审计漏洞

servers/boe-server-all/pom.xml

@@ -84,6 +84,7 @@
 			<artifactId>xboe-module-es</artifactId>
 			<version>1.0.0</version>
 		</dependency>
+
 		<dependency>
 			<groupId>it.sauronsoftware</groupId>
 			<artifactId>jave</artifactId>
@@ -124,7 +125,9 @@
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
+			<version>2.7.18</version>
 		</dependency>
+
 		<dependency>
 			<groupId>org.springframework.session</groupId>
 			<artifactId>spring-session-data-redis</artifactId>

servers/boe-server-all/src/main/java/com/xboe/constants/CacheName.java

@@ -133,6 +133,4 @@ public interface CacheName {
      * 字典缓存key
      * */
     String KEY_DICT="dict";
-
-    String STUDY_KEY = "StudyKey:";
 }

servers/boe-server-all/src/main/java/com/xboe/school/study/api/StudyCourseApi.java

@@ -3,12 +3,15 @@ package com.xboe.school.study.api;
 import java.time.LocalDateTime;
 import java.util.*;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
 
-import com.alibaba.nacos.shaded.com.google.common.util.concurrent.RateLimiter;
+import cn.hutool.core.util.ArrayUtil;
 import com.xboe.api.ThirdApi;
-import com.xboe.constants.CacheName;
+import com.xboe.api.vo.*;
 import com.xboe.module.course.vo.TeacherVo;
+import com.xboe.module.usergroup.entity.UserGroupItem;
 import com.xboe.module.usergroup.service.IUserGroupService;
+import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.redis.core.StringRedisTemplate;
@@ -92,6 +95,7 @@ public class StudyCourseApi extends ApiBaseController{
 
 	@Autowired
 	StringRedisTemplate redisTemplate;
+
 	/**
 	 * 用于查询课程的学习记录
 	 * @param pager
@@ -283,7 +287,11 @@ public class StudyCourseApi extends ApiBaseController{
 	}
 
 	
-
+	/**
+	 * 记录学习信息，在学习每个资源时都要记录.前端用户打开课程资源按规则调用带着课程及学习信息调用此接口。
+	 * @param
+	 * @return 返回学习条目的id
+	 */
 	@PostMapping("/study")
 	public JsonResponse<String> study(@RequestBody StudyContentDto sci, HttpServletRequest request){
 		
@@ -313,32 +321,18 @@ public class StudyCourseApi extends ApiBaseController{
 		if (StringUtils.isEmpty(token)) {
 			token = request.getHeader("token");
 		}
+		//检查是否已存在
 		StudyCourseItem item = studyService.checkHas(sci.getStudyId(),sci.getContentId());
 		if(item!=null) {
-			String studyKey = CacheName.NAME_AUTH + ":" + CacheName.STUDY_KEY + item.getCourseId()+":"+cuser.getAccountId()+":"+item.getContentId();
+			//如果记录存在，但是进度不100无成情况，就更新进度，一期不会有这种情况
-			String studyKey2 = CacheName.NAME_AUTH + ":" + CacheName.STUDY_KEY + sci.getCourseId()+":"+cuser.getAccountId()+":"+sci.getContentId();
+			if(item.getProgress()<100 && sci.getProgress()>item.getProgress()) {
-			redisTemplate.opsForValue().set(studyKey,
-					String.valueOf(item.getProgress()), 2, TimeUnit.HOURS);
-			String progressStr = redisTemplate.opsForValue().get(studyKey2);
-			if (progressStr != null && !progressStr.isEmpty()) {
-				// 尝试将 Redis 中的字符串转换为整数
-				int redisProgress = Integer.parseInt(progressStr);
-				// 假设 item.getProgress() 返回的是 int 类型
-				int sciProgress = sci.getProgress();
-
-				if (redisProgress < sciProgress && redisProgress < 100) {
-					// 执行一些操作
-//					if(item.getProgress()<100 && sci.getProgress()>item.getProgress()) {
-//					}
 				studyService.updateProcess(item.getId(), sci.getStudyId(), sci.getCourseId(), sci.getContentTotal(), sci.getProgress(),token);
 			}
-			}
 			//追加学习时长
 			studyService.appendStudyDuration(sci.getStudyId(),item.getId(),sci.getContentId(),sci.getDuration());
 			List<StudyCourse> allUserList = thirdApi.getStudyCourseList(sci.getStudyId() ,sci.getCourseId(), token);
 			log.info("在线课学习记录"+allUserList);
 			return success(item.getId());
-			//如果记录存在，但是进度不100无成情况，就更新进度，一期不会有这种情况
 		}
 		
 		if(StringUtils.isBlank(sci.getCourseId())){

servers/boe-server-all/src/main/java/com/xboe/school/study/service/impl/StudyServiceImpl.java

@@ -98,12 +98,8 @@ public class StudyServiceImpl implements IStudyService{
 		//sci.setProgress(100);//直接设置为学习完成
 		sci.setLastTime(ldt);
 		scItemDao.saveOrUpdate(sci);
-		if (sci.getId() != null){
+		
 		dto.setStudyItemId(sci.getId());
-		}else {
-			log.info("学习记录插入失败"+sci.getId());
-			throw new IllegalArgumentException("学习记录插入失败");
-		}
 		//检查是否全部学习完成
 		scDao.finishCheck(dto.getStudyId(),dto.getCourseId(),dto.getContentTotal(),token);