From 22c22c424633cdac64908c150db1f412f766daf5 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Thu, 19 Aug 2021 15:34:13 +0800
Subject: [PATCH] 定时任务屏蔽ldap远程调用
---
ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java | 5 +++++
ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java | 8 ++++++++
2 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
index 4a07f40..e33a26a 100644
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
@@ -23,6 +23,11 @@
public static final String LOOKUP_RMI = "rmi://";
/**
+ * LDAP 远程方法调用
+ */
+ public static final String LOOKUP_LDAP = "ldap://";
+
+ /**
* http请求
*/
public static final String HTTP = "http://";
diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
index 9ce0067..c4d40eb 100644
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
@@ -91,6 +91,10 @@
{
return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi://'调用");
}
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap://'调用");
+ }
else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
{
return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用");
@@ -115,6 +119,10 @@
{
return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi://'调用");
}
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap://'调用");
+ }
else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
{
return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用");
--
Gitblit v1.9.3