Browse Source

调度通讯默认启用accessToken,提升系统安全性(建议生产环境自定义accessToken)。

xuxueli 2 years ago
parent
commit
390165d733

+ 2 - 1
doc/XXL-JOB官方文档.md

@@ -2213,7 +2213,8 @@ public void execute() {
 - 1、【修复】修复低版本风险漏洞,升级项目依赖:CVE-2021-2471、CVE-2022-22965等;
 - 2、【修复】邮箱校验逻辑下放至EmailJobAlarm中,避免对其他告警方式的干扰;
 - 3、【优化】合并多项PR,项目代码结构、健壮性优化:PR-2833、PR-2812、PR-2541、PR-2537、PR-2514、PR-2509、;
-- 4、【优化】任务线程名优化(ISSUE-2527)
+- 4、【优化】任务线程名优化(ISSUE-2527);
+- 5、【优化】调度通讯默认启用accessToken,提升系统安全性(建议生产环境自定义accessToken)。
 
 ### 7.33 版本 v2.3.2 Release Notes[规划中]
 - 1、【优化】[规划中]任务日志重构:一次调度只记录一条主任务,维护起止时间和状态。

+ 5 - 6
pom.xml

@@ -27,11 +27,11 @@
 		<netty-all.version>4.1.63.Final</netty-all.version>
 		<gson.version>2.9.0</gson.version>
 
-		<spring.version>5.3.19</spring.version>
-		<spring-boot.version>2.6.6</spring-boot.version>
+		<spring.version>5.3.20</spring.version>
+		<spring-boot.version>2.6.7</spring-boot.version>
 
 		<mybatis-spring-boot-starter.version>2.2.2</mybatis-spring-boot-starter.version>
-		<mysql-connector-java.version>8.0.28</mysql-connector-java.version>
+		<mysql-connector-java.version>8.0.29</mysql-connector-java.version>
 
 		<slf4j-api.version>1.7.36</slf4j-api.version>
 		<junit-jupiter.version>5.8.2</junit-jupiter.version>
@@ -40,9 +40,8 @@
 		<groovy.version>3.0.10</groovy.version>
 
 		<maven-source-plugin.version>3.2.1</maven-source-plugin.version>
-		<maven-javadoc-plugin.version>3.3.2</maven-javadoc-plugin.version>
-		<maven-gpg-plugin.version>1.6</maven-gpg-plugin.version>
-		<maven-war-plugin.version>3.3.2</maven-war-plugin.version>
+		<maven-javadoc-plugin.version>3.4.0</maven-javadoc-plugin.version>
+		<maven-gpg-plugin.version>3.0.1</maven-gpg-plugin.version>
 	</properties>
 
 	<build>

+ 3 - 4
xxl-job-admin/src/main/java/com/xxl/job/admin/controller/interceptor/CookieInterceptor.java

@@ -3,8 +3,8 @@ package com.xxl.job.admin.controller.interceptor;
 import com.xxl.job.admin.core.util.FtlUtil;
 import com.xxl.job.admin.core.util.I18nUtil;
 import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.AsyncHandlerInterceptor;
 import org.springframework.web.servlet.ModelAndView;
-import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
@@ -17,7 +17,7 @@ import java.util.HashMap;
  * @author xuxueli 2015-12-12 18:09:04
  */
 @Component
-public class CookieInterceptor extends HandlerInterceptorAdapter {
+public class CookieInterceptor implements AsyncHandlerInterceptor {
 
 	@Override
 	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
@@ -36,8 +36,7 @@ public class CookieInterceptor extends HandlerInterceptorAdapter {
 		if (modelAndView != null) {
 			modelAndView.addObject("I18nUtil", FtlUtil.generateStaticModel(I18nUtil.class.getName()));
 		}
-		
-		super.postHandle(request, response, handler, modelAndView);
+
 	}
 	
 }

+ 4 - 4
xxl-job-admin/src/main/java/com/xxl/job/admin/controller/interceptor/PermissionInterceptor.java

@@ -6,7 +6,7 @@ import com.xxl.job.admin.core.util.I18nUtil;
 import com.xxl.job.admin.service.LoginService;
 import org.springframework.stereotype.Component;
 import org.springframework.web.method.HandlerMethod;
-import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+import org.springframework.web.servlet.AsyncHandlerInterceptor;
 
 import javax.annotation.Resource;
 import javax.servlet.http.HttpServletRequest;
@@ -18,7 +18,7 @@ import javax.servlet.http.HttpServletResponse;
  * @author xuxueli 2015-12-12 18:09:04
  */
 @Component
-public class PermissionInterceptor extends HandlerInterceptorAdapter {
+public class PermissionInterceptor implements AsyncHandlerInterceptor {
 
 	@Resource
 	private LoginService loginService;
@@ -27,7 +27,7 @@ public class PermissionInterceptor extends HandlerInterceptorAdapter {
 	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
 		
 		if (!(handler instanceof HandlerMethod)) {
-			return super.preHandle(request, response, handler);
+			return true;	// proceed with the next interceptor
 		}
 
 		// if need login
@@ -53,7 +53,7 @@ public class PermissionInterceptor extends HandlerInterceptorAdapter {
 			request.setAttribute(LoginService.LOGIN_IDENTITY_KEY, loginUser);
 		}
 
-		return super.preHandle(request, response, handler);
+		return true;	// proceed with the next interceptor
 	}
 	
 }

+ 1 - 1
xxl-job-admin/src/main/resources/application.properties

@@ -52,7 +52,7 @@ spring.mail.properties.mail.smtp.starttls.required=true
 spring.mail.properties.mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
 
 ### xxl-job, access token
-xxl.job.accessToken=
+xxl.job.accessToken=default_token
 
 ### xxl-job, i18n (default is zh_CN, and you can choose "zh_CN", "zh_TC" and "en")
 xxl.job.i18n=zh_CN

+ 1 - 1
xxl-job-executor-samples/xxl-job-executor-sample-frameless/src/main/resources/xxl-job-executor.properties

@@ -2,7 +2,7 @@
 xxl.job.admin.addresses=http://127.0.0.1:8080/xxl-job-admin
 
 ### xxl-job, access token
-xxl.job.accessToken=
+xxl.job.accessToken=default_token
 
 ### xxl-job executor appname
 xxl.job.executor.appname=xxl-job-executor-sample

+ 1 - 1
xxl-job-executor-samples/xxl-job-executor-sample-springboot/src/main/resources/application.properties

@@ -11,7 +11,7 @@ logging.config=classpath:logback.xml
 xxl.job.admin.addresses=http://127.0.0.1:8080/xxl-job-admin
 
 ### xxl-job, access token
-xxl.job.accessToken=
+xxl.job.accessToken=default_token
 
 ### xxl-job executor appname
 xxl.job.executor.appname=xxl-job-executor-sample