[UPDATE] 解決弱點Cleartext sensitive data in a database

jack

2023-09-18 aef49f6faffbd93350f322db5fad339e2867656b

 pamapi/src/main/java/com/pollex/pam/web/rest/ConsultantResource.java

@@ -1,27 +1,23 @@
package com.pollex.pam.web.rest;

import com.pollex.pam.domain.Appointment;
import com.pollex.pam.domain.Consultant;
import com.pollex.pam.security.SecurityUtils;
import com.pollex.pam.service.AppointmentService;
import com.pollex.pam.service.ConsultantService;
import com.pollex.pam.service.dto.*;
import com.pollex.pam.business.aop.logging.audit.AuditLoggingInject;
import com.pollex.pam.business.domain.Consultant;
import com.pollex.pam.business.security.SecurityUtils;
import com.pollex.pam.business.service.AppointmentService;
import com.pollex.pam.business.service.ConsultantService;
import com.pollex.pam.business.service.dto.*;
import org.apache.commons.compress.utils.IOUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.List;

import static com.pollex.pam.business.aop.logging.audit.AuditLoggingType.EDIT_CONSULTANT_DATA;

@RestController
@RequestMapping("/api/consultant")
@@ -36,12 +32,6 @@
    @GetMapping("/favorite")
    public ResponseEntity<List<CustomerFavoriteConsultantDTO>> getMyConsultantList() {
        List<CustomerFavoriteConsultantDTO> myConsultants = consultantService.getMyConsultantList();
        return new ResponseEntity<>(myConsultants, HttpStatus.OK);
    }

    @GetMapping("/all")
    public ResponseEntity<List<ConsultantDTO>> getAllConsultantList() {
        List<ConsultantDTO> myConsultants = consultantService.getAllConsultantList();
        return new ResponseEntity<>(myConsultants, HttpStatus.OK);
    }

@@ -69,13 +59,13 @@
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @Deprecated

    @PostMapping("/strictQuery")
    public ResponseEntity<List<ConsultantDTO>> strictQueryConsultant(@RequestBody StrictQueryConsultantParam param) {
        List<ConsultantDTO> queryResult = consultantService.strictQueryConsultant(param);
        return new ResponseEntity<>(queryResult, HttpStatus.OK);
    }
    @Deprecated

    @PostMapping("/fastQuery")
    public ResponseEntity<List<ConsultantDTO>> fastQueryConsultant(@RequestBody FastQueryConsultantParam param) {
        List<ConsultantDTO> queryResult = consultantService.fastQueryConsultant(param);
@@ -118,6 +108,7 @@
        return ResponseEntity.noContent().build();
    }

    @AuditLoggingInject(type = EDIT_CONSULTANT_DATA)
    @PostMapping("/edit")
    public ResponseEntity<Consultant> editConsultant(@RequestBody ConsultantEditDTO editDTO) {
       if(!editDTO.getAgentNo().equals(SecurityUtils.getAgentNo())) {
@@ -125,15 +116,5 @@
       }
       Consultant editResult = consultantService.editConsultant(editDTO);
        return new ResponseEntity<>(editResult, HttpStatus.OK);
    }

    @PostMapping("/sendSatisfactionToClient/{appointmentId}")
    public ResponseEntity<Void> sendSatisfactionToClient(@PathVariable Long appointmentId) {
       Appointment appointment = appointmentService.findById(appointmentId);
       if(!appointment.getAgentNo().equals(SecurityUtils.getAgentNo())) {
          throw new IllegalAccessError();
       }
       consultantService.sendSatisfactionToClient(appointment);
       return ResponseEntity.noContent().build();
    }
}