漏洞修复

ruoyi-common/pom.xml

@@ -227,6 +227,10 @@
             <artifactId>cas-client-autoconfig-support</artifactId>
             <version>2.0.0-GA</version>
         </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-webmvc</artifactId>
+        </dependency>
     </dependencies>
 
 </project>

ruoyi-common/src/main/java/com/ruoyi/common/filter/RestCorsFilter.java

@@ -8,6 +8,9 @@ import javax.servlet.*;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
 
 @Component
 @Order(Ordered.HIGHEST_PRECEDENCE)
@@ -20,9 +23,18 @@ public class RestCorsFilter implements Filter {
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
         HttpServletResponse response = (HttpServletResponse) res;
         HttpServletRequest request = (HttpServletRequest) req;
-        response.setHeader("Access-Control-Allow-Origin", "*"); // 可写成受信任的站点
+
+        String[] allowDomain={"http://10.152.72.7","http://10.152.70.21","http://10.152.72.5"};
+        Set<String> allowedOrigins=new HashSet<>(Arrays.asList(allowDomain));
+        String originHeader=request.getHeader("Origin");
+        if(allowedOrigins.contains(originHeader)){
+            response.setHeader("Access-Control-Allow-Origin",originHeader);
+        }else{
+            response.setHeader("Access-Control-Allow-Origin","https://***.***.com");
+        }
+        response.setHeader("Access-Control-Allow-Origin", "http://10.152.72.7"); // 可写成受信任的站点
         response.setHeader("Access-Control-Allow-Credentials","true");
-        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS ,DELETE,PUT");
+        response.setHeader("Access-Control-Allow-Methods", "POST, GET,DELETE,PUT");
         response.setHeader("Access-Control-Max-Age", "31536000");
         response.setHeader("Access-Control-Allow-Headers", "*");
         if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {