中危.4.API误用:不安全的框架绑定,缺陷32

whycxzp

2023-10-27 ab28b2ba992f95aa5461de48c1c94f70bd358ae6

 src/main/java/com/whyc/controller/UserController.java

@@ -135,11 +135,12 @@
    public Response checkUserPasswordOfREA(@RequestParam String pwd){
        UserInf userInf = ActionUtil.getUser();
        String passwordEncrypt = null;
        try {
        /*try {
            passwordEncrypt = URLDecoder.decode(pwd, "utf-8");
        }catch (UnsupportedEncodingException e){
            e.printStackTrace();
        }
        }*/
        passwordEncrypt = pwd;
        String password = RSAUtil.decryptFront(passwordEncrypt, RSAUtil.fontSeparator)[0];
        String passwordDB = RSAUtil.decrypt(userInf.getUpassword(),RSAUtil.getPrivateKey());
        if(passwordDB.equals(password)){
@@ -235,6 +236,10 @@
        return new Response().set(1,list);
    }


    @ApiOperation(value = "伪单点登录",notes = "返回的data为布尔值,是否登录成功;data2:用户所在的权限组id;data3为用户对象,内含属性uid,uname,urole")
    @GetMapping("loginByUId")
    public Response searchSnIdByUId(@RequestParam int uId){
        return userService.loginByUId(uId);
    }

}