fix 修复系统爆破性谷歌登录、登录地址，系统报错信息

netflix-service/src/main/java/com/cyksj/service/user/UserService.java

@@ -52,6 +52,8 @@ public interface UserService extends IService<User> {
 	 */
 	User webLogin(LoginReq loginReq, HttpServletRequest request) throws Exception;
 
+	User googleLogin(LoginReq loginReq, String credential, HttpServletRequest request) throws Exception;
+
 	String bindWxAccountRedirect(String code, String state) throws Exception;
 
 	/**

netflix-service/src/main/java/com/cyksj/service/user/impl/UserServiceImpl.java

@@ -1,5 +1,7 @@
 package com.cyksj.service.user.impl;
 
+import cn.hutool.http.HttpUtil;
+import com.cyksj.model.response.GoogleLoginRep;
 import cn.hutool.core.bean.BeanUtil;
 import cn.hutool.core.collection.CollUtil;
 import cn.hutool.core.date.DateTime;
@@ -473,6 +475,43 @@ public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements Us
 
 	@Override
 	public User webLogin(LoginReq loginReq, HttpServletRequest request) throws Exception {
+        if (loginReq == null || loginReq.getType() == null
+                || (loginReq.getType() != 1 && loginReq.getType() != 2)) {
+            throw BusinessRuntimeException.getInstance("不支持的登录方式");
+        }
+        return loginWithVerifiedIdentity(loginReq, request);
+    }
+
+    @Override
+    public User googleLogin(LoginReq loginReq, String credential, HttpServletRequest request) throws Exception {
+        if (loginReq == null || StrUtil.isBlank(credential)) {
+            throw BusinessRuntimeException.getInstance("Google身份验证失败");
+        }
+        // 身份只能来自服务端验证结果，不能相信客户端的type/email/subject。
+        GoogleLoginRep identity;
+        try {
+            String url = "https://galaxyva.com/8081/api/auth/google/login/inner?credential="
+                    + java.net.URLEncoder.encode(credential, "UTF-8");
+            String result = HttpUtil.post(url, new java.util.HashMap<>(), 10000);
+            java.util.Map<String, Object> response = Jsons.toMap(result);
+            if (!"10000".equals(String.valueOf(response.get("code")))) {
+                throw new IllegalArgumentException("Verification rejected");
+            }
+            identity = Jsons.parseObject(response.get("data"), GoogleLoginRep.class);
+            if (identity == null || StrUtil.isBlank(identity.getEmail()) || StrUtil.isBlank(identity.getSubject())) {
+                throw new IllegalArgumentException("Missing verified identity");
+            }
+        } catch (Exception e) {
+            // 不记录credential或验证服务响应。
+            throw BusinessRuntimeException.getInstance("Google身份验证失败");
+        }
+        loginReq.setType(3);
+        loginReq.setEmail(identity.getEmail());
+        loginReq.setSubject(identity.getSubject());
+        return loginWithVerifiedIdentity(loginReq, request);
+    }
+
+    private User loginWithVerifiedIdentity(LoginReq loginReq, HttpServletRequest request) throws Exception {
 		LambdaQueryWrapper<User> wrapper = Wrappers.lambdaQuery(User.class).last("limit 1");
 		if (loginReq.getType() == null || loginReq.getType() < 1 || loginReq.getType() > 3) {
 			throw BusinessRuntimeException.getInstance("系统异常,请刷新页面重新操作");

netflix-web/src/main/java/com/cyksj/config/SaTokenConfigure.java

@@ -20,7 +20,7 @@ public class SaTokenConfigure implements WebMvcConfigurer {
 	@Override
 	public void addInterceptors(InterceptorRegistry registry) {
 		registry.addInterceptor(new SaRouteInterceptor())
-				.addPathPatterns(List.of("/manage/**", "/manager/**", "/sys/update", "/sys/delete/**"))
+				.addPathPatterns(List.of("/manage/**", "/manager/**", "/sys/post", "/sys/update", "/sys/delete/**"))
 				.excludePathPatterns(List.of("/manage/admin/login",
 						"/manage/admin/get/loginInfo",
 						"/manage/corp/**",

netflix-web/src/main/java/com/cyksj/web/GlobalExceptionHandler.java

@@ -5,7 +5,6 @@ import cn.dev33.satoken.exception.NotPermissionException;
 import cn.dev33.satoken.exception.NotRoleException;
 import cn.hutool.core.lang.Validator;
 import com.cyksj.common.exception.BusinessRuntimeException;
-import com.cyksj.common.util.StringUtil;
 import com.cyksj.dto.Result;
 import com.cyksj.enums.GatewayApiCode;
 import com.cyksj.enums.GatewayResponse;
@@ -39,22 +38,9 @@ public class GlobalExceptionHandler {
 
     @ExceptionHandler(value = {Exception.class})
     public Result<String> handleNoteException(Exception e) {
-        StringBuilder builder = new StringBuilder(32);
-        builder.append(request.getRequestURI()).append(" -- > ");
-
-        StackTraceElement[] trace = e.getStackTrace();
-        log.info("{}",e);
-        for (StackTraceElement element : trace) {
-            if (StringUtil.startsWith(element.getClassName(), "com.cyksj")) {
-                builder.append(element.getFileName())
-                        .append("[").append(element.getLineNumber()).append("]")
-                        .append("&");
-            }
-        }
-        builder.deleteCharAt(builder.length() - 1);
-
-        String message = e.getMessage();
-        String value = builder.toString();
+        String requestId = java.util.UUID.randomUUID().toString();
+        log.error("Request failed requestId={} path={}", requestId, request.getRequestURI(), e);
+        String message = e instanceof BusinessRuntimeException ? e.getMessage() : "系统异常，请稍后重试";
         GatewayApiCode apiCode = null;
         if (e instanceof BusinessRuntimeException) {
             BusinessRuntimeException ee = (BusinessRuntimeException) e;
@@ -84,11 +70,11 @@ public class GlobalExceptionHandler {
             NotPermissionException ee = (NotPermissionException) e;
             apiCode = GatewayApiCode.CMS_USER_NO_PERMISSION;
         }
-        log.error("全局错误处理: \n Cause: {} \n Value: {}", message, value);
+
         if (apiCode != null) {
             return GatewayResponse.FAIL.newBuilder().buildGatewayCode(apiCode).toResult();
         }
-        return GatewayResponse.FAIL.newBuilder().setMsg(message).toResult(value);
+        return GatewayResponse.FAIL.newBuilder().setMsg(message).toResult("requestId=" + requestId);
     }
 
     @ExceptionHandler(value = ConstraintViolationException.class)

netflix-web/src/main/java/com/cyksj/web/controller/cps/CpsBackLoginController.java

@@ -27,7 +27,6 @@ import com.cyksj.model.dto.CpsAuthDto;
 import com.cyksj.model.dto.GzhOAuth2UserInfo;
 import com.cyksj.model.entity.*;
 import com.cyksj.model.request.LoginReq;
-import com.cyksj.model.response.GoogleLoginRep;
 import com.cyksj.model.response.UserAuthLoginResp;
 import com.cyksj.model.views.UserInfoView;
 import com.cyksj.redis.RedisService;
@@ -246,14 +245,7 @@ public class CpsBackLoginController {
 	 */
 	@PostMapping("/google/login")
 	public Result<UserAuthLoginResp> googleLogin(LoginReq loginReq, String credential) throws Exception {
-		log.info("google loginReq:{},credential:{}", loginReq, credential);
-		String result = HttpUtil.post("https://galaxyva.com/8081/api/auth/google/login/inner?credential=" + credential, new HashMap<>());
-		log.info("google result:{}", result);
-		GoogleLoginRep googleLoginRep = Jsons.parseObject(Jsons.toMap(result).get("data"), GoogleLoginRep.class);
-		loginReq.setType(3);
-		loginReq.setEmail(googleLoginRep.getEmail());
-		loginReq.setSubject(googleLoginRep.getSubject());
-		User user = userService.webLogin(loginReq, request);
+		User user = userService.googleLogin(loginReq, credential, request);
 
 		//是否非cps分销用户
 		UserDistribute userDistribute = userDistributeMapper.selectOne(Wrappers.lambdaQuery(UserDistribute.class)

netflix-web/src/main/java/com/cyksj/web/controller/manage/AdminController.java

@@ -73,17 +73,17 @@ public class AdminController {
                 new QueryWrapper<Admin>().lambda().eq(Admin::getPhone,adminRequest.getPhone()));
 
         if (null == admin) {
-            throw BusinessRuntimeException.getInstance("该用户不存在.");
+            throw BusinessRuntimeException.getInstance("账号或凭据错误");
         }
         if (null == admin.getStatus() || !admin.getStatus()) {
-            throw BusinessRuntimeException.getInstance("无登录权限.");
+            throw BusinessRuntimeException.getInstance("账号或凭据错误");
         }
 
         // 对比密码
         String encodePasscode = Codec.DoDigest.custom().setAlgorithm(Codec.DoDigest.Algorithm.SHA256).setStringData(adminRequest.getPassWord()).toBase64String();
 
         if (!StringUtils.equals(admin.getPassWord(), encodePasscode)) {
-            throw BusinessRuntimeException.getInstance("密码有误.");
+            throw BusinessRuntimeException.getInstance("账号或凭据错误");
         }
         return GatewayResponse.SUCCESS.newBuilder().toResult();
     }

netflix-web/src/main/java/com/cyksj/web/controller/sys/SysConfigController.java

@@ -112,6 +112,8 @@ public class SysConfigController {
 	@PostMapping("/post")
 	@Log(module = "系统设置/新增配置", businessType = BusinessType.POST, isSaveRequestData = true)
 	public Result<SysConfig> post(@RequestBody SysConfig sysConfig) {
+        StpUtil.checkLogin();
+        sysConfig.setId(null);
 		sysConfigService.save(sysConfig);
 		return GatewayResponse.SUCCESS.newBuilder().toResult(sysConfig);
 	}

netflix-web/src/main/java/com/cyksj/web/controller/user/AddressController.java

@@ -52,6 +52,7 @@ public class AddressController {
         if(address.getIsDefault() != null && address.getIsDefault() ){
             addressService.update(Wrappers.lambdaUpdate(Address.class).in(Address::getUserId,userIdList).set(Address::getIsDefault,false));
         }
+        address.setId(null);
         address.setUserId(userId);
         addressService.save(address);
         return GatewayResponse.SUCCESS.newBuilder().toResult(address);
@@ -63,11 +64,34 @@ public class AddressController {
 
         long userId = StpUserUtil.getLoginIdAsLong();
         List<Long> userIdList = userBindRelationService.getRelationUserIdList(userId, null);
-        if(address.getIsDefault() != null && address.getIsDefault() ){
-            addressService.update(Wrappers.lambdaUpdate(Address.class).in(Address::getUserId,userIdList).set(Address::getIsDefault,false));
+        if (address.getId() == null || userIdList == null || userIdList.isEmpty()) {
+            throw new BusinessRuntimeException("地址不存在或无权操作");
         }
-
-        addressService.updateById(address);
+        Address existing = addressService.getOne(Wrappers.lambdaQuery(Address.class)
+                .eq(Address::getId, address.getId()).in(Address::getUserId, userIdList));
+        if (existing == null) {
+            throw new BusinessRuntimeException("地址不存在或无权操作");
+        }
+        // 只复制允许编辑的字段，拒绝userId和BaseEntity字段的批量赋值。
+        Address changes = new Address();
+        changes.setReceiver(address.getReceiver());
+        changes.setPhone(address.getPhone());
+        changes.setProvince(address.getProvince());
+        changes.setCity(address.getCity());
+        changes.setDistrict(address.getDistrict());
+        changes.setAddress(address.getAddress());
+        changes.setCode(address.getCode());
+        changes.setIsDefault(address.getIsDefault());
+        if (!addressService.update(changes, Wrappers.lambdaUpdate(Address.class)
+                .eq(Address::getId, existing.getId()).in(Address::getUserId, userIdList))) {
+            throw new BusinessRuntimeException("地址不存在或无权操作");
+        }
+        if (Boolean.TRUE.equals(address.getIsDefault())) {
+            addressService.update(Wrappers.lambdaUpdate(Address.class)
+                    .in(Address::getUserId, userIdList).ne(Address::getId, existing.getId())
+                    .set(Address::getIsDefault, false));
+        }
+        address = addressService.getById(existing.getId());
         return GatewayResponse.SUCCESS.newBuilder().toResult(address);
     }
 

netflix-web/src/main/java/com/cyksj/web/controller/user/AuthorizationController.java

@@ -25,7 +25,6 @@ import com.cyksj.model.dto.*;
 import com.cyksj.model.entity.PhoneCode;
 import com.cyksj.model.entity.User;
 import com.cyksj.model.request.LoginReq;
-import com.cyksj.model.response.GoogleLoginRep;
 import com.cyksj.model.response.UserAuthLoginResp;
 import com.cyksj.model.response.WxGzhQrCodeTicketRep;
 import com.cyksj.redis.RedisService;
@@ -587,14 +586,7 @@ public class AuthorizationController {
 
     @PostMapping("/google/login")
     public Result<UserAuthLoginResp> googleLogin(LoginReq loginReq,String credential) throws Exception {
-        log.info("google loginReq:{},credential:{}", loginReq, credential);
-        String result = HttpUtil.post("https://galaxyva.com/8081/api/auth/google/login/inner?credential=" + credential, new HashMap<>());
-        log.info("google result:{}",result);
-        GoogleLoginRep googleLoginRep = Jsons.parseObject(Jsons.toMap(result).get("data"), GoogleLoginRep.class);
-        loginReq.setType(3);
-        loginReq.setEmail(googleLoginRep.getEmail());
-        loginReq.setSubject(googleLoginRep.getSubject());
-        User user = userService.webLogin(loginReq, request);
+        User user = userService.googleLogin(loginReq, credential, request);
 
         Optional.ofNullable(user.getIsBlack())
                 .ifPresent(black -> {