|
|
@@ -1,312 +1,325 @@
|
|
|
-package com.runzhixing.filter;
|
|
|
-
|
|
|
-import java.io.BufferedInputStream;
|
|
|
-import java.io.BufferedReader;
|
|
|
-import java.io.FileInputStream;
|
|
|
-import java.io.IOException;
|
|
|
-import java.io.InputStream;
|
|
|
-import java.io.InputStreamReader;
|
|
|
-import java.util.Properties;
|
|
|
-
|
|
|
-import javax.servlet.Filter;
|
|
|
-import javax.servlet.FilterChain;
|
|
|
-import javax.servlet.FilterConfig;
|
|
|
-import javax.servlet.ServletException;
|
|
|
-import javax.servlet.ServletRequest;
|
|
|
-import javax.servlet.ServletResponse;
|
|
|
-import javax.servlet.http.HttpServletRequest;
|
|
|
-import javax.servlet.http.HttpServletResponse;
|
|
|
-import javax.servlet.http.HttpSession;
|
|
|
-
|
|
|
-import com.runzhixing.constant.Constant;
|
|
|
-import com.runzhixing.dao.QueryDao;
|
|
|
-import com.runzhixing.exception.BsException;
|
|
|
-import com.runzhixing.filter.XssHttpServletRequestWrapperNew;
|
|
|
-import com.runzhixing.tool.MySqlImportAndExport;
|
|
|
-import com.runzhixing.tool.PropertiesUtil;
|
|
|
-import com.runzhixing.tool.Tool;
|
|
|
-
|
|
|
-/**
|
|
|
- *
|
|
|
- * @author 判断是否登陆和编码
|
|
|
- *
|
|
|
- */
|
|
|
-public class MyFilter implements Filter {
|
|
|
- private FilterConfig config;
|
|
|
- public static String whitelist="";
|
|
|
- public static String specialUser="";
|
|
|
- public static String saveImgPath="";
|
|
|
-
|
|
|
- public static String baseUrl="";
|
|
|
- public static String redirectUri="";
|
|
|
- public static String ClientId="";
|
|
|
- public static String ClientSecret="";
|
|
|
- public static String man_prefix="";
|
|
|
-
|
|
|
- public static String info_publish="0";
|
|
|
- public void destroy() {
|
|
|
-
|
|
|
- }
|
|
|
-
|
|
|
- public void doFilter(ServletRequest request, ServletResponse response,
|
|
|
- FilterChain chain) throws IOException, ServletException {
|
|
|
- HttpServletRequest req = (HttpServletRequest) request;
|
|
|
- HttpServletResponse res = (HttpServletResponse) response;
|
|
|
- req.setCharacterEncoding("UTF-8");
|
|
|
- res.setContentType("text/html;charset=UTF-8");//编码
|
|
|
- res.setHeader( "Set-Cookie", "name=value; HttpOnly");
|
|
|
- res.addHeader("x-frame-options","SAMEORIGIN");
|
|
|
-
|
|
|
-
|
|
|
- res.setHeader("Access-Control-Allow-Origin","*");
|
|
|
- res.setHeader("Access-Control-Allow-Credentials", "true");
|
|
|
- res.setHeader("Access-Control-Allow-Methods", "GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH");
|
|
|
- res.setHeader("Access-Control-Max-Age", "3600");
|
|
|
- res.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
|
|
|
- String reqUri1 = req.getRequestURI();
|
|
|
- String contentType = req.getContentType();
|
|
|
- if(contentType != null&& contentType.contains("multipart/form-data") && !contentType.startsWith("multipart/form-data") ){
|
|
|
- res.getWriter().write("Reject!");
|
|
|
- return;
|
|
|
- }
|
|
|
- if(checkWhiteList(request.getServerName(),whitelist)){
|
|
|
- res.setHeader( "Set-Cookie", "name=value; HttpOnly");
|
|
|
- HttpSession session = req.getSession();
|
|
|
- String specialUser = (String)session.getAttribute("specialUser");
|
|
|
-
|
|
|
- String charset = config.getInitParameter("charset");
|
|
|
- String sessionTimeOut = config.getInitParameter("sessionTimeOut");
|
|
|
- if(sessionTimeOut==null){
|
|
|
- sessionTimeOut = "60";
|
|
|
- }
|
|
|
- String loginpaths = config.getInitParameter("Loginpaths");
|
|
|
- if(charset == null){
|
|
|
- charset = "UTF-8";
|
|
|
- }
|
|
|
- //设置请求编码UTF-8
|
|
|
- req.setCharacterEncoding(charset);
|
|
|
-
|
|
|
- if(reqUri1.contains("redirect:")||reqUri1.contains("action:")||reqUri1.contains("redirectAction:")
|
|
|
- ||
|
|
|
- reqUri1.contains("redirect%3A")||reqUri1.contains("action%3A")||reqUri1.contains("redirectAction%3A")){
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }
|
|
|
- String path = req.getContextPath();
|
|
|
- String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
|
|
|
-
|
|
|
- if(reqUri1.contains("jsp/fail/timeOut.jsp")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.contains("wx/")||reqUri1.contains("wxCert/")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.contains("CNG_LNG_REPORT.pdf")){
|
|
|
- res.setContentType("application/pdf;charset=UTF-8");//编码
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- String openid = (String)req.getSession().getAttribute("openid");
|
|
|
- if(reqUri1.contains("jsp/commonInput.jsp")||reqUri1.contains("ajax/getVCode")||reqUri1.contains("ajax/testVCode")
|
|
|
- ||reqUri1.equals("peoplePage.jsp")||reqUri1.contains("applyRegister.jsp")||reqUri1.contains("ajax/getCarCylinderInfo")
|
|
|
- ||reqUri1.contains("ajax/getRedirect")||reqUri1.contains("wxLogin")||reqUri1.contains("cngningxia")||reqUri1.contains("saveFiles.do")
|
|
|
- ||reqUri1.contains("ajax/updateNickName")||reqUri1.contains("ajax/insertWXID")||reqUri1.contains("ajax/getAppTypeInfo")||reqUri1.contains("ajax/getCityInfo")
|
|
|
- ||reqUri1.contains("ajax/getCountryInfo")||reqUri1.contains("ajax/getUnitInfo")||reqUri1.contains("ajax/getCarPlateColorInfo")||reqUri1.contains("ajax/getCarTypeInfo")
|
|
|
- ||reqUri1.contains("ajax/getCarInfo_1")||reqUri1.contains("ajax/CRUDCarInfo")||reqUri1.contains("ajax/getProductInfo")||reqUri1.contains("ajax/getInstallTypeInfo")
|
|
|
- ||reqUri1.contains("ajax/getInstallLocInfo")||reqUri1.contains("ajax/getRegister")
|
|
|
- ||reqUri1.contains("ajax/wx_Login")||reqUri1.contains("ajax/examineAll")||reqUri1.contains("applyRegister1.jsp")
|
|
|
- ){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- if(!Tool.isNullOrEmpty(openid)){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.contains("jsp/login/loginre.jsp")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- Constant.loginint=0;
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.equals("/cng/")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- Constant.loginint=0;
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- if(reqUri1.contains("jsp/login/login.jsp")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- Constant.loginint=0;
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- if(reqUri1.contains("downloadapp.html")||reqUri1.contains("useCert.html")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- if(reqUri1.contains("loginServlet.do")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- Constant.loginint=0;
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.contains("SylogReCylinderdataQuery.jsp")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.contains("SylogCylinderdataQuery.jsp")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
- if(reqUri1.contains("getcheckinfo2.do")||reqUri1.contains("getcheckinfo.do")||reqUri1.contains("appGetCylinderInfo.do")||reqUri1.contains("appgetkey.do")||reqUri1.contains("/appServlet")){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
- if(loginpaths!=null){
|
|
|
- String[] strArray = loginpaths.split(";");
|
|
|
-
|
|
|
-
|
|
|
- String username = (String)session.getAttribute(Constant.userName);
|
|
|
- username = Constant.storageSession;
|
|
|
- if(username != null&&!username.equals("")){//session未注销
|
|
|
- try {
|
|
|
- if(specialUser!=null&&!specialUser.trim().equals("")&&specialUser.equals("1")){
|
|
|
- String reqUri = req.getRequestURI();
|
|
|
- for (int i = 0; i < strArray.length; i++) {
|
|
|
- if(strArray[i]==null || "".equals(strArray[i]))continue;
|
|
|
- if(reqUri.indexOf(strArray[i]) !=-1 || reqUri.equals("/cng/")){
|
|
|
- try {
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- } catch (Exception e) {
|
|
|
- e.printStackTrace();
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(reqUri1.contains("modifiedDataQuery")
|
|
|
- ||reqUri1.contains("hiddenCity")
|
|
|
- ||reqUri1.contains("hiddenspeStation")
|
|
|
- ||reqUri1.contains("modifiedDataQuery")
|
|
|
- ||reqUri1.contains("machineDetail")
|
|
|
- ||reqUri1.contains("carsDataQueryagain")
|
|
|
- ||reqUri1.contains("CylinderFollow")
|
|
|
- ||reqUri1.contains("cylinderFollow")
|
|
|
- ){
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
- }else{
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
- } catch (Exception e) {
|
|
|
- if(e instanceof BsException){//如果是你定义的业务异常
|
|
|
- request.setAttribute("BsException", e);//存储业务异常信息类
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }else{
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- }else{//session已注销或者根本就没有登陆
|
|
|
- if(Constant.loginint==0){//没有登陆
|
|
|
- String reqUri = req.getRequestURI();
|
|
|
- for (int i = 0; i < strArray.length; i++) {
|
|
|
- if(strArray[i]==null || "".equals(strArray[i]))continue;
|
|
|
- if(reqUri.indexOf(strArray[i]) !=-1 || reqUri.equals("/cng/")){
|
|
|
- try {
|
|
|
- chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
- return;
|
|
|
- } catch (Exception e) {
|
|
|
- e.printStackTrace();
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- }
|
|
|
- }
|
|
|
- }else if(Constant.loginint==1){//已登陆但session已注销
|
|
|
- try {
|
|
|
- res.sendRedirect(basePath+"jsp/fail/timeOut.jsp?sessionTimeOut="+sessionTimeOut);
|
|
|
-// res.sendRedirect("jsp/fail/timeOut.jsp?sessionTimeOut="+sessionTimeOut);
|
|
|
- return;
|
|
|
- } catch (Exception e) {
|
|
|
- if(e instanceof BsException){//如果是你定义的业务异常
|
|
|
- request.setAttribute("BsException", e);//存储业务异常信息类
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }else{
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- }
|
|
|
- res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
- return;
|
|
|
- }
|
|
|
- }else{
|
|
|
- System.out.println("[host deny access tips]->"+request.getServerName());
|
|
|
- response.getWriter().print("host deny");
|
|
|
- response.flushBuffer();
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
- }
|
|
|
-
|
|
|
- public void init(FilterConfig filterConfig) throws ServletException {
|
|
|
- this.config = filterConfig;
|
|
|
- InputStream is = MySqlImportAndExport.class.getClassLoader().getResourceAsStream("com/runzhixing/config/config.properties");
|
|
|
-
|
|
|
- try {
|
|
|
- BufferedReader bf = new BufferedReader(new InputStreamReader(is,"UTF-8"));//解决读取properties文件中产生中文乱码的问题
|
|
|
- Properties properties = new Properties();
|
|
|
- properties.load(bf);
|
|
|
- whitelist= properties.getProperty("whitelist");
|
|
|
- specialUser = properties.getProperty("specialUser");
|
|
|
- String paramID="1";
|
|
|
- saveImgPath = new QueryDao().getImgPath(paramID);
|
|
|
-// saveImgPath ="C:\\tomcat\\Tomcat 8.5\\webapps\\cngningxia2";
|
|
|
- baseUrl=properties.getProperty("unified_login_baseUrl");
|
|
|
- redirectUri=properties.getProperty("unified_login_redirectUrl");
|
|
|
- ClientId=properties.getProperty("unified_login_clientId");
|
|
|
- ClientSecret=properties.getProperty("unified_login_clientSecret");
|
|
|
- man_prefix = properties.getProperty("man_prefix");
|
|
|
- info_publish = properties.getProperty("info_publish");
|
|
|
- } catch (IOException e) {
|
|
|
- e.printStackTrace();
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
- }
|
|
|
- private boolean checkWhiteList(String host,String whitelist){
|
|
|
- if(whitelist!=null&&!whitelist.trim().equals("")){
|
|
|
- String[] wlist = whitelist.split(";");
|
|
|
- if(wlist!=null&&wlist.length>0){
|
|
|
- for(int i=0;i<wlist.length;i++){
|
|
|
- if(wlist[i]!=null&&!wlist[i].equals("")&&host.contains(wlist[i])){
|
|
|
- return true;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- return false;
|
|
|
- }
|
|
|
-}
|
|
|
+package com.runzhixing.filter;
|
|
|
+
|
|
|
+import java.io.BufferedInputStream;
|
|
|
+import java.io.BufferedReader;
|
|
|
+import java.io.FileInputStream;
|
|
|
+import java.io.IOException;
|
|
|
+import java.io.InputStream;
|
|
|
+import java.io.InputStreamReader;
|
|
|
+import java.util.Properties;
|
|
|
+
|
|
|
+import javax.servlet.Filter;
|
|
|
+import javax.servlet.FilterChain;
|
|
|
+import javax.servlet.FilterConfig;
|
|
|
+import javax.servlet.ServletException;
|
|
|
+import javax.servlet.ServletRequest;
|
|
|
+import javax.servlet.ServletResponse;
|
|
|
+import javax.servlet.http.HttpServletRequest;
|
|
|
+import javax.servlet.http.HttpServletResponse;
|
|
|
+import javax.servlet.http.HttpSession;
|
|
|
+
|
|
|
+import com.runzhixing.constant.Constant;
|
|
|
+import com.runzhixing.dao.QueryDao;
|
|
|
+import com.runzhixing.exception.BsException;
|
|
|
+import com.runzhixing.filter.XssHttpServletRequestWrapperNew;
|
|
|
+import com.runzhixing.tool.MySqlImportAndExport;
|
|
|
+import com.runzhixing.tool.PropertiesUtil;
|
|
|
+import com.runzhixing.tool.Tool;
|
|
|
+
|
|
|
+/**
|
|
|
+ *
|
|
|
+ * @author 判断是否登陆和编码
|
|
|
+ *
|
|
|
+ */
|
|
|
+public class MyFilter implements Filter {
|
|
|
+ private FilterConfig config;
|
|
|
+ public static String whitelist="";
|
|
|
+ public static String specialUser="";
|
|
|
+ public static String saveImgPath="";
|
|
|
+
|
|
|
+ public static String statisticsPath="";
|
|
|
+
|
|
|
+ public static String baseUrl="";
|
|
|
+ public static String redirectUri="";
|
|
|
+ public static String ClientId="";
|
|
|
+ public static String ClientSecret="";
|
|
|
+
|
|
|
+ public static String baseUrl2="";
|
|
|
+ public static String redirectUri2="";
|
|
|
+ public static String ClientId2="";
|
|
|
+ public static String ClientSecret2="";
|
|
|
+ public static String man_prefix="";
|
|
|
+
|
|
|
+ public static String info_publish="0";
|
|
|
+ public void destroy() {
|
|
|
+
|
|
|
+ }
|
|
|
+
|
|
|
+ public void doFilter(ServletRequest request, ServletResponse response,
|
|
|
+ FilterChain chain) throws IOException, ServletException {
|
|
|
+ HttpServletRequest req = (HttpServletRequest) request;
|
|
|
+ HttpServletResponse res = (HttpServletResponse) response;
|
|
|
+ req.setCharacterEncoding("UTF-8");
|
|
|
+ res.setContentType("text/html;charset=UTF-8");//编码
|
|
|
+ res.setHeader( "Set-Cookie", "name=value; HttpOnly");
|
|
|
+ res.addHeader("x-frame-options","SAMEORIGIN");
|
|
|
+
|
|
|
+
|
|
|
+ res.setHeader("Access-Control-Allow-Origin","*");
|
|
|
+ res.setHeader("Access-Control-Allow-Credentials", "true");
|
|
|
+ res.setHeader("Access-Control-Allow-Methods", "GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH");
|
|
|
+ res.setHeader("Access-Control-Max-Age", "3600");
|
|
|
+ res.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
|
|
|
+ String reqUri1 = req.getRequestURI();
|
|
|
+ String contentType = req.getContentType();
|
|
|
+ if(contentType != null&& contentType.contains("multipart/form-data") && !contentType.startsWith("multipart/form-data") ){
|
|
|
+ res.getWriter().write("Reject!");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(checkWhiteList(request.getServerName(),whitelist)){
|
|
|
+ res.setHeader( "Set-Cookie", "name=value; HttpOnly");
|
|
|
+ HttpSession session = req.getSession();
|
|
|
+ String specialUser = (String)session.getAttribute("specialUser");
|
|
|
+
|
|
|
+ String charset = config.getInitParameter("charset");
|
|
|
+ String sessionTimeOut = config.getInitParameter("sessionTimeOut");
|
|
|
+ if(sessionTimeOut==null){
|
|
|
+ sessionTimeOut = "60";
|
|
|
+ }
|
|
|
+ String loginpaths = config.getInitParameter("Loginpaths");
|
|
|
+ if(charset == null){
|
|
|
+ charset = "UTF-8";
|
|
|
+ }
|
|
|
+ //设置请求编码UTF-8
|
|
|
+ req.setCharacterEncoding(charset);
|
|
|
+
|
|
|
+ if(reqUri1.contains("redirect:")||reqUri1.contains("action:")||reqUri1.contains("redirectAction:")
|
|
|
+ ||
|
|
|
+ reqUri1.contains("redirect%3A")||reqUri1.contains("action%3A")||reqUri1.contains("redirectAction%3A")){
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ String path = req.getContextPath();
|
|
|
+ String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
|
|
|
+
|
|
|
+ if(reqUri1.contains("jsp/fail/timeOut.jsp")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.contains("wx/")||reqUri1.contains("wxCert/")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.contains("CNG_LNG_REPORT.pdf")){
|
|
|
+ res.setContentType("application/pdf;charset=UTF-8");//编码
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ String openid = (String)req.getSession().getAttribute("openid");
|
|
|
+ if(reqUri1.contains("jsp/commonInput.jsp")||reqUri1.contains("ajax/getVCode")||reqUri1.contains("ajax/testVCode")
|
|
|
+ ||reqUri1.equals("peoplePage.jsp")||reqUri1.contains("applyRegister.jsp")||reqUri1.contains("ajax/getCarCylinderInfo")
|
|
|
+ ||reqUri1.contains("ajax/getRedirect")||reqUri1.contains("wxLogin")||reqUri1.contains("cngningxia")||reqUri1.contains("saveFiles.do")
|
|
|
+ ||reqUri1.contains("ajax/updateNickName")||reqUri1.contains("ajax/insertWXID")||reqUri1.contains("ajax/getAppTypeInfo")||reqUri1.contains("ajax/getCityInfo")
|
|
|
+ ||reqUri1.contains("ajax/getCountryInfo")||reqUri1.contains("ajax/getUnitInfo")||reqUri1.contains("ajax/getCarPlateColorInfo")||reqUri1.contains("ajax/getCarTypeInfo")
|
|
|
+ ||reqUri1.contains("ajax/getCarInfo_1")||reqUri1.contains("ajax/CRUDCarInfo")||reqUri1.contains("ajax/getProductInfo")||reqUri1.contains("ajax/getInstallTypeInfo")
|
|
|
+ ||reqUri1.contains("ajax/getInstallLocInfo")||reqUri1.contains("ajax/getRegister")
|
|
|
+ ||reqUri1.contains("ajax/wx_Login")||reqUri1.contains("ajax/examineAll")||reqUri1.contains("applyRegister1.jsp")
|
|
|
+ ){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(!Tool.isNullOrEmpty(openid)){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.contains("jsp/login/loginre.jsp")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ Constant.loginint=0;
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.equals("/cng/")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ Constant.loginint=0;
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ if(reqUri1.contains("jsp/login/login.jsp")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ Constant.loginint=0;
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ if(reqUri1.contains("downloadapp.html")||reqUri1.contains("useCert.html")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ if(reqUri1.contains("loginServlet.do")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ Constant.loginint=0;
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.contains("SylogReCylinderdataQuery.jsp")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.contains("SylogCylinderdataQuery.jsp")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if(reqUri1.contains("getcheckinfo2.do")||reqUri1.contains("getcheckinfo.do")||reqUri1.contains("appGetCylinderInfo.do")||reqUri1.contains("appgetkey.do")||reqUri1.contains("/appServlet")){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ if(loginpaths!=null){
|
|
|
+ String[] strArray = loginpaths.split(";");
|
|
|
+
|
|
|
+
|
|
|
+ String username = (String)session.getAttribute(Constant.userName);
|
|
|
+ username = Constant.storageSession;
|
|
|
+ if(username != null&&!username.equals("")){//session未注销
|
|
|
+ try {
|
|
|
+ if(specialUser!=null&&!specialUser.trim().equals("")&&specialUser.equals("1")){
|
|
|
+ String reqUri = req.getRequestURI();
|
|
|
+ for (int i = 0; i < strArray.length; i++) {
|
|
|
+ if(strArray[i]==null || "".equals(strArray[i]))continue;
|
|
|
+ if(reqUri.indexOf(strArray[i]) !=-1 || reqUri.equals("/cng/")){
|
|
|
+ try {
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ } catch (Exception e) {
|
|
|
+ e.printStackTrace();
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ if(reqUri1.contains("modifiedDataQuery")
|
|
|
+ ||reqUri1.contains("hiddenCity")
|
|
|
+ ||reqUri1.contains("hiddenspeStation")
|
|
|
+ ||reqUri1.contains("modifiedDataQuery")
|
|
|
+ ||reqUri1.contains("machineDetail")
|
|
|
+ ||reqUri1.contains("carsDataQueryagain")
|
|
|
+ ||reqUri1.contains("CylinderFollow")
|
|
|
+ ||reqUri1.contains("cylinderFollow")
|
|
|
+ ){
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ }else{
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ } catch (Exception e) {
|
|
|
+ if(e instanceof BsException){//如果是你定义的业务异常
|
|
|
+ request.setAttribute("BsException", e);//存储业务异常信息类
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }else{
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ }else{//session已注销或者根本就没有登陆
|
|
|
+ if(Constant.loginint==0){//没有登陆
|
|
|
+ String reqUri = req.getRequestURI();
|
|
|
+ for (int i = 0; i < strArray.length; i++) {
|
|
|
+ if(strArray[i]==null || "".equals(strArray[i]))continue;
|
|
|
+ if(reqUri.indexOf(strArray[i]) !=-1 || reqUri.equals("/cng/")){
|
|
|
+ try {
|
|
|
+ chain.doFilter(new XssHttpServletRequestWrapperNew((HttpServletRequest) request), res);
|
|
|
+ return;
|
|
|
+ } catch (Exception e) {
|
|
|
+ e.printStackTrace();
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }else if(Constant.loginint==1){//已登陆但session已注销
|
|
|
+ try {
|
|
|
+ res.sendRedirect(basePath+"jsp/fail/timeOut.jsp?sessionTimeOut="+sessionTimeOut);
|
|
|
+// res.sendRedirect("jsp/fail/timeOut.jsp?sessionTimeOut="+sessionTimeOut);
|
|
|
+ return;
|
|
|
+ } catch (Exception e) {
|
|
|
+ if(e instanceof BsException){//如果是你定义的业务异常
|
|
|
+ request.setAttribute("BsException", e);//存储业务异常信息类
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }else{
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ }
|
|
|
+ res.sendRedirect("jsp/login/loginre.jsp");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ }else{
|
|
|
+ System.out.println("[host deny access tips]->"+request.getServerName());
|
|
|
+ response.getWriter().print("host deny");
|
|
|
+ response.flushBuffer();
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ }
|
|
|
+
|
|
|
+ public void init(FilterConfig filterConfig) throws ServletException {
|
|
|
+ this.config = filterConfig;
|
|
|
+ InputStream is = MySqlImportAndExport.class.getClassLoader().getResourceAsStream("com/runzhixing/config/config.properties");
|
|
|
+
|
|
|
+ try {
|
|
|
+ BufferedReader bf = new BufferedReader(new InputStreamReader(is,"UTF-8"));//解决读取properties文件中产生中文乱码的问题
|
|
|
+ Properties properties = new Properties();
|
|
|
+ properties.load(bf);
|
|
|
+ whitelist= properties.getProperty("whitelist");
|
|
|
+ specialUser = properties.getProperty("specialUser");
|
|
|
+ String paramID="1";
|
|
|
+ saveImgPath = new QueryDao().getImgPath(paramID);
|
|
|
+ statisticsPath = properties.getProperty("statistics_path");
|
|
|
+// saveImgPath ="C:\\tomcat\\Tomcat 8.5\\webapps\\cngningxia2";
|
|
|
+ baseUrl=properties.getProperty("unified_login_baseUrl");
|
|
|
+ redirectUri=properties.getProperty("unified_login_redirectUrl");
|
|
|
+ ClientId=properties.getProperty("unified_login_clientId");
|
|
|
+ ClientSecret=properties.getProperty("unified_login_clientSecret");
|
|
|
+
|
|
|
+ baseUrl2=properties.getProperty("integration_login_baseUrl");
|
|
|
+ redirectUri2=properties.getProperty("integration_login_redirectUrl");
|
|
|
+ ClientId2=properties.getProperty("integration_login_clientId");
|
|
|
+ ClientSecret2=properties.getProperty("integration_login_clientSecret");
|
|
|
+ man_prefix = properties.getProperty("man_prefix");
|
|
|
+ info_publish = properties.getProperty("info_publish");
|
|
|
+ } catch (IOException e) {
|
|
|
+ e.printStackTrace();
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ }
|
|
|
+ private boolean checkWhiteList(String host,String whitelist){
|
|
|
+ if(whitelist!=null&&!whitelist.trim().equals("")){
|
|
|
+ String[] wlist = whitelist.split(";");
|
|
|
+ if(wlist!=null&&wlist.length>0){
|
|
|
+ for(int i=0;i<wlist.length;i++){
|
|
|
+ if(wlist[i]!=null&&!wlist[i].equals("")&&host.contains(wlist[i])){
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+}
|