Merge pull request #43 from hushuo2002/feature-branch

修改了修改密码部分的问题以及下载图片时会遇到的入侵问题

src/main/java/com/yeqifu/sys/controller/FileController.java

@@ -58,8 +58,13 @@ public class FileController {
      * 图片下载
      */
     @RequestMapping("showImageByPath")
-    public ResponseEntity<Object> showImageByPath(String path){
+    public ResponseEntity<byte[]> showImageByPath(String path) {
-        return AppFileUtils.createResponseEntity(path);
+        // 规范路径，防止路径穿越
+        Path normalizedPath = Paths.get(AppFileUtils.UPLOAD_PATH, path).normalize();
+        if (!normalizedPath.startsWith(AppFileUtils.UPLOAD_PATH)) {
+            // 如果路径越界，则返回错误响应
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
     }
 
 }

src/main/java/com/yeqifu/sys/controller/UserController.java

@@ -223,21 +223,25 @@ public class UserController {
      * @param id
      * @return
      */
-    @RequestMapping("resetPwd/{id}")
+    @PreAuthorize("hasRole('ADMIN')") // Ensure only admin users can access this method
-    public ResultObj resetPwd(@PathVariable("id") Integer id){
+    @PostMapping("/resetPwd/{id}")
-        try {
+    public DataGridView resetPwd(@PathVariable Long id, Authentication authentication) {
-            User user = new User();
+        User currentUser = userService.getCurrentUser(authentication); // Get current logged-in user
-            user.setId(id);
+        User targetUser = userService.getById(id); // Find the target user by ID
-            //设置盐  32位(大写英文字母(A-Z)加数字(0-9))
+
-            String salt = IdUtil.simpleUUID().toUpperCase();
+        // Ensure that the user trying to reset is an admin
-            user.setSalt(salt);
+        if (!currentUser.isAdmin()) {
-            //设置密码
+            return new DataGridView("403", "权限不足，无法重置其他用户密码");
-            user.setPwd(new Md5Hash(Constast.USER_DEFAULT_PWD,salt,2).toString());
+        }
-            userService.updateById(user);
+
-            return ResultObj.RESET_SUCCESS;
+        // Reset password logic
-        } catch (Exception e) {
+        Md5Hash newPassword = new Md5Hash("defaultPassword", targetUser.getSalt(), 2);
-            e.printStackTrace();
+        targetUser.setPassword(newPassword.toHex());
-            return ResultObj.RESET_ERROR;
+
+        // Save the updated user
+        userService.updateById(targetUser);
+
+        return new DataGridView("200", "用户密码重置成功");
     }
 }