修复渗透bug

hcp-app/src/main/java/com/yingyangfly/app/controller/AppUpgradeRecordController.java

@@ -44,9 +44,8 @@ public class AppUpgradeRecordController {
     public ResultResponse selectNewVersion(Integer versionCode){
 
         AppUpgradeRecord appUpgradeRecord =appUpgradeRecordService.selectNewVersion(versionCode);
-        AppUpgradeRecordVo appUpgradeRecordVo = new AppUpgradeRecordVo();
 
-        BeanUtils.copyProperties(appUpgradeRecordVo,appUpgradeRecord);
+        AppUpgradeRecordVo appUpgradeRecordVo = EntityConverter.convertToTarget(appUpgradeRecord, AppUpgradeRecordVo.class);
 
         return ResultResponse.success(appUpgradeRecordVo);
 

hcp-app/src/main/java/com/yingyangfly/app/controller/MedicalConsultationController.java

@@ -12,10 +12,7 @@ import com.yingyangfly.core.enums.OperatorType;
 import com.yingyangfly.core.service.MedicalConsultationService;
 import com.yingyangfly.core.service.impl.SysUserService;
 import com.yingyangfly.core.util.EntityConverter;
-import com.yingyangfly.core.vo.ConsultationDetailsVo;
-import com.yingyangfly.core.vo.MedicalConsultationAppVo;
-import com.yingyangfly.core.vo.MedicalConsultationVo;
-import com.yingyangfly.core.vo.SysUserVo;
+import com.yingyangfly.core.vo.*;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import org.assertj.core.util.Lists;
@@ -57,7 +54,8 @@ public class MedicalConsultationController {
             return ResultResponse.success(Lists.newArrayList());
         }
         List<SysUser> sysUsers = sysUserService.getAppRecommendDoctor(list.stream().map(m->m.getSysUserId()).collect(Collectors.toSet()),null);
-        Map<Long,SysUser> sysUserMap = sysUsers.stream().collect(Collectors.toMap(SysUser::getId,obj->obj,(key1,key2) ->key1));
+        List<MedicalConsultationSysUserVo> medicalConsultationSysUserVoList = EntityConverter.convertList(sysUsers, MedicalConsultationSysUserVo.class);
+        Map<Long,MedicalConsultationSysUserVo> sysUserMap = medicalConsultationSysUserVoList.stream().collect(Collectors.toMap(MedicalConsultationSysUserVo::getId,obj->obj,(key1,key2) ->key1));
         List<MedicalConsultationAppVo> medicalConsultationAppVoes = list.stream().map(m->{
             MedicalConsultationAppVo vo = BeanUtil.toBean(m,MedicalConsultationAppVo.class);
             vo.setDoctor(sysUserMap.get(vo.getSysUserId()));
@@ -72,12 +70,12 @@ public class MedicalConsultationController {
     @PostMapping("/recommend_doctor")
     @ApiOperation("推荐医生列表")
     @TraceLog
-    public ResultResponse<List<SysUserVo>> recommendDoctors() {
+    public ResultResponse<List<MedicalConsultationSysUserVo>> recommendDoctors() {
         List<MedicalConsultation> list = medicalConsultationService.getAppList();
         Set<Long> notin = list.stream().map(m->m.getSysUserId()).collect(Collectors.toSet());
         List<SysUser> appRecommendDoctor = sysUserService.getAppRecommendDoctor(null, notin);
 
-        List<SysUserVo> sysUserVos = EntityConverter.convertList(appRecommendDoctor, SysUserVo.class);
+        List<MedicalConsultationSysUserVo> sysUserVos = EntityConverter.convertList(appRecommendDoctor, MedicalConsultationSysUserVo.class);
         return ResultResponse.success(sysUserVos);
     }
 
@@ -85,10 +83,10 @@ public class MedicalConsultationController {
     @PostMapping("/doctor/detail")
     @ApiOperation("医生详情")
     @TraceLog
-    public ResultResponse<SysUser> doctorDetail(@RequestBody @Valid IdDto dto) {
+    public ResultResponse<MedicalConsultationSysUserVo> doctorDetail(@RequestBody @Valid IdDto dto) {
         SysUser appDoctorDetail = sysUserService.getAppDoctorDetail(dto.getId());
 
-        SysUserVo sysUserVo = EntityConverter.convertToTarget(appDoctorDetail, SysUserVo.class);
+        MedicalConsultationSysUserVo sysUserVo = EntityConverter.convertToTarget(appDoctorDetail, MedicalConsultationSysUserVo.class);
 
         return ResultResponse.success(sysUserVo);
     }

hcp-app/src/main/java/com/yingyangfly/app/controller/UploadFileController.java

@@ -14,6 +14,9 @@ import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
 
+import java.util.Arrays;
+import java.util.List;
+
 /**
  *
  * @author jiangqian
@@ -28,6 +31,9 @@ public class UploadFileController {
     @Autowired
     private FileClient fileClient;
 
+    // 允许上传的文件类型
+    private static final List<String> ALLOWED_FILE_TYPES = Arrays.asList("png", "jpg", "jpeg", "doc", "xls", "ppt", "mp4", "pdf");
+
 
     /**
      * 通用上传
@@ -38,6 +44,19 @@ public class UploadFileController {
     @PostMapping("/upload")
     @ApiOperation("文件上传")
     public ResultResponse upload(@RequestParam("file") MultipartFile file, @RequestParam("dirName") String dirName) {
+        if (file.isEmpty()) {
+            return ResultResponse.fail("文件不能为空");
+        }
+        String fileName = file.getOriginalFilename();
+        if (fileName == null) {
+            return ResultResponse.fail("文件名不能为空");
+        }
+        // 获取文件后缀
+        String fileExtension = fileName.substring(fileName.lastIndexOf(".") + 1).toLowerCase();
+        // 检查文件类型是否允许
+        if (!ALLOWED_FILE_TYPES.contains(fileExtension)) {
+            return ResultResponse.fail("不允许的文件类型: " + fileExtension);
+        }
         String upload = fileClient.upload(file, dirName);
         return ResultResponse.success(upload);
     }

hcp-app/src/main/java/com/yingyangfly/app/util/BaiduVoiceUtil.java

@@ -59,7 +59,7 @@ public class BaiduVoiceUtil {
         HashMap<String, Object> options = new HashMap<String, Object>();
         options.put("spd", "5");
         options.put("pit", "5");
-        options.put("per", "4");
+        options.put("per", "0");
         TtsResponse res = client.synthesis(voiceMsg, "zh", 1, options);
         byte[] data = res.getData();
         if(data == null){

hcp-app/src/main/resources/application-dev.yml

@@ -22,7 +22,7 @@ spring:
   datasource:
     type: com.alibaba.druid.pool.DruidDataSource
     name: master
-    url: jdbc:mysql://47.93.254.212:3306/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
+    url: jdbc:mysql://47.93.254.212:3485/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
     username: root
     password: SkyMedic$240307
     driver-class-name: com.mysql.cj.jdbc.Driver
@@ -97,6 +97,35 @@ yingyang:
   security:
     check-pwd: false
 
+security:
+  ignored:
+    urls: #安全路径白名单
+      - /swagger-ui/
+      - /swagger-resources/**
+      - /v2/**
+      - /doc.html
+      - /**/*.html
+      - /**/*.js
+      - /**/*.css
+      - /**/*.png
+      - /**/*.map
+      - /favicon.ico
+      - /actuator/**
+      - /druid/**
+      - /app/login
+      - /app/register
+      - /app/login
+      - /app/loginMsg
+      - /app/getCheckCode
+      - /app/loginMsg
+      - /app/logout
+      - /info
+      - /logout
+      - /pub/app/**
+      - /app/task/**
+      - /im/**
+      - /game_voice/**
+
 baidu:
   appId: 55480265
   apiKey: px002Mxrj5K2CGyanMoQUcZU

hcp-app/src/main/resources/application-prod.yml

@@ -0,0 +1,131 @@
+server:
+  port: 8110
+  servlet:
+    context-path: /
+spring:
+  application:
+    name: hcp-app
+  data:
+    mongodb:
+      authentication-database: admin
+      database: hcp-dev
+      host: 47.93.254.212
+      port: 3717
+      username: root
+      password: SkyMedic$240307
+  servlet:
+    multipart:
+      # 单个文件大小
+      max-file-size:  10MB
+      # 设置总上传的文件大小
+      max-request-size:  50MB
+  datasource:
+    type: com.alibaba.druid.pool.DruidDataSource
+    name: master
+    url: jdbc:mysql://47.93.254.212:3485/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
+    username: root
+    password: SkyMedic$240307
+    driver-class-name: com.mysql.cj.jdbc.Driver
+    filters: stat
+    maxActive: 100
+    initialSize: 3
+    maxWait: 60000
+    minIdle: 3
+    timeBetweenEvictionRunsMillis: 60000
+    minEvictableIdleTimeMillis: 300000
+    validationQuery: select 'x' FROM DUAL
+    testWhileIdle: true
+    testOnBorrow: false
+    testOnReturn: false
+    poolPreparedStatements: true
+    maxOpenPreparedStatements: 20
+  jackson:
+    # 全局json时间格式化
+    date-format: yyyy-MM-dd HH:mm:ss
+    time-zone: GMT+8
+#redis
+redis:
+  host: 47.93.254.212
+  port: 6379
+  timeout: 3000
+  password: SkyMedic$240307
+  database: 1 #默认0
+  poolMaxIdle: 256
+  poolMaxTotal: 100
+  poolMaxWait: 5000
+# token配置
+jwt:
+  tokenHeader: userToken
+  tokenPrefix: Bearer
+  secret: 123456
+  expiration: 604800
+  rememberExpiration: 604800
+
+mybatis-plus:
+  config-location: classpath:mybatis-config.xml
+  mapper-locations: classpath*:mapper/*Mapper.xml
+  type-aliases-package: com.yingyangfly.**.domain
+# 日志级别设置为DEBUG
+logging:
+  level:
+    root: DEBUG
+
+
+oss:
+  access-key-id: LTAI5tCEQ1So2i2GehVRk6Er
+  access-key-secret: Ju8eTnJdHa6nZJuDPfee2eQJQvuVuw
+  bucket-name: hcp-yaorong
+  endpoint:  oss-cn-beijing.aliyuncs.com #填写自己oss endpoint
+  outDomain: https://yaorongoss.yaorongmedical.com #填写自己oss 外网域名
+
+live:
+  stream: 187278.push.tlivecloud.com
+  broadcast: pull.dustlee.com
+  time-expand: 1440
+  key: ZySdM7afXBAhP6XGkpjT
+  livekey: TENYsAdNFfFwYJ2XiMWW
+  secretid: AKIDBLvFQWglgSGvU0QfibKsGbosmV1AIMCo
+  secretkey: XzeDeu03349B2iEWjy8xV4WxKYinhXCz
+vod:
+  secretid: AKIDBLvFQWglgSGvU0QfibKsGbosmV1AIMCo
+  secretkey: XzeDeu03349B2iEWjy8xV4WxKYinhXCz
+  subappid: 1300835310
+im:
+  sdkappid: 1400823270
+  secretkey: 227a119d8a54da08ad0ea2b96f006d1cddf933e0a57e0f517e691ce055722720
+yingyang:
+  security:
+    check-pwd: false
+
+security:
+  ignored:
+    urls: #安全路径白名单
+      - /**/*.html
+      - /**/*.js
+      - /**/*.css
+      - /**/*.png
+      - /**/*.map
+      - /favicon.ico
+      - /actuator/**
+      - /druid/**
+      - /app/login
+      - /app/register
+      - /app/login
+      - /app/loginMsg
+      - /app/getCheckCode
+      - /app/loginMsg
+      - /app/logout
+      - /info
+      - /logout
+      - /pub/app/**
+      - /app/task/**
+      - /im/**
+      - /game_voice/**
+
+baidu:
+  appId: 55480265
+  apiKey: px002Mxrj5K2CGyanMoQUcZU
+  secretKey: hiD6uuvNgRchMF0WVK3GN4bMxcmkq9Zt
+query-daily-trai: https://yaorong.yaorongmedical.com/h5-training-daily/index.html
+
+review-task-space: 30

hcp-core/src/main/java/com/yingyangfly/core/domain/GameUser.java

@@ -1,4 +1,5 @@
 package com.yingyangfly.core.domain;
+import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 import lombok.experimental.Accessors;
 
@@ -14,10 +15,13 @@ public class GameUser {
 
     private String userName;
 
+    @ApiModelProperty(value = "游戏编码")
     private String gameCode;
 
+    @ApiModelProperty(value = "游戏类型（字典维护）")
     private String gameType;
 
+    @ApiModelProperty(value = "游戏url")
     private String gameUrl;
 
     private String orgCode;
@@ -28,8 +32,10 @@ public class GameUser {
 
     private Date updateTime;
 
+    @ApiModelProperty(value = "游戏名字")
     private String gameName;
 
+    @ApiModelProperty(value = "总关卡")
     private Integer totalNum;
 
     private Integer currentLevel;
@@ -38,11 +44,15 @@ public class GameUser {
 
     private String playClass;
     //关卡时间
+    @ApiModelProperty(value = "游戏时长(分钟)")
     private Integer gameDuration;
     //难易程度速率
+    @ApiModelProperty(value = "游戏简易程度速率")
     private String gameDifficultyRate;
     //游戏困难度
+    @ApiModelProperty(value = "游戏简易程度")
     private String gameDifficulty;
     //游戏封面
+    @ApiModelProperty(value = "封面图")
     private String gameCoverImage;
 }

hcp-core/src/main/java/com/yingyangfly/core/enums/MsgTemplateEnums.java

@@ -9,7 +9,7 @@ public enum MsgTemplateEnums {
     /**
      * 登录验证码
      */
-    GET_CHECK_CODE("CHECK_CODE", "SMS_463632004");
+    GET_CHECK_CODE("CHECK_CODE", "SMS_470270053");
     private final String name;
     private final String tempalteCode;
 

hcp-core/src/main/java/com/yingyangfly/core/mapper/GameMapper.java

@@ -3,6 +3,7 @@ package com.yingyangfly.core.mapper;
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.yingyangfly.core.domain.Game;
 import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Select;
 
 /**
  * 游戏表(Game)表数据库访问层
@@ -12,5 +13,8 @@ import org.apache.ibatis.annotations.Mapper;
 @Mapper
 public interface GameMapper extends BaseMapper<Game> {
 
+    @Select("SELECT id, game_code, game_type, game_url, game_name, game_duration, game_difficulty, game_difficulty_rate, game_video_url, status, org_name, desn, game_cover_image, total_num, game_background_image, game_inbetween_image, game_short_desn, full_flag, frame_img, create_by, create_time, update_by, update_time, org_code FROM game ORDER BY CAST(game_code AS UNSIGNED) DESC LIMIT 1")
+    Game selectMaxGameCode();
+
 }
 

hcp-core/src/main/java/com/yingyangfly/core/security/filter/JwtAuthenticationFilter.java

@@ -5,11 +5,14 @@ import com.yingyangfly.common.dto.ResultResponse;
 import com.yingyangfly.core.enums.RedisStatusEnums;
 import com.yingyangfly.core.security.util.JwtUtil;
 import com.yingyangfly.core.security.util.TokenUtil;
+import com.yingyangfly.core.util.Sha256WithSaltUtils;
 import com.yingyangfly.redis.client.RedisClient;
+import jodd.net.HttpMethod;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.web.filter.OncePerRequestFilter;
@@ -20,6 +23,7 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.security.NoSuchAlgorithmException;
 
 /**
  * @author: jiangqian
@@ -30,6 +34,7 @@ import java.io.IOException;
 @Slf4j
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
+    public static final String UJNHYTGHYUJHYUYH = "ujnhytghyujhyuyh";
     @Autowired
     JwtUtil jwtUtil;
     @Autowired
@@ -46,6 +51,30 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
         String authHeader = request.getHeader(jwtUtil.getJwtProperties().getTokenHeader());
+        String authTimestamp = request.getHeader("timestamp");
+        String sign = request.getHeader("sign");
+        if (StringUtils.isEmpty(authTimestamp) || StringUtils.isEmpty(sign)){
+            handleUnauthorized(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"无效的请求");
+            return;
+        }
+        Long timestamp = Long.parseLong(authTimestamp);
+        timestamp += 60000;
+        Long currentTimeMillis = System.currentTimeMillis();
+        if (timestamp < currentTimeMillis){
+            handleUnauthorized(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"无效的请求");
+            return;
+        }
+
+        String hash = "";
+        if (StringUtils.isEmpty(authHeader)){
+            hash = Sha256WithSaltUtils.hashWithSalt(authTimestamp);
+        }else {
+            hash = Sha256WithSaltUtils.hashWithSalt(authTimestamp+authHeader);
+        }
+        if (!sign.equals(hash)){
+            handleUnauthorized(response,HttpServletResponse.SC_INTERNAL_SERVER_ERROR,"无效的请求");
+            return;
+        }
         String authToken = tokenUtil.getAuthToken(authHeader);
         String username = jwtUtil.getUserNameFromToken(authToken);
         if(tokenUtil.getAuthentication() != null || StringUtils.isBlank(username)){

hcp-core/src/main/java/com/yingyangfly/core/service/impl/AppUserService.java

@@ -18,6 +18,7 @@ import com.yingyangfly.common.utils.DateUtils;
 import com.yingyangfly.core.api.ImApi;
 import com.yingyangfly.core.domain.*;
 import com.yingyangfly.core.dto.*;
+import com.yingyangfly.core.enums.MsgTemplateEnums;
 import com.yingyangfly.core.enums.RedisStatusEnums;
 import com.yingyangfly.core.enums.StatusEnums;
 import com.yingyangfly.core.mapper.*;
@@ -26,6 +27,7 @@ import com.yingyangfly.core.security.util.TokenUtil;
 import com.yingyangfly.core.service.*;
 import com.yingyangfly.core.util.AmountUtils;
 import com.yingyangfly.core.util.Sm4Util;
+import com.yingyangfly.core.util.SmgUtil;
 import com.yingyangfly.redis.client.RedisClient;
 import lombok.extern.slf4j.Slf4j;
 import org.assertj.core.util.Sets;
@@ -486,7 +488,20 @@ public class AppUserService extends ServiceImpl<AppUserMapper, AppUser> implemen
         if (StringUtils.isEmpty(checkCodeRedis)) {
             return ResultResponse.fail("验证码已经过期");
         }
+        String errorNumKey = "app:error:num:"+mobile;
+        String errorNumRedis = redisClient.get(errorNumKey, "");
+        if (ObjectUtils.isNotNull(errorNumRedis)){
+            if (Integer.parseInt(errorNumRedis) >= 3){
+                return ResultResponse.fail("验证码错误了3次,账户锁定10分钟");
+            }
+        }
         if (!checkCodeRedis.equals(checkCode)) {
+            Integer errorNum = 0;
+            if (ObjectUtils.isNotNull(errorNumRedis)){
+                errorNum = Integer.parseInt(errorNumRedis);
+            }
+            errorNum++;
+            redisClient.set(errorNumKey,String.valueOf(errorNum),600);
             return ResultResponse.fail("验证码输入错误");
         }
         String encrypt = Sm4Util.encrypt(mobile);
@@ -522,6 +537,11 @@ public class AppUserService extends ServiceImpl<AppUserMapper, AppUser> implemen
     }
 
     public ResultResponse getCheckCode(String mobile) {
+        String redisKey = "hcp:sms:mobile:" + mobile;
+        String checkCodeRedis = redisClient.get(redisKey, "");
+        if (!StringUtils.isEmpty(checkCodeRedis)) {
+            return ResultResponse.fail("请不要频繁发送验证码");
+        }
         String encrypt = Sm4Util.encrypt(mobile);
         AppUser appUser = this.selectByMobile(encrypt,"0");
         if (appUser == null) {
@@ -529,10 +549,12 @@ public class AppUserService extends ServiceImpl<AppUserMapper, AppUser> implemen
         }
         Random rand = new Random();
         int randomNumber = rand.nextInt(1000000);
-        String random = "123456";//String.format("%06d", randomNumber);
+        String random = String.format("%06d", randomNumber);
         //6位随机数
-        Boolean isSuccess = true;//SmgUtil.sendCheckCode(mobile, MsgTemplateEnums.GET_CHECK_CODE.getTempalteCode(), random);
+        Boolean isSuccess = SmgUtil.sendCheckCode(mobile, MsgTemplateEnums.GET_CHECK_CODE.getTempalteCode(), random);
         if (isSuccess) {
+            // 防机器
+            redisClient.set("hcp:sms:mobile:"+mobile,random,60);
             //存入redis
             redisClient.set("hcp:mobile:" + mobile, random, 120);
             return ResultResponse.success();

hcp-core/src/main/java/com/yingyangfly/core/service/impl/GameServiceImpl.java

@@ -127,26 +127,32 @@ public class GameServiceImpl extends ServiceImpl<GameMapper, Game> implements Ga
         return map;
     }
 
+    @Transactional(rollbackFor = Exception.class)
     @Override
     public boolean saveGame(Game game) {
         if(game.getId() == null){
             game.setId(IdWorker.getId());
-            Game gameDb = this.getOne(new LambdaQueryWrapper<Game>().orderByDesc(Game::getGameCode).last("limit 1"));
+            Game gameDb = gameMapper.selectMaxGameCode();
             Integer gamecode = Integer.parseInt(gameDb.getGameCode())+1;
             game.setGameCode(String.valueOf(gamecode));
             game.setStatus(StatusEnums.OK.getIntCode());
-            game.setGameDuration(game.getGameDuration()*60);
             return save(game);
         }
         Game gameUpdate = this.getById(game.getId());
         if (ObjectUtils.isNotNull(gameUpdate)){
-            if (gameUpdate.getTotalNum() != game.getTotalNum()){
-                GameUser gameUser = new GameUser();
-                gameUser.setTotalNum(game.getTotalNum());
-                LambdaQueryWrapper<GameUser> wrapper = new LambdaQueryWrapper<>();
-                wrapper.eq(GameUser::getGameCode,gameUpdate.getGameCode());
-                gameUserMapper.update(gameUser,wrapper);
-            }
+            GameUser gameUser = new GameUser();
+            gameUser.setTotalNum(game.getTotalNum());
+            gameUser.setGameType(game.getGameType());
+            gameUser.setGameUrl(game.getGameUrl());
+            gameUser.setGameName(game.getGameName());
+            gameUser.setGameDuration(game.getGameDuration());
+            gameUser.setGameDifficultyRate(game.getGameDifficultyRate());
+            gameUser.setGameDifficulty(game.getGameDifficulty());
+            gameUser.setGameCoverImage(game.getGameCoverImage());
+            LambdaQueryWrapper<GameUser> wrapper = new LambdaQueryWrapper<>();
+            wrapper.eq(GameUser::getGameCode,gameUpdate.getGameCode());
+            gameUserMapper.update(gameUser,wrapper);
+
         }
         return saveOrUpdate(game);
     }

hcp-core/src/main/java/com/yingyangfly/core/service/impl/MedicalConsultationServiceImpl.java

@@ -23,7 +23,9 @@ import com.yingyangfly.core.domain.MedicalConsultation;
 import com.yingyangfly.core.security.util.TokenUtil;
 import com.yingyangfly.core.service.*;
 import com.yingyangfly.core.util.AmountUtils;
+import com.yingyangfly.core.util.EntityConverter;
 import com.yingyangfly.core.vo.MedicalConsultationAppVo;
+import com.yingyangfly.core.vo.MedicalConsultationSysUserVo;
 import com.yingyangfly.core.vo.MedicalConsultationVo;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
@@ -142,7 +144,8 @@ public class MedicalConsultationServiceImpl extends ServiceImpl<MedicalConsultat
         List<MedicalConsultation> list = list(lq);
         return list.stream().map(m->{
             MedicalConsultationAppVo vo = BeanUtil.toBean(m,MedicalConsultationAppVo.class);
-            vo.setDoctor(sysUserService.getAppDoctorDetail(m.getSysUserId()));
+            MedicalConsultationSysUserVo medicalConsultationSysUserVo = EntityConverter.convertToTarget(sysUserService.getAppDoctorDetail(m.getSysUserId()), MedicalConsultationSysUserVo.class);
+            vo.setDoctor(medicalConsultationSysUserVo);
             vo.setIsComment(patientReviewService.isComment(m.getId()));
             return vo;
         }).collect(Collectors.toList());

hcp-core/src/main/java/com/yingyangfly/core/service/impl/SysUserService.java

@@ -27,6 +27,7 @@ import com.yingyangfly.core.service.impl.SysDictDataService;
 import com.yingyangfly.core.service.impl.SysMenuService;
 import com.yingyangfly.core.service.impl.SysOrgService;
 import com.yingyangfly.core.util.CryptoUtil;
+import com.yingyangfly.core.util.PasswordValidator;
 import com.yingyangfly.core.util.Sm4Util;
 import com.yingyangfly.redis.client.RedisClient;
 import lombok.extern.slf4j.Slf4j;
@@ -77,6 +78,10 @@ public class SysUserService extends  ServiceImpl<SysUserMapper,SysUser> {
     public String login(LoginDto dto){
         UserDetails userDetails = loadUserByUsername(dto.getLoginName());
         String passWord = CryptoUtil.decrypt(dto.getPassWord());
+        boolean strongPassword = PasswordValidator.isStrongPassword(passWord);
+        if (!strongPassword){
+            throw new BadCredentialsException("用户密码长度必须大于8位数小于20位数且包含大小写字母，数字，特殊字符(!@#$%^&*)");
+        }
         if(!bCryptPasswordEncoder.matches(passWord,userDetails.getPassword())){
             // 获取错误次数
             String errorVisits = redisClient.get(String.format("%s%s", "syspwd:", dto.getLoginName()), "");

hcp-core/src/main/java/com/yingyangfly/core/util/CryptoUtil.java

@@ -7,8 +7,8 @@ import org.apache.tomcat.util.codec.binary.Base64;
 
 public class CryptoUtil {
 
-    private final static String IV = "1234567890123456";//需要前端与后端配置一致
-    private final static String KEY = "1234567890123456";
+    private final static String IV = "hghthfbdbrhfuehr";//需要前端与后端配置一致
+    private final static String KEY = "fhyredhufrdhyrfb";
 
     /**
      * 加密算法，使用默认的IV、KEY

hcp-core/src/main/java/com/yingyangfly/core/util/Sha256WithSaltUtils.java

@@ -0,0 +1,41 @@
+package com.yingyangfly.core.util;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class Sha256WithSaltUtils {
+
+    private static String SHA256_KEY = "ujnhytghyujhyuyh";
+
+    /**
+     * 使用SHA-256算法和盐对密码进行哈希处理
+     *
+     * @param input 需要哈希的密码
+     * @return 哈希值（十六进制字符串）
+     */
+    public static String hashWithSalt(String input) {
+        try {
+            input = input+SHA256_KEY;
+            // 获取SHA-256 MessageDigest实例
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+
+            // 将输入字符串转换为字节数组，并使用指定的字符编码（此处为UTF-8）
+            byte[] encodedhash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
+
+            // 将字节数组转换为十六进制字符串
+            StringBuilder hexString = new StringBuilder(2 * encodedhash.length);
+            for (byte b : encodedhash) {
+                String hex = Integer.toHexString(0xff & b);
+                if (hex.length() == 1) hexString.append('0');
+                hexString.append(hex);
+            }
+
+            return hexString.toString();
+        } catch (NoSuchAlgorithmException e) {
+            // SHA-256应该总是可用的，但如果发生这种情况，则抛出运行时异常
+            throw new RuntimeException(e);
+        }
+    }
+
+}

hcp-core/src/main/java/com/yingyangfly/core/util/SmgUtil.java

@@ -1,5 +1,10 @@
 package com.yingyangfly.core.util;
 import com.alibaba.fastjson2.JSON;
+import com.aliyun.dysmsapi20170525.Client;
+import com.aliyun.dysmsapi20170525.models.SendSmsRequest;
+import com.aliyun.dysmsapi20170525.models.SendSmsResponse;
+import com.aliyun.teaopenapi.models.Config;
+import com.aliyun.teautil.models.RuntimeOptions;
 import lombok.extern.slf4j.Slf4j;
 
 import java.util.HashMap;
@@ -15,32 +20,35 @@ import java.util.concurrent.CompletableFuture;
 @Slf4j
 public class SmgUtil {
 
-    private static String accessKeyId="阿里云短信key";
-    private static String accessKeySecret= "阿里云短信秘钥";
+    private static String accessKeyId="LTAI5tGsZvk88BcginPSQkVK";
+    private static String accessKeySecret= "mnq2hkIw7HPdi33ByO09Avv4Wa8991";
 
-    private static com.aliyun.dysmsapi20170525.Client createClient(String accessKeyId, String accessKeySecret) throws Exception {
-        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
+    private static Client createClient(String accessKeyId, String accessKeySecret) throws Exception {
+        Config config = new Config()
                 .setAccessKeyId(accessKeyId)
                 .setAccessKeySecret(accessKeySecret);
         // Endpoint 请参考 https://api.aliyun.com/product/Dysmsapi
         config.endpoint = "dysmsapi.aliyuncs.com";
-        return new com.aliyun.dysmsapi20170525.Client(config);
+        return new Client(config);
     }
 
+//    public static void main(String[] args) {
+//        sendCheckCode("18501093738","SMS_470270053","125874");
+//    }
 
     public static Boolean sendCheckCode(String mobile, String templateCode, String random) {
         try {
             log.info("<<<<<<<<<<<<<<调用阿里云参数手机:{}，模板:{}>>>>>>>>>>>>",mobile,templateCode);
-            com.aliyun.dysmsapi20170525.Client client = createClient(accessKeyId,accessKeySecret);
-            com.aliyun.dysmsapi20170525.models.SendSmsRequest sendSmsRequest = new com.aliyun.dysmsapi20170525.models.SendSmsRequest();
-            sendSmsRequest.setSignName("鹰扬科技");
+            Client client = createClient(accessKeyId,accessKeySecret);
+            SendSmsRequest sendSmsRequest = new SendSmsRequest();
+            sendSmsRequest.setSignName("长沙耀荣科技有限公司");
             sendSmsRequest.setPhoneNumbers(mobile);
             sendSmsRequest.setTemplateCode(templateCode);
             Map<String,Object> map =new HashMap<>();
             map.put("code",random);
             sendSmsRequest.setTemplateParam(JSON.toJSONString(map));
-            com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
-            com.aliyun.dysmsapi20170525.models.SendSmsResponse resp = client.sendSmsWithOptions(sendSmsRequest, runtime);
+            RuntimeOptions runtime = new RuntimeOptions();
+            SendSmsResponse resp = client.sendSmsWithOptions(sendSmsRequest, runtime);
             log.info("<<<<<<<<<<<<<<<<调用阿里云短信响应:{}>>>>>>>>>>>>>>>>", JSON.toJSONString(resp));
             if(resp.getStatusCode()==200 && "OK".equals(resp.getBody().getCode())){
                 return true;

hcp-core/src/main/java/com/yingyangfly/core/vo/MedicalConsultationAppVo.java

@@ -13,6 +13,6 @@ import lombok.Data;
 @Data
 public class MedicalConsultationAppVo extends MedicalConsultation {
     @ApiModelProperty("医生信息")
-    private SysUser doctor;
+    private MedicalConsultationSysUserVo doctor;
 
 }

hcp-core/src/main/java/com/yingyangfly/core/vo/MedicalConsultationSysUserVo.java

@@ -0,0 +1,65 @@
+package com.yingyangfly.core.vo;
+
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.yingyangfly.core.util.Sm4JacksonSerialize;
+import io.swagger.annotations.ApiModelProperty;
+import lombok.Data;
+
+@Data
+public class MedicalConsultationSysUserVo {
+
+    @ApiModelProperty(value = "用户ID")
+    @TableId(value = "id")
+    private Long id;
+    @ApiModelProperty(value = "用户账号")
+    private String userName;
+    @ApiModelProperty(value = "用户昵称")
+    private String nickName;
+    @ApiModelProperty(value = "用户邮箱")
+    private String email;
+    @ApiModelProperty(value = "手机号码")
+    private String mobile;
+    @ApiModelProperty(value = "用户性别（0男 1女 2未知）")
+    private String sex;
+    @ApiModelProperty(value = "头像地址")
+    private String avatar;
+    @ApiModelProperty(value = "密码")
+    private String password;
+    @ApiModelProperty(value = "帐号状态（0正常 1停用 2删除）")
+    private String status;
+    @ApiModelProperty(value = "备注")
+    private String remark;
+    @ApiModelProperty(value = "用户关联的所有的角色，用逗号分隔")
+    private String roleCodes;
+    @ApiModelProperty(value = "机构名字")
+    private String orgName;
+    @ApiModelProperty(value = "所属部门")
+    private String departmentName;
+    @ApiModelProperty(value = "职称")
+    private String title;
+    @ApiModelProperty(value = "单价")
+    private Double price;
+    @ApiModelProperty(value = "擅长")
+    private String speciality;
+    @ApiModelProperty(value = "医生资格证")
+    private String certificate;
+    @ApiModelProperty(value = "是否在线 0是 1否")
+    private Integer isOnline;
+    @ApiModelProperty(value = "问诊量")
+    private Integer consultationTotal;
+    @ApiModelProperty(value = "好评率")
+    private Double goodRate;
+    @ApiModelProperty(value = "身份证号")
+    private String idCard;
+
+    private java.util.Date createTime;
+    private java.util.Date updateTime;
+
+    private java.lang.String orgCode;
+    @com.baomidou.mybatisplus.annotation.TableField(exist = false)
+    private java.lang.Integer page;
+    @com.baomidou.mybatisplus.annotation.TableField(exist = false)
+    private java.lang.Integer limit;
+
+}

hcp-large-screen/src/main/resources/application-dev.yml

@@ -22,9 +22,9 @@ spring:
   datasource:
     type: com.alibaba.druid.pool.DruidDataSource
     name: master
-    url: jdbc:mysql://47.93.254.212:3306/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
+    url: jdbc:mysql://localhost:3306/hcp0524?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
     username: root
-    password: SkyMedic$240307
+    password: root
     driver-class-name: com.mysql.cj.jdbc.Driver
     filters: stat
     maxActive: 100
@@ -96,6 +96,34 @@ yingyang:
   security:
     check-pwd: false
 
+
+security:
+  ignored:
+    urls: #安全路径白名单
+      - /swagger-ui/
+      - /swagger-resources/**
+      - /v2/**
+      - /doc.html
+      - /**/*.html
+      - /**/*.js
+      - /**/*.css
+      - /**/*.png
+      - /**/*.map
+      - /favicon.ico
+      - /actuator/**
+      - /druid/**
+      - /app/register
+      - /large-screen/login
+      - /large-screen/loginMsg
+      - /large-screen/getCheckCode
+      - /large-screen/logout
+      - /info
+      - /pub/app/**
+      - /app/task/**
+      - /im/**
+      - /game_voice/**
+      - /home/index
+
 baidu:
   appId: 55480265
   apiKey: px002Mxrj5K2CGyanMoQUcZU

hcp-large-screen/src/main/resources/application-prod.yml

@@ -0,0 +1,128 @@
+server:
+  port: 8112
+  servlet:
+    context-path: /
+spring:
+  application:
+    name: hcp-large-screen
+  servlet:
+    multipart:
+      # 单个文件大小
+      max-file-size:  10MB
+      # 设置总上传的文件大小
+      max-request-size:  50MB
+  data:
+    mongodb:
+      authentication-database: admin
+      database: hcp-dev
+      host: 47.93.254.212
+      port: 3717
+      username: root
+      password: SkyMedic$240307
+  datasource:
+    type: com.alibaba.druid.pool.DruidDataSource
+    name: master
+    url: jdbc:mysql://47.93.254.212:3485/hcp0524?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
+    username: root
+    password: root
+    driver-class-name: com.mysql.cj.jdbc.Driver
+    filters: stat
+    maxActive: 100
+    initialSize: 3
+    maxWait: 60000
+    minIdle: 3
+    timeBetweenEvictionRunsMillis: 60000
+    minEvictableIdleTimeMillis: 300000
+    validationQuery: select 'x' FROM DUAL
+    testWhileIdle: true
+    testOnBorrow: false
+    testOnReturn: false
+    poolPreparedStatements: true
+    maxOpenPreparedStatements: 20
+  jackson:
+    # 全局json时间格式化
+    date-format: yyyy-MM-dd HH:mm:ss
+    time-zone: GMT+8
+#redis
+redis:
+  host: 47.93.254.212
+  port: 6379
+  timeout: 3000
+  password: SkyMedic$240307
+  database: 1 #默认0
+  poolMaxIdle: 256
+  poolMaxTotal: 100
+  poolMaxWait: 5000
+# token配置
+jwt:
+  tokenHeader: userToken
+  tokenPrefix: Bearer
+  secret: 123456
+  expiration: 604800
+  rememberExpiration: 604800
+
+mybatis-plus:
+  config-location: classpath:mybatis-config.xml
+  mapper-locations: classpath*:mapper/*Mapper.xml
+  type-aliases-package: com.yingyangfly.**.domain
+# 日志级别设置为DEBUG
+logging:
+  level:
+    root: DEBUG
+
+
+oss:
+  access-key-id: LTAI5tCEQ1So2i2GehVRk6Er
+  access-key-secret: Ju8eTnJdHa6nZJuDPfee2eQJQvuVuw
+  bucket-name: hcp-yaorong
+  endpoint:  oss-cn-beijing.aliyuncs.com #填写自己oss endpoint
+  outDomain: https://yaorongoss.yaorongmedical.com #填写自己oss 外网域名
+live:
+  stream: 187278.push.tlivecloud.com
+  broadcast: pull.dustlee.com
+  time-expand: 1440
+  key: ZySdM7afXBAhP6XGkpjT
+  livekey: TENYsAdNFfFwYJ2XiMWW
+  secretid: AKIDBLvFQWglgSGvU0QfibKsGbosmV1AIMCo
+  secretkey: XzeDeu03349B2iEWjy8xV4WxKYinhXCz
+vod:
+  secretid: AKIDBLvFQWglgSGvU0QfibKsGbosmV1AIMCo
+  secretkey: XzeDeu03349B2iEWjy8xV4WxKYinhXCz
+  subappid: 1300835310
+im:
+  sdkappid: 1400823270
+  secretkey: 227a119d8a54da08ad0ea2b96f006d1cddf933e0a57e0f517e691ce055722720
+yingyang:
+  security:
+    check-pwd: false
+
+security:
+  ignored:
+    urls: #安全路径白名单
+      - /**/*.html
+      - /**/*.js
+      - /**/*.css
+      - /**/*.png
+      - /**/*.map
+      - /favicon.ico
+      - /actuator/**
+      - /druid/**
+      - /app/register
+      - /large-screen/login
+      - /large-screen/loginMsg
+      - /large-screen/getCheckCode
+      - /large-screen/logout
+      - /info
+      - /pub/app/**
+      - /app/task/**
+      - /im/**
+      - /game_voice/**
+      - /home/index
+
+baidu:
+  appId: 55480265
+  apiKey: px002Mxrj5K2CGyanMoQUcZU
+  secretKey: hiD6uuvNgRchMF0WVK3GN4bMxcmkq9Zt
+query-daily-trai: https://yaorong.yaorongmedical.com/h5-training-daily/index.html
+
+review-task-space: 30

hcp-large-screen/src/main/resources/application.yml

@@ -5,30 +5,3 @@ spring:
 ############################
 #########自定义字段#########
 ###########################
-
-security:
-  ignored:
-    urls: #安全路径白名单
-      - /swagger-ui/
-      - /swagger-resources/**
-      - /v2/**
-      - /doc.html
-      - /**/*.html
-      - /**/*.js
-      - /**/*.css
-      - /**/*.png
-      - /**/*.map
-      - /favicon.ico
-      - /actuator/**
-      - /druid/**
-      - /app/register
-      - /large-screen/login
-      - /large-screen/loginMsg
-      - /large-screen/getCheckCode
-      - /large-screen/logout
-      - /info
-      - /pub/app/**
-      - /app/task/**
-      - /im/**
-      - /game_voice/**
-      - /home/index

hcp-platform/src/main/java/com/yingyangfly/platform/sys/controller/UploadFileController.java

@@ -14,6 +14,8 @@ import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
 import javax.annotation.Resource;
 import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
 
 /**
  *
@@ -29,6 +31,9 @@ public class UploadFileController {
     @Autowired
     private FileClient fileClient;
 
+    // 允许上传的文件类型
+    private static final List<String> ALLOWED_FILE_TYPES = Arrays.asList("png", "jpg", "jpeg", "doc", "xls", "ppt", "mp4", "pdf");
+
     /**
      * 通用上传
      * file 是文件
@@ -38,6 +43,20 @@ public class UploadFileController {
     @PostMapping("/upload")
     @ApiOperation("文件上传")
     public ResultResponse upload(@RequestParam("file") MultipartFile file, @RequestParam("dirName") String dirName) {
+        if (file.isEmpty()) {
+            return ResultResponse.fail("文件不能为空");
+        }
+        String fileName = file.getOriginalFilename();
+        if (fileName == null) {
+            return ResultResponse.fail("文件名不能为空");
+        }
+        // 获取文件后缀
+        String fileExtension = fileName.substring(fileName.lastIndexOf(".") + 1).toLowerCase();
+        // 检查文件类型是否允许
+        if (!ALLOWED_FILE_TYPES.contains(fileExtension)) {
+            return ResultResponse.fail("不允许的文件类型: " + fileExtension);
+        }
+
         String upload = fileClient.upload(file, dirName);
         return ResultResponse.success(upload);
     }

hcp-platform/src/main/resources/application-dev.yml

@@ -22,7 +22,7 @@ spring:
   datasource:
     type: com.alibaba.druid.pool.DruidDataSource
     name: master
-    url: jdbc:mysql://47.93.254.212:3306/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
+    url: jdbc:mysql://47.93.254.212:3485/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
     username: root
     password: SkyMedic$240307
     driver-class-name: com.mysql.cj.jdbc.Driver

hcp-platform/src/main/resources/application-prod.yml

@@ -0,0 +1,120 @@
+server:
+  port: 8111
+  servlet:
+    context-path: /
+spring:
+  application:
+    name: hcp
+  servlet:
+    multipart:
+      # 单个文件大小
+      max-file-size:  100MB
+      # 设置总上传的文件大小
+      max-request-size:  100MB
+  data:
+    mongodb:
+      authentication-database: admin
+      database: hcp-dev
+      host: 47.93.254.212
+      port: 3717
+      username: root
+      password: SkyMedic$240307
+  datasource:
+    type: com.alibaba.druid.pool.DruidDataSource
+    name: master
+    url: jdbc:mysql://47.93.254.212:3485/hcp?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
+    username: root
+    password: SkyMedic$240307
+    driver-class-name: com.mysql.cj.jdbc.Driver
+    filters: stat
+    maxActive: 100
+    initialSize: 3
+    maxWait: 60000
+    minIdle: 3
+    timeBetweenEvictionRunsMillis: 60000
+    minEvictableIdleTimeMillis: 300000
+    validationQuery: select 'x' FROM DUAL
+    testWhileIdle: true
+    testOnBorrow: false
+    testOnReturn: false
+    poolPreparedStatements: true
+    maxOpenPreparedStatements: 20
+  jackson:
+    # 全局json时间格式化
+    date-format: yyyy-MM-dd HH:mm:ss
+    time-zone: GMT+8
+#redis
+redis:
+  host: 47.93.254.212
+  port: 6379
+  timeout: 3000
+  password: SkyMedic$240307
+  database: 1 #默认0
+  poolMaxIdle: 256
+  poolMaxTotal: 100
+  poolMaxWait: 5000
+# token配置
+jwt:
+  tokenHeader: userToken
+  tokenPrefix: Bearer
+  secret: 123456
+  expiration: 604800
+  rememberExpiration: 604800
+
+mybatis-plus:
+  config-location: classpath:mybatis-config.xml
+  mapper-locations: classpath*:mapper/*Mapper.xml
+  type-aliases-package: com.yingyangfly.**.domain
+
+oss:
+  access-key-id: LTAI5tCEQ1So2i2GehVRk6Er
+  access-key-secret: Ju8eTnJdHa6nZJuDPfee2eQJQvuVuw
+  bucket-name: hcp-yaorong
+  endpoint:  oss-cn-beijing.aliyuncs.com #填写自己oss endpoint
+  outDomain: https://yaorongoss.yaorongmedical.com #填写自己oss 外网域名
+wx:
+  app-id: 填写自己微信支付key
+  app-secret: 填写自己微信支付密码
+  pay-url-callback: http://自己微信支付回调:8601/pub/api/wx/pay/appointment/order/callback
+  refund-url-callback: http://自己微信支付退款回调:8601/pub/api/wx/refund/appointment/order/callback
+live:
+  stream: 187278.push.tlivecloud.com
+  broadcast: pull.dustlee.com
+  time-expand: 1440
+  key: ZySdM7afXBAhP6XGkpjT
+  livekey: TENYsAdNFfFwYJ2XiMWW
+  secretid: AKIDBLvFQWglgSGvU0QfibKsGbosmV1AIMCo
+  secretkey: XzeDeu03349B2iEWjy8xV4WxKYinhXCz
+vod:
+  secretid: AKIDBLvFQWglgSGvU0QfibKsGbosmV1AIMCo
+  secretkey: XzeDeu03349B2iEWjy8xV4WxKYinhXCz
+  subappid: 1300835310
+im:
+  sdkappid: 1400823270
+  secretkey: 227a119d8a54da08ad0ea2b96f006d1cddf933e0a57e0f517e691ce055722720
+yingyang:
+  security:
+    check-pwd: true
+security:
+  ignored:
+    urls: #安全路径白名单
+      - /**/*.html
+      - /**/*.js
+      - /**/*.css
+      - /**/*.png
+      - /**/*.map
+      - /favicon.ico
+      - /actuator/**
+      - /druid/**
+      - /login
+      - /register
+      - /info
+      - /logout
+      - /pub/app/**
+      - /callback/**
+      - /im/callback/**
+      - /pay/callback/**/m**
+
+query-daily-trai: https://yaorong.yaorongmedical.com/h5-training-daily/index.html
+
+review-task-space: 30