漏洞修复-[高危] GET请求URL路径中携带手机号

fs-company/src/main/java/com/fs/company/controller/qw/QwAcquisitionAssistantController.java

@@ -10,6 +10,7 @@ import com.fs.framework.security.LoginUser;
 import com.fs.framework.service.TokenService;
 import com.fs.his.dto.SendResultDetailDTO;
 import com.fs.qw.bo.SendMsgLogBo;
+import com.fs.qw.dto.SendMessageLinkDTO;
 import com.fs.qw.domain.QwCompany;
 import com.fs.qw.domain.QwUser;
 import com.fs.qw.service.IQwCompanyService;
@@ -59,9 +60,11 @@ public class QwAcquisitionAssistantController extends BaseController {
     /**
      * 发送获客链接短信
      */
-    @GetMapping("/sendAcquisitionMessage/{id}/{phone}")
-    public AjaxResult sendAcquisitionMessage(@PathVariable Long id,@PathVariable String phone) {
+    @PostMapping("/sendAcquisitionMessage")
+    public AjaxResult sendAcquisitionMessage(@RequestBody SendMessageLinkDTO dto) {
         try {
+            Long id = dto.getId();
+            String phone = dto.getPhone();
             LoginUser loginUser = tokenService.getLoginUser(ServletUtils.getRequest());
             if (loginUser==null||loginUser.getCompany()==null){
                 throw new CustomException("请登录");

fs-company/src/main/java/com/fs/company/controller/qw/QwAcquisitionLinkInfoController.java

@@ -17,6 +17,7 @@ import com.fs.his.dto.SendResultDetailDTO;
 import com.fs.qw.bo.SendMsgLogBo;
 import com.fs.qw.dto.BatchAddAcquisitionLinkDTO;
 import com.fs.qw.dto.IpadBlindAddDto;
+import com.fs.qw.dto.SendMessageLinkDTO;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections4.CollectionUtils;
 import org.apache.poi.hssf.usermodel.HSSFCell;
@@ -138,9 +139,11 @@ public class QwAcquisitionLinkInfoController extends BaseController
     /**
      * 发送获客链接短信
      */
-    @GetMapping("/sendMessageLink/{id}/{phone}")
-    public AjaxResult sendMessageLink(@PathVariable Long id,@PathVariable String phone) {
+    @PostMapping("/sendMessageLink")
+    public AjaxResult sendMessageLink(@Valid @RequestBody SendMessageLinkDTO dto) {
         try {
+            Long id = dto.getId();
+            String phone = dto.getPhone();
             LoginUser loginUser = tokenService.getLoginUser(ServletUtils.getRequest());
             if (loginUser==null||loginUser.getCompany()==null){
                 throw new CustomException("请登录");

fs-service/src/main/java/com/fs/qw/dto/SendMessageLinkDTO.java

@@ -0,0 +1,27 @@
+package com.fs.qw.dto;
+
+import lombok.Data;
+
+import javax.validation.constraints.NotBlank;
+import javax.validation.constraints.NotNull;
+import javax.validation.constraints.Pattern;
+
+/**
+ * 发送获客链接短信请求参数DTO
+ */
+@Data
+public class SendMessageLinkDTO {
+
+    /**
+     * 获客链接ID
+     */
+    @NotNull(message = "获客链接ID不能为空")
+    private Long id;
+
+    /**
+     * 手机号码
+     */
+    @NotBlank(message = "手机号码不能为空")
+    @Pattern(regexp = "^1[3-9]\\d{9}$", message = "手机号码格式不正确")
+    private String phone;
+}