build(pom): v3.5.4发布

perf(html): 模版更新
fix(yml): Public Key Retrieval is not allowed
2025-07-01 23:26:38 +00:00 · 2021-06-01 23:14:35 +08:00 · 2021-06-01 23:13:18 +08:00 · 2021-06-01 23:03:15 +08:00 · 2021-06-01 22:49:23 +08:00 · 2021-06-01 22:01:05 +08:00
12 changed files with 11 additions and 17 deletions
--- a/novel-admin/pom.xml
+++ b/novel-admin/pom.xml
@ -5,7 +5,7 @@

    <groupId>com.java2nb</groupId>
    <artifactId>novel-admin</artifactId>
-    <version>3.5.3</version>
+    <version>3.5.4</version>
    <packaging>jar</packaging>

    <name>novel-admin</name>
--- a/novel-admin/src/main/java/com/java2nb/common/config/ShiroConfig.java
+++ b/novel-admin/src/main/java/com/java2nb/common/config/ShiroConfig.java
@ -75,7 +75,6 @@ public class ShiroConfig {
        filterChainDefinitionMap.put("/img/**", "anon");
        filterChainDefinitionMap.put("/docs/**", "anon");
        filterChainDefinitionMap.put("/layuimini/**", "anon");
-        filterChainDefinitionMap.put("/druid/**", "anon");
        filterChainDefinitionMap.put("/upload/**", "anon");
        filterChainDefinitionMap.put("/files/**", "anon");
        filterChainDefinitionMap.put("/logout", "logout");
--- a/novel-admin/src/main/resources/application-dev.yml
+++ b/novel-admin/src/main/resources/application-dev.yml
@ -10,7 +10,7 @@ spring:
  datasource:
    type: com.alibaba.druid.pool.DruidDataSource
    driverClassName: com.mysql.cj.jdbc.Driver
-    url: jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
+    url: jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
    username: root
    password: test123456
    #password:
--- a/novel-admin/src/main/resources/application-prod.yml
+++ b/novel-admin/src/main/resources/application-prod.yml
@ -10,7 +10,7 @@ spring:
  datasource:
    type: com.alibaba.druid.pool.DruidDataSource
    driverClassName: com.mysql.cj.jdbc.Driver
-    url: jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
+    url: jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
    username: root
    password: test123456
    #password:
--- a/novel-common/pom.xml
+++ b/novel-common/pom.xml
@ -5,7 +5,7 @@
    <parent>
        <artifactId>novel</artifactId>
        <groupId>com.java2nb</groupId>
-        <version>3.5.3</version>
+        <version>3.5.4</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

--- a/novel-crawl/pom.xml
+++ b/novel-crawl/pom.xml
@ -5,7 +5,7 @@
    <parent>
        <artifactId>novel</artifactId>
        <groupId>com.java2nb</groupId>
-        <version>3.5.3</version>
+        <version>3.5.4</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

--- a/novel-front/pom.xml
+++ b/novel-front/pom.xml
@ -5,7 +5,7 @@
    <parent>
        <artifactId>novel</artifactId>
        <groupId>com.java2nb</groupId>
-        <version>3.5.3</version>
+        <version>3.5.4</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

--- a/novel-front/src/main/java/com/java2nb/novel/core/wrapper/XssHttpServletRequestWrapper.java
+++ b/novel-front/src/main/java/com/java2nb/novel/core/wrapper/XssHttpServletRequestWrapper.java
@ -14,11 +14,6 @@ import java.util.List;
 */
 public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

-    /**
-     * 假如有有html 代码是自己传来的  需要设定对应的name 不过滤
-     */
-    private static final List<String> noFilterNames = Arrays.asList("content");
-
    /**
     * @param request
     */
@ -29,7 +24,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
-        if (!noFilterNames.contains(name) && values != null) {
+        if (values != null) {
            int length = values.length;
            String[] escapseValues = new String[length];
            for (int i = 0; i < length; i++) {
--- a/novel-front/src/main/resources/application.yml
+++ b/novel-front/src/main/resources/application.yml
@ -48,7 +48,7 @@ xss:
  # 排除链接（多个用逗号分隔）
  excludes: /system/notice/*
  # 匹配链接 （多个用逗号分隔）
-  urlPatterns: /book/addBookComment,/user/addFeedBack,/author/addBook,/author/addBookContent,/author/register.html
+  urlPatterns: /book/addBookComment,/user/addFeedBack,/author/addBook,/author/addBookContent,/author/updateBookContent,/author/register.html


 author:
--- a/novel-front/src/main/resources/templates/book/book_detail.html
+++ b/novel-front/src/main/resources/templates/book/book_detail.html
@ -95,7 +95,7 @@
                            <span class="block">暂无评论</span>
                        </div>
                        <div class="commentBar" id="commentPanel" th:style="${bookCommentPageBean.total == 0}? 'display:none'">
-                            <div th:each="comment: ${bookCommentPageBean.list}" class="comment_list cf"><div class="user_heads fl" vals="389"><img th:src="${comment.createUserPhoto}?${comment.createUserPhoto}:'/images/man.png'" class="user_head" alt=""><span class="user_level1" style="display: none;">见习</span></div><ul class="pl_bar fr">			<li class="name" th:text="${#strings.substring(comment.createUserName,0,4)}+'****'+${#strings.substring(comment.createUserName,#strings.length(comment.createUserName)-3,#strings.length(comment.createUserName))}"></li><li class="dec" th:text="${comment.commentContent}"></li><li class="other cf"><span class="time fl" th:text="${#calendars.format(comment.createTime, 'yyyy-MM-dd HH:mm:ss')}"></span><span class="fr"><a href="javascript:void(0);" onclick="javascript:BookDetail.AddAgreeTotal(77,this);" class="zan" style="display: none;">赞<i class="num">(0)</i></a></span></li>		</ul>	</div>
+                            <div th:each="comment: ${bookCommentPageBean.list}" class="comment_list cf"><div class="user_heads fl" vals="389"><img th:src="${comment.createUserPhoto}?${comment.createUserPhoto}:'/images/man.png'" class="user_head" alt=""><span class="user_level1" style="display: none;">见习</span></div><ul class="pl_bar fr">			<li class="name" th:text="${#strings.substring(comment.createUserName,0,4)}+'****'+${#strings.substring(comment.createUserName,#strings.length(comment.createUserName)-3,#strings.length(comment.createUserName))}"></li><li class="dec" th:utext="${comment.commentContent}"></li><li class="other cf"><span class="time fl" th:text="${#calendars.format(comment.createTime, 'yyyy-MM-dd HH:mm:ss')}"></span><span class="fr"><a href="javascript:void(0);" onclick="javascript:BookDetail.AddAgreeTotal(77,this);" class="zan" style="display: none;">赞<i class="num">(0)</i></a></span></li>		</ul>	</div>

                        </div>

--- a/pom.xml
+++ b/pom.xml
@ -5,7 +5,7 @@

    <groupId>com.java2nb</groupId>
    <artifactId>novel</artifactId>
-    <version>3.5.3</version>
+    <version>3.5.4</version>
    <modules>
        <module>novel-common</module>
        <module>novel-front</module>
--- a/templates/orange/html/book/book_detail.html
+++ b/templates/orange/html/book/book_detail.html
@ -95,7 +95,7 @@
                            <span class="block">暂无评论</span>
                        </div>
                        <div class="commentBar" id="commentPanel" th:style="${bookCommentPageBean.total == 0}? 'display:none'">
-                            <div th:each="comment: ${bookCommentPageBean.list}" class="comment_list cf"><div class="user_heads fl" vals="389"><img th:src="${comment.createUserPhoto}?${comment.createUserPhoto}:'/images/man.png'" class="user_head" alt=""><span class="user_level1" style="display: none;">见习</span></div><ul class="pl_bar fr">			<li class="name" th:text="${#strings.substring(comment.createUserName,0,4)}+'****'+${#strings.substring(comment.createUserName,#strings.length(comment.createUserName)-3,#strings.length(comment.createUserName))}"></li><li class="dec" th:text="${comment.commentContent}"></li><li class="other cf"><span class="time fl" th:text="${#calendars.format(comment.createTime, 'yyyy-MM-dd HH:mm:ss')}"></span><span class="fr"><a href="javascript:void(0);" onclick="javascript:BookDetail.AddAgreeTotal(77,this);" class="zan" style="display: none;">赞<i class="num">(0)</i></a></span></li>		</ul>	</div>
+                            <div th:each="comment: ${bookCommentPageBean.list}" class="comment_list cf"><div class="user_heads fl" vals="389"><img th:src="${comment.createUserPhoto}?${comment.createUserPhoto}:'/images/man.png'" class="user_head" alt=""><span class="user_level1" style="display: none;">见习</span></div><ul class="pl_bar fr">			<li class="name" th:text="${#strings.substring(comment.createUserName,0,4)}+'****'+${#strings.substring(comment.createUserName,#strings.length(comment.createUserName)-3,#strings.length(comment.createUserName))}"></li><li class="dec" th:utext="${comment.commentContent}"></li><li class="other cf"><span class="time fl" th:text="${#calendars.format(comment.createTime, 'yyyy-MM-dd HH:mm:ss')}"></span><span class="fr"><a href="javascript:void(0);" onclick="javascript:BookDetail.AddAgreeTotal(77,this);" class="zan" style="display: none;">赞<i class="num">(0)</i></a></span></li>		</ul>	</div>

                        </div>
Author	SHA1	Message	Date
xiongxiaoyang	8d3ce53dba	build(pom): v3.5.4发布	2021-06-01 23:14:35 +08:00
xiongxiaoyang	d32d9d8410	perf(html): 模版更新	2021-06-01 23:13:18 +08:00
xiongxiaoyang	05ae012e05	fix(yml): Public Key Retrieval is not allowed	2021-06-01 23:03:15 +08:00
xiongxiaoyang	b60a0c9b40	perf(监控): 设置druid监控信息登陆后查看	2021-06-01 22:49:23 +08:00
xiongxiaoyang	3efaf8ce5f	perf(评论): 优化评论显示	2021-06-01 22:01:05 +08:00
xiongxiaoyang	ebc4210774	fix(章节更新): xss	2021-06-01 21:44:18 +08:00
xiaoyang	655ec90906	fix(data submit): Xss攻击	2021-06-01 20:58:06 +08:00