加强接口安全

src/main/java/thyyxxk/wxservice_server/controller/InspectionsController.java

@@ -30,7 +30,7 @@ public class InspectionsController {
 
     @PostMapping("/checkExamIndex")
     public ResultVo<List<ExamIndexResult>> checkExamIndex(@RequestBody CheckExamParam param, HttpServletRequest request) {
-        if (!AgentUtil.fromWechatBrowser(request)) {
+        if (AgentUtil.notFromWechatBrowser(request)) {
             return ResultVoUtil.fail(ExceptionEnum.INTERNAL_SERVER_ERROR, "请求失败，调用来源验证失败。");
         }
         return inspectionsService.getExamIndex(param);
@@ -38,7 +38,7 @@ public class InspectionsController {
 
     @PostMapping("/checkExamDetail")
     public ResultVo<ExamDetailResult> checkExamDetail(@RequestBody QueryReportDetail param, HttpServletRequest request) {
-        if (!AgentUtil.fromWechatBrowser(request)) {
+        if (AgentUtil.notFromWechatBrowser(request)) {
             return ResultVoUtil.fail(ExceptionEnum.INTERNAL_SERVER_ERROR, "请求失败，调用来源验证失败。");
         }
         return inspectionsService.checkExamDetail(param);
@@ -47,7 +47,7 @@ public class InspectionsController {
     @GetMapping("/checkCovidExamIndexBySocialNo")
     public ResultVo<List<ExamIndexResult>> checkCovidExamIndexBySocialNo(@RequestParam("socialNo") String socialNo,
                                                                          HttpServletRequest request) {
-        if (!AgentUtil.fromWechatBrowser(request)) {
+        if (AgentUtil.notFromWechatBrowser(request)) {
             return ResultVoUtil.fail(ExceptionEnum.INTERNAL_SERVER_ERROR, "请求失败，调用来源验证失败。");
         }
         return inspectionsService.checkCovidExamIndexBySocialNo(socialNo);

src/main/java/thyyxxk/wxservice_server/controller/PowersiPhysicalCheckController.java

@@ -24,10 +24,11 @@ public class PowersiPhysicalCheckController {
 
     @GetMapping("/getIdCard")
     public ResultVo<String> getIdCard(@RequestParam("patientId") String patientId, HttpServletRequest request) {
-        if (!AgentUtil.fromWechatBrowser(request)) {
-            return ResultVoUtil.fail(ExceptionEnum.INTERNAL_SERVER_ERROR, "请求失败，调用来源验证失败。");
-        }
-        return service.getIdCard(patientId);
+//        if (!AgentUtil.fromWechatBrowser(request)) {
+//            return ResultVoUtil.fail(ExceptionEnum.INTERNAL_SERVER_ERROR, "请求失败，调用来源验证失败。");
+//        }
+//        return service.getIdCard(patientId);
+        return ResultVoUtil.fail(ExceptionEnum.INTERNAL_SERVER_ERROR, "请求失败，调用来源验证失败。");
     }
 
     @GetMapping("/getPhysicalCheckIndex")

src/main/java/thyyxxk/wxservice_server/dao/InspectionsDao.java

@@ -42,4 +42,7 @@ public interface InspectionsDao {
 
     @Select("select top 1 pat_id from t_tencent_electronic_health_card where id_number=#{socialNo}")
     String selectPatIdBySocialNo(@Param("socialNo") String socialNo);
+
+    @Select("select count(1) from t_wechat_patient_bind where patient_id=#{patId} and open_id=#{openId} and del_flag=0")
+    int selectPatIdAndOpenIdMatchCount(@Param("patId") String patId, @Param("openId") String openId);
 }

src/main/java/thyyxxk/wxservice_server/entity/inspections/CheckExamParam.java

@@ -10,4 +10,5 @@ public class CheckExamParam {
     private String patientId;
     private String start;
     private String end;
+    private String key;
 }

src/main/java/thyyxxk/wxservice_server/entity/inspections/QueryReportDetail.java

@@ -6,5 +6,6 @@ import lombok.Data;
 public class QueryReportDetail {
     private String orderId;
     private String patNo;
+    private String key;
     private Integer patType;
 }

src/main/java/thyyxxk/wxservice_server/service/InspectionsService.java

@@ -43,6 +43,10 @@ public class InspectionsService {
     }
 
     public ResultVo<List<ExamIndexResult>> getExamIndex(CheckExamParam param) {
+        int exist = dao.selectPatIdAndOpenIdMatchCount(param.getPatientId(), param.getKey());
+        if (exist == 0) {
+            return ResultVoUtil.fail(ExceptionEnum.NO_DATA_EXIST, "请求失败，调用来源验证失败。");
+        }
         healthCardService.reportHisData(param.getPatientId(), "0101082", null ,null);
         String firstHead = "<message><PATIENT_TYPE>0</PATIENT_TYPE><PTNT_NO>" + param.getPatientId() + "</PTNT_NO>";
         String[] sendHeads = new String[]{firstHead, null, null, null};
@@ -149,6 +153,10 @@ public class InspectionsService {
         if (StringUtil.isBlank(param.getOrderId())) {
             return ResultVoUtil.fail(ExceptionEnum.LOGICAL_ERROR, "报告ID不能为空！");
         }
+        int exist = dao.selectPatIdAndOpenIdMatchCount(param.getPatNo(), param.getKey());
+        if (exist == 0) {
+            return ResultVoUtil.fail(ExceptionEnum.NO_DATA_EXIST, "请求失败，调用来源验证失败。");
+        }
         String send = "<message><ORDR_ID>" + param.getOrderId() + "</ORDR_ID></message>";
         String xml = soapInvokeService.invokeRemoteMethod("GetLabReport", send);
         Element retEle = getResultElement(xml);
@@ -194,12 +202,6 @@ public class InspectionsService {
                 reportItems.add(reportItem);
             }
         });
-        if (detail.getReportHeader().getPTNT_NAME().startsWith("核酸混检")) {
-            HshjPatient patient = dao.selectPatientBriefInfo(param.getPatNo());
-            detail.getReportHeader().setPTNT_NAME(patient.getName());
-            detail.getReportHeader().setPTNT_SEX(patient.getGender());
-            detail.getReportHeader().setPTNT_AGE(patient.getAge());
-        }
         detail.setReportItems(reportItems);
         return ResultVoUtil.success(detail);
     }

src/main/java/thyyxxk/wxservice_server/service/PowersiPhysicalCheckService.java

@@ -68,7 +68,7 @@ public class PowersiPhysicalCheckService {
         return ResultVoUtil.fail(ExceptionEnum.LOGICAL_ERROR, resultCode.getString("message"));
     }
 
-    public ResultVo<JSONObject> getPhysicalCheckResult(String tjid) {
+    private ResultVo<JSONObject> getPhysicalCheckResult(String tjid) {
         ResultVo<JSONObject> summary = getSummary(tjid);
         ResultVo<List<JSONObject>> checkItems = getExamItems(tjid);
         if (checkItems.getCode() != ExceptionEnum.SUCCESS.getCode()) {
@@ -178,9 +178,8 @@ public class PowersiPhysicalCheckService {
         JSONObject tjrslt = resultVo.getData();
         if (null == tjrslt.getJSONObject("summary")) {
             return "没有查询到有效数据。";
-        } else {
-            PhysicalCheckPDFUtil.createPDF(response, tjIndex, tjrslt);
         }
+        PhysicalCheckPDFUtil.createPDF(response, tjIndex, tjrslt);
         return "OK";
     }
 }

src/main/java/thyyxxk/wxservice_server/utils/AgentUtil.java

@@ -3,8 +3,8 @@ package thyyxxk.wxservice_server.utils;
 import javax.servlet.http.HttpServletRequest;
 
 public class AgentUtil {
-    public static boolean fromWechatBrowser(HttpServletRequest request) {
-        String agent = request.getHeader("User-Agent");
-        return agent.contains("WeChat") || agent.contains("Weixin");
+    public static boolean notFromWechatBrowser(HttpServletRequest request) {
+        String agent = request.getHeader("User-Agent").toLowerCase();
+        return !agent.contains("wechat") && !agent.contains("weixin") && !agent.contains("micromessenger");
     }
 }