代码审计-spring

# Conflicts:
#	servers/boe-server-all/src/main/java/com/xboe/module/exam/entity/ExamTest.java

servers/boe-server-all/pom.xml

@@ -58,7 +58,7 @@
 			<artifactId>xboe-module-scorm</artifactId>
 			<version>1.0.0</version>
 		</dependency>
-		 <dependency>
+		<dependency>
 			<groupId>com.xboe</groupId>
 			<artifactId>xboe-core</artifactId>
 			<version>1.0.0</version>
@@ -233,6 +233,31 @@
 			<artifactId>spring-retry</artifactId>
 			<version>1.3.1</version>
 		</dependency>
+
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-webmvc</artifactId>
+			<version>5.3.26</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.yaml</groupId>
+			<artifactId>snakeyaml</artifactId>
+			<version>2.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-text</artifactId>
+			<version>1.10.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.apache.tomcat.embed</groupId>
+			<artifactId>tomcat-embed-core</artifactId>
+			<version>9.0.83</version>
+		</dependency>
+
 	</dependencies>
 	<build>
 		<resources>

servers/boe-server-all/src/main/java/com/xboe/api/ThirdApi.java

@@ -12,13 +12,10 @@ import com.xboe.module.dict.entity.DictDto;
 import com.xboe.module.exam.entity.ExamTest;
 import com.xboe.school.study.entity.StudyCourse;
 import com.xboe.system.user.dao.UserDao;
-import com.xboe.system.user.entity.User;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.data.domain.Page;
 import org.springframework.stereotype.Service;
-import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Optional;

servers/boe-server-all/src/main/java/com/xboe/module/exam/entity/ExamTest.java

@@ -178,6 +178,4 @@ public class ExamTest extends BaseEntity {
     
     @Transient
     private String paperName;
-
-
 }

servers/boe-server-all/src/main/java/com/xboe/module/exam/service/impl/ExamTestServiceImpl.java

@@ -95,7 +95,7 @@ public class ExamTestServiceImpl implements IExamTestService {
 
     @Override
     public Boolean has(String paperId) {
-    	ExamTest et=examTestDao.findOne(FieldFilters.eq("paperId", paperId));
+    	ExamTest et=examTestDao.findOne(FieldFilters.eq("paperId", paperId),FieldFilters.eq("deleted", false));
     	//String etId= (String)examTestDao.findField("id", FieldFilters.eq("paperId", paperId));
         if(et==null){
             return true;

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyCourseApi.java

@@ -11,6 +11,7 @@ import com.xboe.api.vo.*;
 import com.xboe.module.course.vo.TeacherVo;
 import com.xboe.module.usergroup.entity.UserGroupItem;
 import com.xboe.module.usergroup.service.IUserGroupService;
+import com.xboe.school.study.dao.StudyCourseDao;
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -65,7 +66,9 @@ import javax.servlet.http.HttpServletRequest;
 @RestController
 @RequestMapping(value="/xboe/school/study/course")
 public class StudyCourseApi extends ApiBaseController{
-	
+
+
+
 	@Autowired
 	IStudyCourseService service;
 	
@@ -321,8 +324,19 @@ public class StudyCourseApi extends ApiBaseController{
 		if (StringUtils.isEmpty(token)) {
 			token = request.getHeader("token");
 		}
+
+
 		//检查是否已存在
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
+
+		// 20240815 特训营结营考试 临时代码
+//		if(item != null && redisTemplate.opsForValue().get(item.getId())==null){
+//			redisTemplate.opsForValue().set(item.getId(),item.getId());
+//			//设置过期时间为1天
+//			redisTemplate.expire(item.getId(), 60, TimeUnit.SECONDS);
+//		}else{
+//			return success("");
+//		}
 		if(item!=null) {
 			//如果记录存在，但是进度不100无成情况，就更新进度，一期不会有这种情况
 			if(item.getProgress()<100 && sci.getProgress()>item.getProgress()) {
@@ -407,6 +421,14 @@ public class StudyCourseApi extends ApiBaseController{
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
 		if(item!=null) {
 			//如果记录存在，但是进度不到100，未完成情况，就更新进度，一期不会有这种情况
+			// 20240815 特训营结营考试 临时代码
+//			if(item != null && redisTemplate.opsForValue().get(item.getId())==null){
+//				redisTemplate.opsForValue().set(item.getId(),item.getId());
+//				//设置过期时间为1天
+//				redisTemplate.expire(item.getId(), 60, TimeUnit.SECONDS);
+//			}else{
+//				return success("");
+//			}
 			if(item.getProgress()<100) {
 				studyService.updateProcess(item.getId(),sci.getStudyId(),sci.getCourseId(), sci.getContentTotal(),100,token);
 			}
@@ -512,6 +534,14 @@ public class StudyCourseApi extends ApiBaseController{
 			token = request.getHeader("token");
 		}
 		try {
+			// 20240815 特训营结营考试 临时代码
+//			if(itemId != null && redisTemplate.opsForValue().get(itemId)==null){
+//				redisTemplate.opsForValue().set(itemId,itemId);
+//				//设置过期时间为1天
+//				redisTemplate.expire(itemId, 60, TimeUnit.SECONDS);
+//			}else{
+//				return success(true);
+//			}
 			studyService.finishVideoStudyItem(itemId, studyId,courseId,cnum,token);
 			List<StudyCourse> allUserList = thirdApi.getStudyCourseList(studyId ,courseId, token);
 			log.info("在线课学习记录"+allUserList);
@@ -693,9 +723,10 @@ public class StudyCourseApi extends ApiBaseController{
 			return error("查询失败",e.getMessage());
 		}
 	}
+
 	
 	@RequestMapping(value="/study-course-content",method = {RequestMethod.GET,RequestMethod.POST})
-	public JsonResponse<StudyCourseItem> findStudyCourseItem(String studyId,String contentId){
+	public JsonResponse<StudyCourseItem> findStudyCourseItem(String studyId,String contentId, HttpServletRequest request){
 		if(StringUtils.isBlank(studyId)){
 			return error("无学习信息");
 		}

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyExamApi.java

@@ -7,6 +7,7 @@ import java.util.Map;
 import java.util.concurrent.TimeUnit;
 
 import com.xboe.api.ThirdApi;
+import com.xboe.school.study.dao.StudyCourseDao;
 import com.xboe.school.study.entity.StudyCourse;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -32,6 +33,8 @@ import javax.servlet.http.HttpServletRequest;
 @RestController
 @RequestMapping(value="/xboe/school/study/exam")
 public class StudyExamApi extends ApiBaseController{
+	@Autowired
+	StudyCourseDao scDao;
 
 	@Autowired
 	IStudyExamService sexamService;

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyAssessServiceImpl.java

@@ -44,7 +44,7 @@ public class StudyAssessServiceImpl implements IStudyAssessService{
 			LocalDateTime ldt=LocalDateTime.now();
 			sci.setStudyId(assess.getStudyId());
 			sci.setContentId(assess.getContentId());
-			//sci.setContentName(homework.getContentName());
+			sci.setContentName("评估");
 			sci.setCourseId(assess.getCourseId());
 			//sci.setCsectionId(homework.getCsectionId());
 			sci.setProgress(100);//直接设置为学习完成

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyExamServiceImpl.java

@@ -82,7 +82,7 @@ public class StudyExamServiceImpl implements IStudyExamService{
 			LocalDateTime ldt=LocalDateTime.now();
 			sci.setStudyId(exam.getStudyId());
 			sci.setContentId(exam.getContentId());
-			//sci.setContentName(homework.getContentName());
+			sci.setContentName("考试");
 			sci.setCourseId(exam.getCourseId());
 			//sci.setCsectionId(homework.getCsectionId());
 			sci.setProgress(prog);//直接设置为学习完成

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyHomeWorkServiceImpl.java

@@ -46,7 +46,7 @@ public class StudyHomeWorkServiceImpl implements IStudyHomeWorkService{
 			LocalDateTime ldt=LocalDateTime.now();
 			sci.setStudyId(homework.getStudyId());
 			sci.setContentId(homework.getContentId());
-			//sci.setContentName(homework.getContentName());
+			sci.setContentName(homework.getHwName());
 			sci.setCourseId(homework.getCourseId());
 			//sci.setCsectionId(homework.getCsectionId());
 			sci.setProgress(100);//直接设置为学习完成
@@ -67,7 +67,7 @@ public class StudyHomeWorkServiceImpl implements IStudyHomeWorkService{
 			//只是保留一条作业记录，不再保存多条记录了
 			//dao.save(homework);
 			//设置id。然后进行悠
-			homework.setId(obj.toString());
+			homework.setId(homework.getStudyItemId());
 			dao.update(homework);
 		}
 	}

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyServiceImpl.java

@@ -98,8 +98,12 @@ public class StudyServiceImpl implements IStudyService{
 		//sci.setProgress(100);//直接设置为学习完成
 		sci.setLastTime(ldt);
 		scItemDao.saveOrUpdate(sci);
-		
+		if (sci.getId() != null){
-		dto.setStudyItemId(sci.getId());
+			dto.setStudyItemId(sci.getId());
+		}else {
+			log.info("学习记录插入失败"+sci.getId());
+			throw new IllegalArgumentException("学习记录插入失败");
+		}
 		//检查是否全部学习完成
 		scDao.finishCheck(dto.getStudyId(),dto.getCourseId(),dto.getContentTotal(),token);
 		
@@ -182,7 +186,7 @@ public class StudyServiceImpl implements IStudyService{
 		if(StringUtils.isNotBlank(name)) {
 			query.addFilter(FieldFilters.eq("aname", name));
 		}
-		int pageIndex2 = pageIndex-1;
+		int pageIndex2 = (pageIndex-1)*10;
 		if(status!=null) {
 			if(status==3) {
 				query.addFilter(FieldFilters.eq("status", 2));
@@ -193,16 +197,16 @@ public class StudyServiceImpl implements IStudyService{
 			}else if (status == 1) {
 				String sql = "select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,item.content_id,0 as progress,1 as status from boe_study_course bsc " +
 						" left join boe_study_course_item item on bsc.course_id = item.course_id and bsc.id = item.study_id" +
-						" where bsc.course_id = '"+courseId+"' and bsc.id not in(" +
+						" where bsc.course_id = '"+courseId+"' and bsc.aname like '%"+name+"%' and bsc.id not in(" +
 						" select item.study_id from boe_study_course_item item " +
-						" where item.course_id = '" + courseId + "' and item.content_id = '"+ contentId+"' group by item.study_id" +
+						" where item.course_id = '" + courseId + "' and item.content_id = '"+ contentId+"' and item.aname like '%"+name+"%' group by item.study_id" +
 						" ) group by bsc.id limit "+ pageIndex2+","+ pageSize+";";
 
 				String sql2 = "select count(*) as total from (select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,item.content_id,0 as progress,1 as status from boe_study_course bsc " +
 						" left join boe_study_course_item item on bsc.course_id = item.course_id and bsc.id = item.study_id" +
-						" where bsc.course_id = '"+courseId+"' and bsc.id not in(" +
+						" where bsc.course_id = '"+courseId+"' and bsc.aname like '%"+name+"%' and bsc.id not in(" +
 						" select item.study_id from boe_study_course_item item " +
-						" where item.course_id = '" + courseId + "' and item.content_id = '"+ contentId+"' group by item.study_id" +
+						" where item.course_id = '" + courseId + "' and item.content_id = '"+ contentId+"' and item.aname like '%"+name+"%' group by item.study_id" +
 						" ) group by bsc.id) as total";
 				log.info("资源完成情况未开始sql"+sql);
 				List<Object[]> list = scDao.sqlFindList(sql);
@@ -224,46 +228,22 @@ public class StudyServiceImpl implements IStudyService{
 				return pageList;
 			}
 		}
-//		String sql = "select * from (select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,item.progress,item.status from boe_study_course bsc left join " +
-//				"boe_study_course_item item on item.course_id = bsc.course_id and item.study_id = bsc.id " +
-//				"where bsc.`status` in (2,9) and bsc.course_id = '"+ courseId+"' group by bsc.id " +
-//				" UNION ALL " +
-//				" select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,0 as progress,1 as status from boe_study_course bsc " +
-//				" LEFT JOIN boe_study_course_item item on item.course_id = bsc.course_id " +
-//				" where bsc.course_id = '"+courseId+"' and bsc.id not in (" +
-//				" select bsc.id from boe_study_course bsc " +
-//				" left join boe_study_course_item item on item.course_id = bsc.course_id and item.study_id = bsc.id " +
-//				" where bsc.course_id = '" + courseId + "' and item.content_id = '"+ contentId+"' group by bsc.id" +
-//				" )group by bsc.id) a group by a.id limit "+ pageIndex+","+ pageSize+";";
-
-//		String sql2 = "select count(*) from (select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,item.progress,item.status from boe_study_course bsc left join " +
-//				"boe_study_course_item item on item.course_id = bsc.course_id and item.study_id = bsc.id " +
-//				"where bsc.`status` in (2,9) and bsc.course_id = '"+ courseId+"' group by bsc.id " +
-//				" UNION ALL " +
-//				" select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,0 as progress,1 as status from boe_study_course bsc " +
-//				" LEFT JOIN boe_study_course_item item on item.course_id = bsc.course_id " +
-//				" where bsc.course_id = '"+courseId+"' and bsc.id not in (" +
-//				" select bsc.id from boe_study_course bsc " +
-//				" left join boe_study_course_item item on item.course_id = bsc.course_id and item.study_id = bsc.id " +
-//				" where bsc.course_id = '" + courseId + "' and item.content_id = '"+ contentId+"' group by bsc.id" +
-//				" )group by bsc.id) a group by a.id";
-
 		String sql = "select a.id, a.course_id, a.course_name, a.aname, " +
 				"IFNULL(b.finish_time, '0') as finish_time, IFNULL(b.progress, 0) as progress, IFNULL(b.status, 1) as status " +
-				"from (select id, course_id, course_name, aname, 0, 1 from boe_study_course where course_id = '" + courseId + "') a " +
+				"from (select id, course_id, course_name, aname, 0, 1 from boe_study_course where course_id = '" + courseId + "' and aname like '%"+name+"%') a " +
 				"left join " +
 				"(select bsc.id, bsc.course_id, bsc.course_name, bsc.aname, item.finish_time, item.progress, item.status " +
 				"from boe_study_course bsc left join boe_study_course_item item on item.course_id = bsc.course_id and item.study_id = bsc.id " +
-				"where bsc.course_id = '" + courseId + "' and item.content_id = '" + contentId + "' group by bsc.id) b " +
+				"where bsc.course_id = '" + courseId + "' and item.content_id = '" + contentId + "' and item.aname like '%"+name+"%' group by bsc.id) b " +
 				"on a.course_id = b.course_id and a.id = b.id " +
 				"group by a.id limit "+ pageIndex2+","+ pageSize+";";
 		String sql2 = "select count(*) as total from (select a.id, a.course_id, a.course_name, a.aname, " +
 				"IFNULL(b.finish_time, 0) as finish_time, IFNULL(b.progress, 0) as progress, IFNULL(b.status, 1) as status " +
-				"from (select id, course_id, course_name, aname, 0, 1 from boe_study_course where course_id = '" + courseId + "') a " +
+				"from (select id, course_id, course_name, aname, 0, 1 from boe_study_course where course_id = '" + courseId + "' and aname like '%"+name+"%') a " +
 				"left join " +
 				"(select bsc.id, bsc.course_id, bsc.course_name, bsc.aname, item.finish_time, item.progress, item.status " +
 				"from boe_study_course bsc left join boe_study_course_item item on item.course_id = bsc.course_id and item.study_id = bsc.id " +
-				"where bsc.course_id = '" + courseId + "' and item.content_id = '" + contentId + "' group by bsc.id) b " +
+				"where bsc.course_id = '" + courseId + "' and item.content_id = '" + contentId + "' and item.aname like '%"+name+"%' group by bsc.id) b " +
 				"on a.course_id = b.course_id and a.id = b.id " +
 				"group by a.id) as total";
 		log.info("资源完成情况全部sql"+sql);