From 227a1257191fb5d4409516ce35208b1fff5725d7 Mon Sep 17 00:00:00 2001 From: jiangqiang Date: Mon, 11 Jul 2022 15:15:25 +0800 Subject: [PATCH] =?UTF-8?q?=E7=A7=AF=E6=9C=A8=E6=8A=A5=E8=A1=A8post?= =?UTF-8?q?=E8=AF=B7=E6=B1=82=E5=A2=9E=E5=8A=A0=E8=BA=AB=E4=BB=BD=E8=AE=A4?= =?UTF-8?q?=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../filter/TokenAuthenticationFilter.java | 31 ++++++++++++++++--- .../core/util/SecurityFrameworkUtils.java | 17 ++++++++++ .../config/SecurityConfiguration.java | 3 +- .../src/views/visualization/jm/index.vue | 3 +- 4 files changed, 47 insertions(+), 7 deletions(-) diff --git a/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/filter/TokenAuthenticationFilter.java b/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/filter/TokenAuthenticationFilter.java index e87f5bc44..29907a6a1 100644 --- a/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/filter/TokenAuthenticationFilter.java +++ b/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/filter/TokenAuthenticationFilter.java @@ -37,13 +37,34 @@ public class TokenAuthenticationFilter extends OncePerRequestFilter { private final OAuth2TokenApi oauth2TokenApi; + /** + * 积木报表内部请求获取token + * + * @param request + * @return + */ + private static String getToken(HttpServletRequest request) { + String token = request.getParameter("token"); + if (token == null) { + token = request.getHeader("X-Access-Token"); + } + return token; + } + @Override @SuppressWarnings("NullableProblems") protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { - String token = SecurityFrameworkUtils.obtainAuthorization(request, securityProperties.getTokenHeader()); + String token; + Integer userType; + if (request.getRequestURI().startsWith("/jmreport/")) { + token = getToken(request); + userType = 2; + } else { + token = SecurityFrameworkUtils.obtainAuthorization(request, securityProperties.getTokenHeader()); + userType = WebFrameworkUtils.getLoginUserType(request); + } if (StrUtil.isNotEmpty(token)) { - Integer userType = WebFrameworkUtils.getLoginUserType(request); try { // 1.1 基于 token 构建登录用户 LoginUser loginUser = buildLoginUserByToken(token, userType); @@ -88,11 +109,11 @@ public class TokenAuthenticationFilter extends OncePerRequestFilter { /** * 模拟登录用户，方便日常开发调试 - * + *

* 注意，在线上环境下，一定要关闭该功能！！！ * - * @param request 请求 - * @param token 模拟的 token，格式为 {@link SecurityProperties#getMockSecret()} + 用户编号 + * @param request 请求 + * @param token 模拟的 token，格式为 {@link SecurityProperties#getMockSecret()} + 用户编号 * @param userType 用户类型 * @return 模拟的 LoginUser */ diff --git a/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/util/SecurityFrameworkUtils.java b/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/util/SecurityFrameworkUtils.java index 5dc17b626..a64f4aafd 100644 --- a/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/util/SecurityFrameworkUtils.java +++ b/yudao-framework/yudao-spring-boot-starter-security/src/main/java/cn/iocoder/yudao/framework/security/core/util/SecurityFrameworkUtils.java @@ -24,6 +24,20 @@ public class SecurityFrameworkUtils { private SecurityFrameworkUtils() {} + /** + * 积木报表内部请求获取token + * + * @param request + * @return + */ + private static String getToken(HttpServletRequest request) { + String token = request.getParameter("token"); + if (token == null) { + token = request.getHeader("X-Access-Token"); + } + return token; + } + /** * 从请求中，获得认证 Token * @@ -32,6 +46,9 @@ public class SecurityFrameworkUtils { * @return 认证 Token */ public static String obtainAuthorization(HttpServletRequest request, String header) { + if (request.getRequestURI().startsWith("/jmreport/")) { + return getToken(request); + } String authorization = request.getHeader(header); if (!StringUtils.hasText(authorization)) { return null; diff --git a/yudao-module-visualization/yudao-module-visualization-biz/src/main/java/cn/iocoder/yudao/module/visualization/framework/security/config/SecurityConfiguration.java b/yudao-module-visualization/yudao-module-visualization-biz/src/main/java/cn/iocoder/yudao/module/visualization/framework/security/config/SecurityConfiguration.java index f35855a85..bc8a1f249 100644 --- a/yudao-module-visualization/yudao-module-visualization-biz/src/main/java/cn/iocoder/yudao/module/visualization/framework/security/config/SecurityConfiguration.java +++ b/yudao-module-visualization/yudao-module-visualization-biz/src/main/java/cn/iocoder/yudao/module/visualization/framework/security/config/SecurityConfiguration.java @@ -3,6 +3,7 @@ package cn.iocoder.yudao.module.visualization.framework.security.config; import cn.iocoder.yudao.framework.security.config.AuthorizeRequestsCustomizer; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; @@ -17,7 +18,7 @@ public class SecurityConfiguration { return new AuthorizeRequestsCustomizer() { @Override public void customize(ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry registry) { - registry.antMatchers("/jmreport/**").anonymous(); + registry.antMatchers(HttpMethod.GET, "/jmreport/**").permitAll(); } }; } diff --git a/yudao-ui-admin/src/views/visualization/jm/index.vue b/yudao-ui-admin/src/views/visualization/jm/index.vue index 1bfa13875..55c267cf3 100644 --- a/yudao-ui-admin/src/views/visualization/jm/index.vue +++ b/yudao-ui-admin/src/views/visualization/jm/index.vue @@ -6,12 +6,13 @@