安全漏洞修复，获取短信和登录都要图形验证码

server/svr-authentication/src/main/java/com/yihu/jw/security/oauth2/provider/endpoint/WlyyIotLoginEndpoint.java

@@ -3,6 +3,7 @@ package com.yihu.jw.security.oauth2.provider.endpoint;
import com.alibaba.fastjson.JSONObject;
import com.yihu.jw.patient.util.ConstantUtils;
import com.yihu.jw.restmodel.ResultStatus;
import com.yihu.jw.security.exception.ImgCaptchaException;
import com.yihu.jw.security.model.Captcha;
import com.yihu.jw.security.model.Oauth2Envelop;
import com.yihu.jw.security.oauth2.core.redis.WlyyRedisVerifyCodeService;
@@ -13,6 +14,7 @@ import io.swagger.annotations.ApiOperation;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
@@ -47,6 +49,8 @@ public class WlyyIotLoginEndpoint {
    private IotSMSService iotSMSService;
    @Autowired
    private UserService userService;
    @Autowired
    private StringRedisTemplate redisTemplate;
    @RequestMapping(value = "/oauth/sendIotCaptcha", method = RequestMethod.GET)
    @ApiOperation("发送短信验证码")
@@ -59,6 +63,15 @@ public class WlyyIotLoginEndpoint {
        if (StringUtils.isEmpty(mobile)) {
            throw new InvalidRequestException("username");
        }
        //图形验证码验证
        String key = parameters.get("key");
        String text = parameters.get("text");
        if(!verifyCaptcha(key,text)){
            throw new ImgCaptchaException("验证码错误！");
        }
        //验证请求间隔超时，防止频繁获取验证码
        if (!wlyyRedisVerifyCodeService.isIntervalTimeout(client_id, mobile)) {
            throw new IllegalAccessException("SMS request frequency is too fast");
@@ -82,6 +95,16 @@ public class WlyyIotLoginEndpoint {
        throw new IllegalStateException("验证码发送失败！result:"+ result);
    }
    public boolean verifyCaptcha(String key,String text){
        boolean pass = false;
        String captcha = redisTemplate.opsForValue().get(key);
        if (org.apache.commons.lang3.StringUtils.isNotBlank(captcha)&& captcha.equals(text.toLowerCase())){
            pass = true;
            redisTemplate.delete(key);
        }
        return pass;
    }
    @RequestMapping(value = "/oauth/captchaAndRegister", method = RequestMethod.POST)
    @ApiOperation("验证短信验证码并注册")
    public ResponseEntity<Oauth2Envelop> captchaCheck(@RequestParam Map<String, String> parameters) throws Exception {
@@ -98,6 +121,15 @@ public class WlyyIotLoginEndpoint {
        if (StringUtils.isEmpty(captcha)) {
            throw new InvalidRequestException("captcha");
        }
        //图形验证码验证
        String key = parameters.get("key");
        String text = parameters.get("text");
        if(!verifyCaptcha(key,text)){
            throw new ImgCaptchaException("验证码错误！");
        }
        Oauth2Envelop<Boolean> oauth2Envelop;
        //判断当前手机号是否注册过
        Boolean b = userService.isRegisterUserName(mobile);