高危漏洞修复

src/main/java/com/chinaitop/depot/utils/CustomFilter.java

@@ -0,0 +1,38 @@
+package com.chinaitop.depot.utils;
+
+import org.apache.commons.lang.ObjectUtils;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+
+public class CustomFilter implements Filter {
+
+	@Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+ 
+    }
+	
+	@Override
+	public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)
+			throws IOException, ServletException {
+		HttpServletRequest request = (HttpServletRequest) arg0;
+		HttpSession session = request.getSession();
+		String orgId = "";
+		if (session != null){
+			orgId = ObjectUtils.toString(session.getAttribute("orgId"),"");
+		}
+		if (!orgId.isEmpty()) {
+			DataPolicyEngine.set(orgId);
+			arg2.doFilter(arg0, arg1);//放行，通过了当前过滤器，递交给下一个filter进行过滤
+		}
+		DataPolicyEngine.remove();
+	}
+	
+	@Override
+    public void destroy() {
+ 
+    }
+
+}

src/main/java/com/chinaitop/depot/utils/DataPolicyEngine.java

@@ -0,0 +1,61 @@
+package com.chinaitop.depot.utils;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+
+/**
+ * 
+ * @author hf
+ * 
+ * @description 数据策略（数据权限控制使用）
+ * 
+ * 
+ */
+public class DataPolicyEngine {
+	//log信息输出对象
+	protected static final Log log = LogFactory.getLog(DataPolicyEngine.class); 
+
+	//本地线程，用于存储线程公共对象
+	private static ThreadLocal threadLocalSession = new ThreadLocal();
+	
+	
+	/**
+	 * @description 获取本地执行线程
+	 *
+	 * @return ThreadLocal 
+	 * 
+	 */
+	public static ThreadLocal getThreadLocalSession() {
+		return threadLocalSession;
+	}
+	
+	/**
+	 * @description 在线程内设置存储对象
+	 * 
+	 */
+	public static void set(Object obj) {
+		threadLocalSession.set(obj);
+
+	}
+	
+	/**
+	 * @description 获取在线程内设置存储的对象
+	 * 
+	 */
+	public static Object get() {
+		return threadLocalSession.get();
+
+	}
+
+	/**
+	 * @description 移除在线程内设置存储的对象
+	 * 
+	 */
+	public static void remove() {
+		threadLocalSession.remove();
+
+	}
+	
+	
+}