代码审计-spring

# Conflicts:
#	servers/boe-server-all/src/main/java/com/xboe/module/exam/entity/ExamTest.java

servers/boe-server-all/pom.xml

@@ -58,7 +58,7 @@
 			<artifactId>xboe-module-scorm</artifactId>
 			<version>1.0.0</version>
 		</dependency>
-		 <dependency>
+		<dependency>
 			<groupId>com.xboe</groupId>
 			<artifactId>xboe-core</artifactId>
 			<version>1.0.0</version>
@@ -233,6 +233,31 @@
 			<artifactId>spring-retry</artifactId>
 			<version>1.3.1</version>
 		</dependency>
+
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-webmvc</artifactId>
+			<version>5.3.26</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.yaml</groupId>
+			<artifactId>snakeyaml</artifactId>
+			<version>2.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-text</artifactId>
+			<version>1.10.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.apache.tomcat.embed</groupId>
+			<artifactId>tomcat-embed-core</artifactId>
+			<version>9.0.83</version>
+		</dependency>
+
 	</dependencies>
 	<build>
 		<resources>

servers/boe-server-all/src/main/java/com/xboe/module/course/entity/CourseContent.java

@@ -83,8 +83,13 @@ public class CourseContent extends BaseEntity {
      * */
     @Column(name = "duration")
     private Integer duration;
-    
-    
+
+    /**
+     * 视频播放进度
+     * */
+    @Column(name = "progress_video")
+    private Float progressVideo;
+
     /**用于学习时的状态显示，非存储字段*/
     @Transient
     private Integer status;

servers/boe-server-all/src/main/java/com/xboe/module/course/service/ICourseContentService.java

@@ -82,4 +82,7 @@ public interface ICourseContentService{
 	 * @return
 	 */
 	CourseAssess getAssess(String ccid);
+
+	void updateProcessVideo(String contentId, String courseId, Float processVideo);
+
 }

servers/boe-server-all/src/main/java/com/xboe/module/course/service/impl/CourseContentServiceImpl.java

@@ -1,5 +1,7 @@
 package com.xboe.module.course.service.impl;
 
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
 import java.util.List;
 
 import javax.annotation.Resource;
@@ -141,6 +143,17 @@ public class CourseContentServiceImpl implements ICourseContentService {
 		return assess;
 	}
 
+	@Override
+	@Transactional
+	public void updateProcessVideo(String id, String courseId, Float progressVideo) {
+		// 处理 processVideo 为 null 的情况
+		if (progressVideo == null) {
+			progressVideo = 0.00f;
+		}
+		String sql = "UPDATE boe_course_content SET progress_video = "+ progressVideo+" WHERE id = "+ id+" AND course_id = "+ courseId+" ";
+		ccDao.sqlUpdate(sql);
+	}
+
 	@Override
 	@Transactional
 	public void updateName(String id, String name) {

servers/boe-server-all/src/main/java/com/xboe/module/exam/entity/ExamTest.java

@@ -28,7 +28,7 @@ public class ExamTest extends BaseEntity {
     /**
     * 考试名称
      * */
-    @Column(name = "test_name",nullable = false,length = 50)
+    @Column(name = "test_name",length = 50)
     private String testName;
     
     /**
@@ -46,7 +46,7 @@ public class ExamTest extends BaseEntity {
     /**
     * 考试时长    分钟
      * */
-    @Column(name = "test_duration",nullable = false)
+    @Column(name = "test_duration")
     private Integer testDuration;
     /**
      * 显示解析
@@ -107,13 +107,13 @@ public class ExamTest extends BaseEntity {
     /**
      * 考试的类型
      * */
-    @Column(name = "test_type",nullable = false)
+    @Column(name = "test_type")
     private Integer testType;
     
     /**
      * 发布状态 ，是否已发布
      */
-    @Column(name = "published",length = 1,nullable = false)
+    @Column(name = "published",length = 1)
     private Boolean published;
     /**
      * 发布时间
@@ -154,7 +154,7 @@ public class ExamTest extends BaseEntity {
     /**
      * 范围，1表独立使用，2表课程内部
      * */
-    @Column(name = "range_type",nullable = false)
+    @Column(name = "range_type")
     private Integer rangeType;
 
     /**
@@ -178,5 +178,4 @@ public class ExamTest extends BaseEntity {
     
     @Transient
     private String paperName;
-
 }

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyCourseApi.java

@@ -11,6 +11,7 @@ import com.xboe.api.vo.*;
 import com.xboe.module.course.vo.TeacherVo;
 import com.xboe.module.usergroup.entity.UserGroupItem;
 import com.xboe.module.usergroup.service.IUserGroupService;
+import com.xboe.school.study.dao.StudyCourseDao;
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -65,7 +66,9 @@ import javax.servlet.http.HttpServletRequest;
 @RestController
 @RequestMapping(value="/xboe/school/study/course")
 public class StudyCourseApi extends ApiBaseController{
-	
+
+
+
 	@Autowired
 	IStudyCourseService service;
 	
@@ -321,8 +324,19 @@ public class StudyCourseApi extends ApiBaseController{
 		if (StringUtils.isEmpty(token)) {
 			token = request.getHeader("token");
 		}
+
+
 		//检查是否已存在
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
+
+		// 20240815 特训营结营考试 临时代码
+//		if(item != null && redisTemplate.opsForValue().get(item.getId())==null){
+//			redisTemplate.opsForValue().set(item.getId(),item.getId());
+//			//设置过期时间为1天
+//			redisTemplate.expire(item.getId(), 60, TimeUnit.SECONDS);
+//		}else{
+//			return success("");
+//		}
 		if(item!=null) {
 			//如果记录存在，但是进度不100无成情况，就更新进度，一期不会有这种情况
 			if(item.getProgress()<100 && sci.getProgress()>item.getProgress()) {
@@ -407,6 +421,14 @@ public class StudyCourseApi extends ApiBaseController{
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
 		if(item!=null) {
 			//如果记录存在，但是进度不到100，未完成情况，就更新进度，一期不会有这种情况
+			// 20240815 特训营结营考试 临时代码
+//			if(item != null && redisTemplate.opsForValue().get(item.getId())==null){
+//				redisTemplate.opsForValue().set(item.getId(),item.getId());
+//				//设置过期时间为1天
+//				redisTemplate.expire(item.getId(), 60, TimeUnit.SECONDS);
+//			}else{
+//				return success("");
+//			}
 			if(item.getProgress()<100) {
 				studyService.updateProcess(item.getId(),sci.getStudyId(),sci.getCourseId(), sci.getContentTotal(),100,token);
 			}
@@ -512,6 +534,14 @@ public class StudyCourseApi extends ApiBaseController{
 			token = request.getHeader("token");
 		}
 		try {
+			// 20240815 特训营结营考试 临时代码
+//			if(itemId != null && redisTemplate.opsForValue().get(itemId)==null){
+//				redisTemplate.opsForValue().set(itemId,itemId);
+//				//设置过期时间为1天
+//				redisTemplate.expire(itemId, 60, TimeUnit.SECONDS);
+//			}else{
+//				return success(true);
+//			}
 			studyService.finishVideoStudyItem(itemId, studyId,courseId,cnum,token);
 			List<StudyCourse> allUserList = thirdApi.getStudyCourseList(studyId ,courseId, token);
 			log.info("在线课学习记录"+allUserList);
@@ -529,7 +559,7 @@ public class StudyCourseApi extends ApiBaseController{
 	 * @return
 	 */
 	@PostMapping("/study-video-time")
-	public JsonResponse<Boolean> study(String studyId,String itemId,Integer videoTime){
+	public JsonResponse<Boolean> study(String itemId,Integer videoTime,String contentId , String courseId,Float progressVideo){
 		
 		if(StringUtils.isBlank(itemId)){
 			return error("参数错误");
@@ -539,7 +569,10 @@ public class StudyCourseApi extends ApiBaseController{
 		}
 		//检查是否已存在
 		try {
-			studyService.updateLastTime(itemId,videoTime,getCurrent().getAccountId());
+			studyService.updateLastTime(itemId,videoTime, getCurrent().getAccountId());
+			if (contentId != null && courseId != null && progressVideo != null){
+				contentService.updateProcessVideo(contentId, courseId, progressVideo);
+			}
 			return success(true);
 		}catch(Exception e) {
 			log.error("记录最后学习时间错误",e);
@@ -690,9 +723,10 @@ public class StudyCourseApi extends ApiBaseController{
 			return error("查询失败",e.getMessage());
 		}
 	}
+
 	
 	@RequestMapping(value="/study-course-content",method = {RequestMethod.GET,RequestMethod.POST})
-	public JsonResponse<StudyCourseItem> findStudyCourseItem(String studyId,String contentId){
+	public JsonResponse<StudyCourseItem> findStudyCourseItem(String studyId,String contentId, HttpServletRequest request){
 		if(StringUtils.isBlank(studyId)){
 			return error("无学习信息");
 		}

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyExamApi.java

@@ -7,6 +7,7 @@ import java.util.Map;
 import java.util.concurrent.TimeUnit;
 
 import com.xboe.api.ThirdApi;
+import com.xboe.school.study.dao.StudyCourseDao;
 import com.xboe.school.study.entity.StudyCourse;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -32,6 +33,8 @@ import javax.servlet.http.HttpServletRequest;
 @RestController
 @RequestMapping(value="/xboe/school/study/exam")
 public class StudyExamApi extends ApiBaseController{
+	@Autowired
+	StudyCourseDao scDao;
 
 	@Autowired
 	IStudyExamService sexamService;

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyServiceImpl.java

@@ -98,8 +98,12 @@ public class StudyServiceImpl implements IStudyService{
 		//sci.setProgress(100);//直接设置为学习完成
 		sci.setLastTime(ldt);
 		scItemDao.saveOrUpdate(sci);
-		
-		dto.setStudyItemId(sci.getId());
+		if (sci.getId() != null){
+			dto.setStudyItemId(sci.getId());
+		}else {
+			log.info("学习记录插入失败"+sci.getId());
+			throw new IllegalArgumentException("学习记录插入失败");
+		}
 		//检查是否全部学习完成
 		scDao.finishCheck(dto.getStudyId(),dto.getCourseId(),dto.getContentTotal(),token);
 		
@@ -180,17 +184,15 @@ public class StudyServiceImpl implements IStudyService{
 			query.addFilter(FieldFilters.eq("courseId",courseId));
 		}
 		if(StringUtils.isNotBlank(name)) {
-			query.addFilter(FieldFilters.like("aname", name));
+			query.addFilter(FieldFilters.eq("aname", name));
 		}
-		int pageIndex2 = pageIndex-1;
+		int pageIndex2 = (pageIndex-1)*10;
 		if(status!=null) {
 			if(status==3) {
 				query.addFilter(FieldFilters.eq("status", 2));
-				query.addFilter(FieldFilters.like("aname", name));
 				return scItemDao.findPage(query.builder());
 			}else if(status==2){
 				query.addFilter(FieldFilters.eq("status",9));
-				query.addFilter(FieldFilters.like("aname", name));
 				return scItemDao.findPage(query.builder());
 			}else if (status == 1) {
 				String sql = "select bsc.id,bsc.course_id,bsc.course_name,bsc.aname,item.content_id,0 as progress,1 as status from boe_study_course bsc " +