diff --git a/novel-front/src/main/java/com/java2nb/novel/core/wrapper/XssHttpServletRequestWrapper.java b/novel-front/src/main/java/com/java2nb/novel/core/wrapper/XssHttpServletRequestWrapper.java index 059e265..b56f7fa 100644 --- a/novel-front/src/main/java/com/java2nb/novel/core/wrapper/XssHttpServletRequestWrapper.java +++ b/novel-front/src/main/java/com/java2nb/novel/core/wrapper/XssHttpServletRequestWrapper.java @@ -1,37 +1,42 @@ package com.java2nb.novel.core.wrapper; +import org.apache.commons.lang3.StringUtils; + import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; +import java.util.Arrays; +import java.util.List; /** * XSS过滤处理 + * * @author Administrator */ -public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper -{ +public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { + + /** + * 假如有有html 代码是自己传来的 需要设定对应的name 不过滤 + */ + private static final List noFilterNames = Arrays.asList("content"); + /** * @param request */ - public XssHttpServletRequestWrapper(HttpServletRequest request) - { + public XssHttpServletRequestWrapper(HttpServletRequest request) { super(request); } @Override - public String[] getParameterValues(String name) - { + public String[] getParameterValues(String name) { String[] values = super.getParameterValues(name); - if (values != null) - { + if (!noFilterNames.contains(name) && values != null) { int length = values.length; String[] escapseValues = new String[length]; - for (int i = 0; i < length; i++) - { - // 防xss攻击和过滤前后空格 - escapseValues[i] = values[i].replaceAll("<","<").replaceAll(">",">"); + for (int i = 0; i < length; i++) { + escapseValues[i] = values[i].replaceAll("<", "<").replaceAll(">", ">"); } return escapseValues; } - return super.getParameterValues(name); + return values; } } diff --git a/novel-front/src/main/resources/application.yml b/novel-front/src/main/resources/application.yml index 9ab7ea8..2303787 100644 --- a/novel-front/src/main/resources/application.yml +++ b/novel-front/src/main/resources/application.yml @@ -23,7 +23,7 @@ xss: # 排除链接（多个用逗号分隔） excludes: /system/notice/* # 匹配链接 （多个用逗号分隔） - urlPatterns: /book/addBookComment,/user/addFeedBack + urlPatterns: /book/addBookComment,/user/addFeedBack,/author/addBook,/author/addBookContent,/author/register.html diff --git a/novel-front/src/main/resources/templates/book/book_content.html b/novel-front/src/main/resources/templates/book/book_content.html index 5e8cc54..3f33237 100644 --- a/novel-front/src/main/resources/templates/book/book_content.html +++ b/novel-front/src/main/resources/templates/book/book_content.html @@ -2,7 +2,7 @@ - + @@ -74,7 +74,7 @@
首页 > - > + >
@@ -82,11 +82,11 @@
-

+

类别： - 作者： + 作者：
diff --git a/novel-front/src/main/resources/templates/book/book_detail.html b/novel-front/src/main/resources/templates/book/book_detail.html index 248e471..58f05dc 100644 --- a/novel-front/src/main/resources/templates/book/book_detail.html +++ b/novel-front/src/main/resources/templates/book/book_detail.html @@ -2,7 +2,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> - +
-

+

  • 类别： @@ -70,7 +70,7 @@
  • - +
    • @@ -143,7 +143,7 @@
    签约作家

    + th:utext="${book.authorName}">
diff --git a/novel-front/src/main/resources/templates/book/book_index.html b/novel-front/src/main/resources/templates/book/book_index.html index c6146a1..9106404 100644 --- a/novel-front/src/main/resources/templates/book/book_index.html +++ b/novel-front/src/main/resources/templates/book/book_index.html @@ -2,7 +2,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> - + @@ -26,11 +26,11 @@
-

+

  • - 作者： + 作者： 类别： 状态：连载中已完结 @@ -45,7 +45,7 @@
    • - [免费] + [免费]
      • diff --git a/novel-front/src/main/resources/templates/user/set_name.html b/novel-front/src/main/resources/templates/user/set_name.html index d2b06b8..023cbd4 100644 --- a/novel-front/src/main/resources/templates/user/set_name.html +++ b/novel-front/src/main/resources/templates/user/set_name.html @@ -1,4 +1,5 @@ - + @@ -24,21 +25,26 @@
      -
      - -
      +
      + +
      -
      +
      - - -
      -
        -
      • 我的昵称
        • -
      •  用户名只能包括汉字、英文字母、数字和下划线
        • -
      •  
        • -
      •  
        • -
      + + +
      +
        +
      • 我的昵称
        • +
      •  用户名只能包括汉字、英文字母、数字和下划线
        • +
      •  
        • +
      •  
        • +
      @@ -57,14 +63,13 @@ dataType: "json", success: function (data) { if (data.code == 200) { - if(data.data.nickName){ + if (data.data.nickName) { $("#txtNiceName").val(data.data.nickName); - }else{ + } else { $("#txtNiceName").val(data.data.username); } - } else if (data.code == 1001) { //未登录 location.href = '/user/login.html?originUrl=' + decodeURIComponent(location.href); @@ -78,27 +83,26 @@ layer.alert('网络异常'); } }) + function updateName() { var nickname = $("#txtNiceName").val(); - if(nickname.isBlank()){ + if (nickname.isBlank()) { $("#LabErr").html("昵称不能为空！"); return; } - if(!nickname.isNickName()){ + if (!nickname.isNickName()) { $("#LabErr").html("昵称格式不正确！"); return; } $.ajax({ type: "POST", url: "/user/updateUserInfo", - data: {'nickName':nickname}, + data: {'nickName': nickname}, dataType: "json", success: function (data) { if (data.code == 200) { - if(data.data.token){ - $.cookie('Authorization', data.data.token,{ path: '/' }); - } + $.cookie('Authorization', data.data.token, {path: '/'}); window.location.href = '/user/setup.html'; } else if (data.code == 1001) {