manager/my-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

登录后重定向地址不允许跳转到外部地址

Browse Source
This commit is contained in:
thinkgem
2022-12-15 23:27:18 +08:00
parent 26f6781a62
commit 96d1d7c4fd
2 changed files with 30 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
common/src/main/java/com/jeesite/common/web/http/ServletUtils.java
View File

@@ -4,23 +4,6 @@
*/ */
package com.jeesite.common.web.http; package com.jeesite.common.web.http;
import java.io.IOException;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.Map;
import java.util.Map.Entry;
import java.util.StringTokenizer;
import java.util.TreeMap;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang3.Validate;
import org.springframework.http.MediaType;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import com.fasterxml.jackson.databind.util.JSONPObject; import com.fasterxml.jackson.databind.util.JSONPObject;
import com.jeesite.common.codec.EncodeUtils; import com.jeesite.common.codec.EncodeUtils;
import com.jeesite.common.collect.MapUtils; import com.jeesite.common.collect.MapUtils;
@@ -29,6 +12,17 @@ import com.jeesite.common.lang.ExceptionUtils;
import com.jeesite.common.lang.StringUtils; import com.jeesite.common.lang.StringUtils;
import com.jeesite.common.mapper.JsonMapper; import com.jeesite.common.mapper.JsonMapper;
import com.jeesite.common.mapper.XmlMapper; import com.jeesite.common.mapper.XmlMapper;
import org.apache.commons.lang3.Validate;
import org.springframework.http.MediaType;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.*;
import java.util.Map.Entry;
/** /**
* Http与Servlet工具类. * Http与Servlet工具类.
@@ -387,6 +381,18 @@ public class ServletUtils {
return null; return null;
} }
/**
* 获取请求的域名（含端口）
*/
public static String getRequestDomain(String url) {
String scheme = StringUtils.substringBefore(url, "://");
String domain = StringUtils.substringAfter(url, "://");
if (StringUtils.contains(domain, "/")) {
domain = StringUtils.substringBefore(domain, "/");
}
return scheme + "://" + domain;
}
/** /**
* 获得请求参数值 * 获得请求参数值
*/ */

7
modules/core/src/main/java/com/jeesite/modules/sys/web/LoginController.java
View File

@@ -217,6 +217,13 @@ public class LoginController extends BaseController{
if (StringUtils.isBlank(successUrl)){ if (StringUtils.isBlank(successUrl)){
successUrl = (String)request.getAttribute("__url"); successUrl = (String)request.getAttribute("__url");
} }
if (StringUtils.contains(successUrl, "://")){
String domain = ServletUtils.getRequestDomain(successUrl);
successUrl = StringUtils.substring(successUrl, domain.length());
if (StringUtils.startsWith(successUrl, request.getContextPath())) {
successUrl = StringUtils.substringAfter(successUrl, request.getContextPath());
}
}
if (StringUtils.isBlank(successUrl)){ if (StringUtils.isBlank(successUrl)){
successUrl = Global.getProperty("shiro.successUrl"); successUrl = Global.getProperty("shiro.successUrl");
} }