漏洞修复-[高危] 多处接口返回未脱敏手机号

fs-admin/src/main/java/com/fs/company/controller/SopStatsOverviewController.java

@@ -93,38 +93,38 @@ public class SopStatsOverviewController extends BaseController {
     /**
      * 销售端查询解密后的客户联系电话
      * */
-    @GetMapping("/companyGetUserPhone/{id}")
-    public R companyGetUserPhone(@PathVariable("id") Long id){
-        SopCompanyUserTaskDto queryDto=new SopCompanyUserTaskDto();
-        queryDto.setId(id);
-        List<SopCompanyUserTaskVo> list = fsSopCompanyUserTaskService.statsOverviewAllList(queryDto);
-        if (CollectionUtils.isNotEmpty(list)&&list.size()==1){
-            String userPhone=list.get(0).getPhone();
-            if (userPhone!=null&&userPhone.length()>11){
-                userPhone=decryptPhone(userPhone);
-            }
-            return R.ok().put("userPhone",userPhone);
-        }
-        return R.ok().put("userPhone","");
-    }
-
-    /**
-     * 医生端查询解密后的客户联系电话
-     * */
-    @GetMapping("/doctorGetUserPhone/{id}")
-    public R doctorGetUserPhone(@PathVariable("id") Long id){
-        SopDoctorTaskDto queryDto=new SopDoctorTaskDto();
-        queryDto.setId(id);
-        List<SopDoctorTaskVo> list = fsSopDoctorTaskService.statsDoctorOverviewAllList(queryDto);
-        if (CollectionUtils.isNotEmpty(list)&&list.size()==1){
-            String userPhone=list.get(0).getPhone();
-            if (userPhone!=null&&userPhone.length()>11){
-                userPhone=decryptPhone(userPhone);
-            }
-            return R.ok().put("userPhone",userPhone);
-        }
-        return R.ok().put("userPhone","");
-    }
+//    @GetMapping("/companyGetUserPhone/{id}")
+//    public R companyGetUserPhone(@PathVariable("id") Long id){
+//        SopCompanyUserTaskDto queryDto=new SopCompanyUserTaskDto();
+//        queryDto.setId(id);
+//        List<SopCompanyUserTaskVo> list = fsSopCompanyUserTaskService.statsOverviewAllList(queryDto);
+//        if (CollectionUtils.isNotEmpty(list)&&list.size()==1){
+//            String userPhone=list.get(0).getPhone();
+//            if (userPhone!=null&&userPhone.length()>11){
+//                userPhone=decryptPhone(userPhone);
+//            }
+//            return R.ok().put("userPhone",userPhone);
+//        }
+//        return R.ok().put("userPhone","");
+//    }
+//
+//    /**
+//     * 医生端查询解密后的客户联系电话
+//     * */
+//    @GetMapping("/doctorGetUserPhone/{id}")
+//    public R doctorGetUserPhone(@PathVariable("id") Long id){
+//        SopDoctorTaskDto queryDto=new SopDoctorTaskDto();
+//        queryDto.setId(id);
+//        List<SopDoctorTaskVo> list = fsSopDoctorTaskService.statsDoctorOverviewAllList(queryDto);
+//        if (CollectionUtils.isNotEmpty(list)&&list.size()==1){
+//            String userPhone=list.get(0).getPhone();
+//            if (userPhone!=null&&userPhone.length()>11){
+//                userPhone=decryptPhone(userPhone);
+//            }
+//            return R.ok().put("userPhone",userPhone);
+//        }
+//        return R.ok().put("userPhone","");
+//    }
 
     /**
      * 获取用户信息信息

fs-admin/src/main/java/com/fs/crm/controller/CrmCustomerController.java

@@ -300,6 +300,13 @@ public class CrmCustomerController extends BaseController
     {
         CrmCustomer customer=crmCustomerService.selectCrmCustomerById(customerId);
         String mobile = customer.getMobile();
+        if (StringUtils.isNotEmpty(mobile)) {
+            if (mobile.length() > 11) {
+                mobile = PhoneUtil.decryptPhoneMk(mobile);
+            } else {
+                mobile = maskPhoneMiddleFive(mobile);
+            }
+        }
         return R.ok().put("mobile",mobile);
     }
 

fs-doctor-app/src/main/java/com/fs/app/controller/InquiryOrderController.java

@@ -49,6 +49,7 @@ import javax.servlet.http.HttpServletRequest;
 import java.util.*;
 
 import static com.fs.his.utils.PhoneUtil.decryptPhone;
+import static com.fs.his.utils.PhoneUtil.maskPhoneMiddleFive;
 
 
 @Api("订单接口")
@@ -361,8 +362,11 @@ public class InquiryOrderController extends  AppBaseController {
         if (patientJson != null&&!"".equals(patientJson)) {
             FsInquiryOrderPatientDTO fsInquiryOrderPatientDTO = JSON.parseObject(patientJson, FsInquiryOrderPatientDTO.class);
             String phone = fsInquiryOrderPatientDTO.getMobile();
-            if (phone!=null&&phone.length()>11){
-               phone= decryptPhone(phone);
+//            if (phone!=null&&phone.length()>11){
+//               phone= decryptPhone(phone);
+//            }
+            if (phone!=null && phone.length() == 11) {
+                phone = maskPhoneMiddleFive(phone);
             }
 
             return R.ok().put("data",phone);

fs-service/src/main/java/com/fs/his/utils/PhoneUtil.java

@@ -188,4 +188,16 @@ public class PhoneUtil {
         // 4. 将字节数组按 UTF-8 解码为字符串
         return new String(resultBytes, java.nio.charset.StandardCharsets.UTF_8);
     }
+
+    /**
+     * 手机号中间4位脱敏处理 (例如: 13812345678 -> 138****5678)
+     * @param phone 原始手机号
+     * @return 脱敏后的手机号
+     */
+    public static String maskPhoneMiddleFive(String phone) {
+        if (phone == null || phone.isEmpty()) {
+            return phone;
+        }
+        return phone.replaceAll("(\\d{3})\\d{4}(\\d{4})", "$1****$2");
+    }
 }