居民端预约接口验证码漏洞修复

patient-co/patient-co-wlyy/src/main/java/com/yihu/wlyy/web/third/zysoft/BookingController.java

@@ -33,11 +33,9 @@ import org.json.JSONObject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.*;
import java.util.*;
@@ -79,6 +77,9 @@ public class BookingController extends WeixinBaseController {
    private PushMsgTask pushMsgTask;
    @Autowired
    private WechatTemplateConfigDao templateConfigDao;
    
    @Autowired
    private StringRedisTemplate redisTemplate;
    /**
@@ -309,7 +310,38 @@ public class BookingController extends WeixinBaseController {
                              @ApiParam(name = "clinicCard", value = "市民卡号", defaultValue = "D57117706")
                              @RequestParam(value = "clinicCard", required = true) String clinicCard,
                              @ApiParam(name = "patientPhone", value = "患者手机", defaultValue = "13950116510")
                              @RequestParam(value = "patientPhone", required = true) String patientPhone) {
                              @RequestParam(value = "patientPhone", required = true) String patientPhone,
                              @ApiParam(name = "key", value = "验证码key")
                              @RequestParam(value = "key", required = true) String key,
                              @ApiParam(name = "openId", value = "openId")
                              @RequestParam(value = "openId", required = true) String openId,
                              @ApiParam(name = "text", value = "text")
                              @RequestParam(value = "text", required = true) String text
        ) {
    
        try{
            boolean pass = false;
            key = key.replaceFirst(":",":"+openId+"_");
        
            String captcha = redisTemplate.opsForValue().get(key);
            if (captcha != null && captcha.equals(text.toLowerCase())){
                pass = true;
                redisTemplate.delete(key);
            }
            
            if(!pass){
                return error(-1, "验证码校验失败");
            }
//            else{
//                return write(200, "ok", "pass", pass);
//            }
        
            
        } catch (Exception e){
            error(e);
            return error(-1, e.getMessage());
        }
        
        try {
            if (StringUtils.isEmpty(patientName)) {
                return error(-1, "未设置姓名！");