漏洞修复-[中危] 密码使用MD5哈希

fs-admin/src/main/java/com/fs/his/controller/FsDoctorController.java

@@ -5,7 +5,7 @@ import java.util.List;
 
 import com.fs.common.utils.DateUtils;
 import com.fs.common.utils.SecurityUtils;
-import com.fs.common.utils.sign.Md5Utils;
+import com.fs.common.utils.PasswordUtils;
 import com.fs.his.domain.FsDoctorPatient;
 import com.fs.his.param.*;
 import com.fs.his.service.IFsDoctorPatientService;
@@ -113,7 +113,7 @@ public class FsDoctorController extends BaseController
     public AjaxResult add(@RequestBody FsDoctor fsDoctor)
     {
 
-        fsDoctor.setPassword(Md5Utils.hash(fsDoctor.getPassword()));
+        fsDoctor.setPassword(PasswordUtils.encode(fsDoctor.getPassword()));
         fsDoctor.setCreateBy(SecurityUtils.getUsername());
         fsDoctor.setIsAudit(0);
         fsDoctor.setPriceJson("[{\"price\":1.00,\"type\":1},{\"price\":1.00,\"type\":2}]");
@@ -271,7 +271,7 @@ public class FsDoctorController extends BaseController
     {
         FsDoctor doc = new FsDoctor();
         doc.setDoctorId(fsDoctor.getDoctorId());
-        doc.setPassword(Md5Utils.hash(fsDoctor.getPassword()));
+        doc.setPassword(PasswordUtils.encode(fsDoctor.getPassword()));
         return toAjax(fsDoctorService.updateFsDoctor(doc));
     }
 

fs-doctor-app/src/main/java/com/fs/app/controller/DoctorController.java

@@ -10,7 +10,7 @@ import com.fs.app.param.DoctorLoginParam;
 import com.fs.common.constant.Constants;
 import com.fs.common.core.domain.R;
 import com.fs.common.core.redis.RedisCache;
-import com.fs.common.utils.sign.Md5Utils;
+import com.fs.common.utils.PasswordUtils;
 import com.fs.his.domain.*;
 import com.fs.his.dto.FsExtractDTO;
 import com.fs.his.enums.FsExtractTypeEnum;
@@ -93,9 +93,15 @@ public class DoctorController extends  AppBaseController {
             if(!doctor.getDoctorType().equals(param.getType())){
                 return R.error("非法操作");
             }
-            if(!Md5Utils.hash(param.getPassword()).equals(doctor.getPassword())){
+            if(!PasswordUtils.matches(param.getPassword(), doctor.getPassword())){
                 return R.error("密码不正确");
             }
+            if (PasswordUtils.isLegacy(doctor.getPassword())) {
+                FsDoctor upgrade = new FsDoctor();
+                upgrade.setDoctorId(doctor.getDoctorId());
+                upgrade.setPassword(PasswordUtils.encode(param.getPassword()));
+                doctorService.updateFsDoctor(upgrade);
+            }
             String token = jwtUtils.generateToken(doctor.getDoctorId());
             redisCache.setCacheObject("doctorToken:"+doctor.getDoctorId(),token,604800, TimeUnit.SECONDS);
             Map<String,Object> map=new HashMap<>();
@@ -197,9 +203,15 @@ public class DoctorController extends  AppBaseController {
             if(!doctor.getDoctorType().equals(param.getType())){
                 return R.error("非法操作");
             }
-            if(!Md5Utils.hash(param.getPassword()).equals(doctor.getPassword())){
+            if(!PasswordUtils.matches(param.getPassword(), doctor.getPassword())){
                 return R.error("密码不正确");
             }
+            if (PasswordUtils.isLegacy(doctor.getPassword())) {
+                FsDoctor upgrade = new FsDoctor();
+                upgrade.setDoctorId(doctor.getDoctorId());
+                upgrade.setPassword(PasswordUtils.encode(param.getPassword()));
+                doctorService.updateFsDoctor(upgrade);
+            }
             boolean captchaOnOff = configService.selectCaptchaOnOff();
             // 验证码开关
             if (captchaOnOff)
@@ -307,12 +319,12 @@ public class DoctorController extends  AppBaseController {
     @PostMapping("/editPwd")
     public R editPwd(@Validated @RequestBody DoctorEditPwdParam param, HttpServletRequest request){
         FsDoctor doctor=doctorService.selectFsDoctorByDoctorId(Long.parseLong(getDoctorId()));
-        if(!Md5Utils.hash(param.getOldPassword()).equals(doctor.getPassword())){
+        if(!PasswordUtils.matches(param.getOldPassword(), doctor.getPassword())){
             return R.error("旧密码不正确");
         }
         FsDoctor map=new FsDoctor();
         map.setDoctorId(Long.parseLong(getDoctorId()));
-        map.setPassword(Md5Utils.hash(param.getNewPassword()));
+        map.setPassword(PasswordUtils.encode(param.getNewPassword()));
         doctorService.updateFsDoctor(map);
         return R.ok("修改成功");
     }

fs-user-app/src/main/java/com/fs/app/controller/AppLoginController.java

@@ -21,7 +21,7 @@ import com.fs.common.service.ISmsService;
 import com.fs.common.utils.ParseUtils;
 import com.fs.common.utils.ServletUtils;
 import com.fs.common.utils.ip.IpUtils;
-import com.fs.common.utils.sign.Md5Utils;
+import com.fs.common.utils.PasswordUtils;
 import com.fs.core.config.WxOpenProperties;
 import com.fs.his.config.FsSysConfig;
 import com.fs.his.domain.FsUser;
@@ -118,7 +118,7 @@ public class AppLoginController extends AppBaseController{
         if (fsUser != null) {
             // 更新已有用户的密码
             user.setUserId(fsUser.getUserId());
-            user.setPassword(Md5Utils.hash(param.getPassword()));
+            user.setPassword(PasswordUtils.encode(param.getPassword()));
             user.setUpdateTime(new DateTime());
             userService.updateFsUser(user);
             return R.ok("注册成功");
@@ -128,7 +128,7 @@ public class AppLoginController extends AppBaseController{
             user.setNickName("app用户" + param.getPhone().substring(param.getPhone().length() - 4));
             user.setStatus(1);
             user.setAvatar("https://cos.his.cdwjyyh.com/fs/20240926/420728ee06e54575ba82665dedb4756b.png");
-            user.setPassword(Md5Utils.hash(param.getPassword()));
+            user.setPassword(PasswordUtils.encode(param.getPassword()));
             user.setCreateTime(new Date());
 
             if (userService.insertFsUser(user) > 0) {
@@ -228,7 +228,7 @@ public class AppLoginController extends AppBaseController{
         user.setNickName("app用户" + phone.substring(phone.length() - 4));
         user.setStatus(1);
         user.setAvatar("https://cos.his.cdwjyyh.com/fs/20240926/420728ee06e54575ba82665dedb4756b.png");
-        user.setPassword(Md5Utils.hash(password));
+        user.setPassword(PasswordUtils.encode(password));
         user.setCreateTime(new Date());
         if (userService.insertFsUser(user) > 0) {
             return R.ok("注册成功");
@@ -257,7 +257,7 @@ public class AppLoginController extends AppBaseController{
         }
         FsUser userMap=new FsUser();
         userMap.setUserId(user.getUserId());
-        userMap.setPassword(Md5Utils.hash(param.getPassword()));
+        userMap.setPassword(PasswordUtils.encode(param.getPassword()));
         if (userService.updateFsUser(userMap)>0){
             return R.ok("新密码设置成功");
         }
@@ -386,7 +386,7 @@ public class AppLoginController extends AppBaseController{
         newUser.setHistoryApp("app");
         newUser.setAppleKey(param.getAppleKey());
         newUser.setPhone(param.getPhone());
-        newUser.setPassword(Md5Utils.hash(param.getPassword()));
+        newUser.setPassword(PasswordUtils.encode(param.getPassword()));
         newUser.setNickName("苹果用户" + param.getPhone().substring(param.getPhone().length() - 4));
         newUser.setCreateTime(new Date());
         newUser.setStatus(1);
@@ -411,7 +411,7 @@ public class AppLoginController extends AppBaseController{
             if (StringUtils.isNotEmpty(userMap.getAppleKey()) && !param.getAppleKey().equals(userMap.getAppleKey())) {
                 return R.error("该手机号已绑定其他账号");
             }
-            if (param.getSimExist() == 0 && !Md5Utils.hash(param.getPassword()).equals(userMap.getPassword())) {
+            if (param.getSimExist() == 0 && !PasswordUtils.matches(param.getPassword(), userMap.getPassword())) {
                 return R.error("密码不正确");
             }
         } else {
@@ -493,7 +493,7 @@ public class AppLoginController extends AppBaseController{
         if (!redisCode.equals(code)) {
             return R.error("验证码错误");
         }
-        String password = Md5Utils.hash(newPassword);
+        String password = PasswordUtils.encode(newPassword);
         return userService.updatePasswordByPhone(password,encryptPhone);
     }
 
@@ -608,9 +608,15 @@ public class AppLoginController extends AppBaseController{
             updateExistingUserJpushId(user, param.getJpushId());
         }
 
-        if (!Md5Utils.hash(param.getPassword()).equals(user.getPassword())) {
+        if (!PasswordUtils.matches(param.getPassword(), user.getPassword())) {
             return R.error("密码不正确");
         }
+        if (PasswordUtils.isLegacy(user.getPassword())) {
+            FsUser upgrade = new FsUser();
+            upgrade.setUserId(user.getUserId());
+            upgrade.setPassword(PasswordUtils.encode(param.getPassword()));
+            userService.updateFsUser(upgrade);
+        }
 
         return generateTokenAndReturn(user);
 

fs-user-app/src/main/java/com/fs/app/controller/UserController.java

@@ -11,7 +11,7 @@ import com.fs.common.core.domain.R;
 import com.fs.common.core.page.TableDataInfo;
 import com.fs.common.exception.CustomException;
 import com.fs.common.utils.StringUtils;
-import com.fs.common.utils.sign.Md5Utils;
+import com.fs.common.utils.PasswordUtils;
 import com.fs.course.service.IFsUserCourseVideoService;
 import com.fs.his.domain.FsDoctor;
 import com.fs.his.domain.FsPackage;
@@ -229,7 +229,7 @@ public class UserController extends  AppBaseController {
         BeanUtils.copyProperties(param,doctor);
         doctor.setUserId(Long.parseLong(getUserId()));
         doctor.setIsAudit(0);
-        doctor.setPassword(Md5Utils.hash(param.getPassword()));
+        doctor.setPassword(PasswordUtils.encode(param.getPassword()));
         doctor.setStatus(0);
         doctor.setBalance(new BigDecimal(0));
         doctor.setPriceJson("[{\"price\":1.00,\"type\":1},{\"price\":1.00,\"type\":2}]");