审计漏洞

servers/boe-server-all/pom.xml

@@ -125,7 +125,9 @@
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
+			<version>2.7.18</version>
 		</dependency>
+
 		<dependency>
 			<groupId>org.springframework.session</groupId>
 			<artifactId>spring-session-data-redis</artifactId>

servers/boe-server-all/src/main/java/com/xboe/module/teacher/service/impl/TeacherServiceImpl.java

@@ -101,7 +101,7 @@ public class TeacherServiceImpl implements ITeacherService {
     @Override
     public List<Teacher> findByName(String name) {
     	String hql="Select t.id,t.name,u.userNo from "+Teacher.class.getSimpleName()+" t,"+User.class.getSimpleName()+" u ";
-    	hql+=" where t.id=u.id and t.status = 1 and (t.name like '%"+name+"%' or u.userNo=?1)";
+    	hql+=" where t.id=u.id and (t.name like '%"+name+"%' or u.userNo=?1)";
     	List<Teacher> teachers=new ArrayList<Teacher>();
     	try {
 			List<Object[]> list =dao.findListFields(hql,name);

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyCourseApi.java

@@ -11,7 +11,6 @@ import com.xboe.api.vo.*;
 import com.xboe.module.course.vo.TeacherVo;
 import com.xboe.module.usergroup.entity.UserGroupItem;
 import com.xboe.module.usergroup.service.IUserGroupService;
-import com.xboe.school.study.dao.StudyCourseDao;
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -66,9 +65,7 @@ import javax.servlet.http.HttpServletRequest;
 @RestController
 @RequestMapping(value="/xboe/school/study/course")
 public class StudyCourseApi extends ApiBaseController{
-
-
-
+	
 	@Autowired
 	IStudyCourseService service;
 	
@@ -324,19 +321,8 @@ public class StudyCourseApi extends ApiBaseController{
 		if (StringUtils.isEmpty(token)) {
 			token = request.getHeader("token");
 		}
-
-
 		//检查是否已存在
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
-
-		// 20240815 特训营结营考试 临时代码
-//		if(item != null && redisTemplate.opsForValue().get(item.getId())==null){
-//			redisTemplate.opsForValue().set(item.getId(),item.getId());
-//			//设置过期时间为1天
-//			redisTemplate.expire(item.getId(), 60, TimeUnit.SECONDS);
-//		}else{
-//			return success("");
-//		}
 		if(item!=null) {
 			//如果记录存在，但是进度不100无成情况，就更新进度，一期不会有这种情况
 			if(item.getProgress()<100 && sci.getProgress()>item.getProgress()) {
@@ -421,14 +407,6 @@ public class StudyCourseApi extends ApiBaseController{
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
 		if(item!=null) {
 			//如果记录存在，但是进度不到100，未完成情况，就更新进度，一期不会有这种情况
-			// 20240815 特训营结营考试 临时代码
-//			if(item != null && redisTemplate.opsForValue().get(item.getId())==null){
-//				redisTemplate.opsForValue().set(item.getId(),item.getId());
-//				//设置过期时间为1天
-//				redisTemplate.expire(item.getId(), 60, TimeUnit.SECONDS);
-//			}else{
-//				return success("");
-//			}
 			if(item.getProgress()<100) {
 				studyService.updateProcess(item.getId(),sci.getStudyId(),sci.getCourseId(), sci.getContentTotal(),100,token);
 			}
@@ -534,14 +512,6 @@ public class StudyCourseApi extends ApiBaseController{
 			token = request.getHeader("token");
 		}
 		try {
-			// 20240815 特训营结营考试 临时代码
-//			if(itemId != null && redisTemplate.opsForValue().get(itemId)==null){
-//				redisTemplate.opsForValue().set(itemId,itemId);
-//				//设置过期时间为1天
-//				redisTemplate.expire(itemId, 60, TimeUnit.SECONDS);
-//			}else{
-//				return success(true);
-//			}
 			studyService.finishVideoStudyItem(itemId, studyId,courseId,cnum,token);
 			List<StudyCourse> allUserList = thirdApi.getStudyCourseList(studyId ,courseId, token);
 			log.info("在线课学习记录"+allUserList);
@@ -723,10 +693,9 @@ public class StudyCourseApi extends ApiBaseController{
 			return error("查询失败",e.getMessage());
 		}
 	}
-
 	
 	@RequestMapping(value="/study-course-content",method = {RequestMethod.GET,RequestMethod.POST})
-	public JsonResponse<StudyCourseItem> findStudyCourseItem(String studyId,String contentId, HttpServletRequest request){
+	public JsonResponse<StudyCourseItem> findStudyCourseItem(String studyId,String contentId){
 		if(StringUtils.isBlank(studyId)){
 			return error("无学习信息");
 		}

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyExamApi.java

@@ -7,7 +7,6 @@ import java.util.Map;
 import java.util.concurrent.TimeUnit;
 
 import com.xboe.api.ThirdApi;
-import com.xboe.school.study.dao.StudyCourseDao;
 import com.xboe.school.study.entity.StudyCourse;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -33,8 +32,6 @@ import javax.servlet.http.HttpServletRequest;
 @RestController
 @RequestMapping(value="/xboe/school/study/exam")
 public class StudyExamApi extends ApiBaseController{
-	@Autowired
-	StudyCourseDao scDao;
 
 	@Autowired
 	IStudyExamService sexamService;

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyServiceImpl.java

@@ -98,12 +98,8 @@ public class StudyServiceImpl implements IStudyService{
 		//sci.setProgress(100);//直接设置为学习完成
 		sci.setLastTime(ldt);
 		scItemDao.saveOrUpdate(sci);
-		if (sci.getId() != null){
-			dto.setStudyItemId(sci.getId());
-		}else {
-			log.info("学习记录插入失败"+sci.getId());
-			throw new IllegalArgumentException("学习记录插入失败");
-		}
+		
+		dto.setStudyItemId(sci.getId());
 		//检查是否全部学习完成
 		scDao.finishCheck(dto.getStudyId(),dto.getCourseId(),dto.getContentTotal(),token);