[UPDATE] 解決弱點Cleartext sensitive data in a database

jack

2023-09-18 aef49f6faffbd93350f322db5fad339e2867656b

 pamapi/src/main/java/com/pollex/pam/security/provider/OtpAuthenticationProvider.java

@@ -1,22 +1,20 @@
package com.pollex.pam.security.provider;

import com.pollex.pam.business.web.errors.CustomerNotRegisteredException;
import com.pollex.pam.security.token.OtpAuthenticationToken;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.stereotype.Component;

import com.pollex.pam.domain.Customer;
import com.pollex.pam.domain.OtpTmp;
import com.pollex.pam.enums.OtpTmpStatusEnum;
import com.pollex.pam.repository.CustomerRepository;
import com.pollex.pam.security.token.OtpAuthenticationToken;
import com.pollex.pam.business.domain.Customer;
import com.pollex.pam.business.repository.CustomerRepository;
import com.pollex.pam.service.CustomerAuthService;
import com.pollex.pam.service.OtpTmpService;
import com.pollex.pam.business.service.OtpTmpService;
import com.pollex.pam.service.OtpUtilService;
import com.pollex.pam.web.rest.vm.OtpAccount;
import com.pollex.pam.business.web.vm.OtpAccount;

@Component
public class OtpAuthenticationProvider {
@@ -25,13 +23,13 @@

    @Autowired
    CustomerAuthService customerAuthService;
    

    @Autowired
    CustomerRepository customerRepository;
    

    @Autowired
    OtpTmpService otpTmpService;
    

    @Autowired
    OtpUtilService otpUtilService;

@@ -41,26 +39,15 @@
        String indexKey = otpAccount.getIndexKey();
        String otpCode = otpAuthenticationToken.getCredentials();

        otpUtilService.verifyOtp(indexKey, otpCode);
        
       setVerrifiedOtpTmp(account, indexKey);
    	
        otpUtilService.verifyOtp(account, indexKey, otpCode);
       Customer customer = customerRepository.findOneByEmailEqualsOrPhoneEquals(account)
                      .orElse(null);
    	

       if (customer == null) {
          throw new AuthenticationCredentialsNotFoundException("");
          throw new CustomerNotRegisteredException();
       }
    	

       return customerAuthService.buildCustomerAuthToken(customer, otpCode, indexKey);

    }

    private void setVerrifiedOtpTmp(String account, String indexKey) {
       OtpTmp otpTmp = otpTmpService.findByAccountAndIndexKey(account, indexKey);
       otpTmp.setStatus(OtpTmpStatusEnum.VERRIFIED);
       otpTmpService.save(otpTmp);
   }

		
}