From b2536992b62d89a313b9d061dcfe67d0680d35ea Mon Sep 17 00:00:00 2001 From: heavyrian2012 Date: Mon, 8 Jun 2026 12:07:38 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E4=BB=B6=E4=B8=8A?= =?UTF-8?q?=E4=BC=A0=E7=9A=84=E8=AE=A4=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../loServer/action/UploadFileAction.java | 23 +++++++++++++------ .../imhandler/GetMediaUploadTokenHandler.java | 20 ++++++++++++---- .../imhandler/GetQiniuUploadTokenHandler.java | 2 +- 3 files changed, 33 insertions(+), 12 deletions(-) diff --git a/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java b/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java index f144fc00..e6742d6b 100755 --- a/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java +++ b/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java @@ -44,8 +44,8 @@ public class UploadFileAction extends Action { } - public static String getToken(int type) { - String signKey = KEY + "|" + (System.currentTimeMillis()) + "|" + type; + public static String getToken(int type, String key) { + String signKey = KEY + "|" + (System.currentTimeMillis()) + "|" + type + "|" + key; try { return DES.encryptDES(signKey); } catch (Exception e) { @@ -55,14 +55,17 @@ public class UploadFileAction extends Action { return null; } - public static int validateToken(String token) throws InvalidateTokenExecption { + public static int validateToken(String token, String[] fileNames) throws InvalidateTokenExecption { try { String signKey = DES.decryptDES(token); String[] parts = signKey.split("\\|"); - if(parts.length == 3) { + if(parts.length >= 3) { if(parts[0].equals(KEY)) { long timestamp = Long.parseLong(parts[1]); if(Math.abs(System.currentTimeMillis() - timestamp) < 2 * 60 * 60 * 1000) { + if(parts.length == 4) { + fileNames[0] = parts[3]; + } return Integer.parseInt(parts[2]); } } @@ -153,11 +156,14 @@ public class UploadFileAction extends Action { try { int[] bucket = new int[1]; bucket[0] = -1; + String[] fileNames = new String[1]; + fileNames[0] = null; + while (decoder.hasNext()) { InterfaceHttpData data = decoder.next(); if (data != null) { try { - if(!writeFileUploadData(data, response, requestId, isKeepAlive, bucket)) { + if(!writeFileUploadData(data, response, requestId, isKeepAlive, bucket, fileNames)) { break; } } finally { @@ -173,12 +179,15 @@ public class UploadFileAction extends Action { /** * writeFileUploadData */ - private boolean writeFileUploadData(InterfaceHttpData data, Response response, String requestId, boolean isKeepAlive, int[] bucket) { + private boolean writeFileUploadData(InterfaceHttpData data, Response response, String requestId, boolean isKeepAlive, int[] bucket, String[] fileNames) { try { if (data.getHttpDataType() == InterfaceHttpData.HttpDataType.FileUpload) { FileUpload fileUpload = (FileUpload) data; String remoteFileName = fileUpload.getFilename(); + if(fileNames[0] != null) { + remoteFileName = fileNames[0]; + } long remoteFileSize = fileUpload.length(); if(bucket[0] == -1) { @@ -323,7 +332,7 @@ public class UploadFileAction extends Action { String token = attribute.getValue(); try { - bucket[0] = validateToken(token); + bucket[0] = validateToken(token, fileNames); } catch (InvalidateTokenExecption e) { logger.error("无效的token!", e); response.setStatus(HttpResponseStatus.BAD_REQUEST); diff --git a/broker/src/main/java/io/moquette/imhandler/GetMediaUploadTokenHandler.java b/broker/src/main/java/io/moquette/imhandler/GetMediaUploadTokenHandler.java index 2d78bd8c..1a90aa7f 100644 --- a/broker/src/main/java/io/moquette/imhandler/GetMediaUploadTokenHandler.java +++ b/broker/src/main/java/io/moquette/imhandler/GetMediaUploadTokenHandler.java @@ -18,16 +18,28 @@ import io.moquette.server.config.MediaServerConfig; import io.moquette.spi.impl.Qos1PublishHandler; import io.netty.buffer.ByteBuf; +import java.nio.charset.StandardCharsets; +import java.util.Base64; + import static io.moquette.server.config.MediaServerConfig.FILE_STROAGE_REMOTE_SERVER_URL; @Handler("GMUT") public class GetMediaUploadTokenHandler extends IMHandler { @Override public ErrorCode action(ByteBuf ackPayload, String clientID, String fromUser, ProtoConstants.RequestSourceType requestSourceType, WFCMessage.GetUploadTokenRequest request, Qos1PublishHandler.IMCallback callback) { + String fileKey = request.getMediaPath(); + if(fileKey.contains("/")) { + fileKey = fileKey.substring(fileKey.lastIndexOf("/")+1); + } + + String encodedUserId = Base64.getEncoder().encodeToString(fromUser.getBytes(StandardCharsets.UTF_8)).replace("+", "-2B").replace("/", "-2F").replace("=", "-3D"); + if(!fileKey.startsWith(fromUser) && !fileKey.startsWith(encodedUserId)) { + LOG.error("GetMediaUploadTokenHandler error: {}, {}", fromUser, request.getMediaPath()); + return ErrorCode.ERROR_CODE_NOT_RIGHT; + } + int type = request.getMediaType(); - String token; - WFCMessage.GetUploadTokenResult.Builder resultBuilder = WFCMessage.GetUploadTokenResult.newBuilder(); if (MediaServerConfig.USER_QINIU) { Auth auth = Auth.create(MediaServerConfig.QINIU_ACCESS_KEY, MediaServerConfig.QINIU_SECRET_KEY); @@ -93,12 +105,12 @@ public class GetMediaUploadTokenHandler extends IMHandler { .setServer(MediaServerConfig.QINIU_SERVER_URL); resultBuilder.setPort(80); } else { - token = UploadFileAction.getToken(type); + token = UploadFileAction.getToken(type, null); resultBuilder.setDomain("http://" + MediaServerConfig.SERVER_IP + ":" + MediaServerConfig.HTTP_SERVER_PORT) .setServer(MediaServerConfig.SERVER_IP); resultBuilder.setPort(MediaServerConfig.HTTP_SERVER_PORT);