean validIpv4 = ValidationUtil.validateIpv4(clientIp);
// 白名单
if(validIpv4 && IPUtil.whiteOf(clientIp)){
return true;
}
// 补充白名单
if(validIpv4 && redisTemplate.opsForSet().isMember(Constants.IPV4_LOCK_WHITE, clientIp)){
return true;
}
IPUtil.logIp(LOGGER, request);
LOGGER.info("非法请求 - 未授权访问, clientIp={}", clientIp);
return false;
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment