增加防御代码，防止恶意攻击

jshERP-boot/src/main/java/com/jsh/erp/service/log/LogService.java

@@ -148,15 +148,23 @@ public class LogService {
         try{
             Long userId = userService.getUserId(request);
             if(userId!=null) {
-                Log log = new Log();
-                log.setUserId(userId);
-                log.setOperation(moduleName);
-                log.setClientIp(getLocalIp(request));
-                log.setCreateTime(new Date());
-                Byte status = 0;
-                log.setStatus(status);
-                log.setContent(content);
-                logMapper.insertSelective(log);
+                String clientIp = getLocalIp(request);
+                String createTime = Tools.getNow3();
+                Long count = logMapperEx.getCountByIpAndDate(clientIp, createTime);
+                if(count > 0) {
+                    //如果某1个IP在同1秒内连续操作两遍，此时需要删除该redis记录，使其退出，防止恶意攻击
+                    redisService.deleteObjectByKeyAndIp("clientIp", clientIp, "userId");
+                } else {
+                    Log log = new Log();
+                    log.setUserId(userId);
+                    log.setOperation(moduleName);
+                    log.setClientIp(getLocalIp(request));
+                    log.setCreateTime(new Date());
+                    Byte status = 0;
+                    log.setStatus(status);
+                    log.setContent(content);
+                    logMapper.insertSelective(log);
+                }
             }
         }catch(Exception e){
             JshException.writeFail(logger, e);

jshERP-boot/src/main/java/com/jsh/erp/service/redis/RedisService.java

@@ -10,6 +10,7 @@ import org.springframework.stereotype.Component;
 
 import javax.annotation.Resource;
 import javax.servlet.http.HttpServletRequest;
+import java.util.Set;
 import java.util.concurrent.TimeUnit;
 
 /**
@@ -96,11 +97,24 @@ public class RedisService {
         }
     }
 
-    public Long getTenantId(HttpServletRequest request) {
-        if(getObjectFromSessionByKey(request,"tenantId")!=null) {
-            return Long.parseLong(getObjectFromSessionByKey(request, "tenantId").toString());
-        } else {
-            return null;
+    /**
+     * @author jisheng hua
+     * description:
+     *  将信息从redis中移除，比对key和ip
+     *@date: 2021/08/21 22:10
+     * @Param: request
+     * @Param: key
+     * @Param: ip
+     * @Param: deleteKey
+     * @return Object
+     */
+    public void deleteObjectByKeyAndIp(String key, String ip, String deleteKey){
+        Set<String> tokens = redisTemplate.keys("*");
+        for(String token : tokens) {
+            Object value = redisTemplate.opsForHash().get(token, key);
+            if(value!=null && value.equals(ip)) {
+                redisTemplate.opsForHash().delete(token, deleteKey);
+            }
         }
     }
 }