change saveOrUpdate url strategy and content of gitignore

README.md

@@ -3,7 +3,7 @@
 - 使用renren-security搭建项目，只需编写30%左右代码，其余的代码交给系统自动生成
 - 一个月的工作量，一周就能完成，剩余的时间可以陪家人、朋友、撩妹、钓凯子等，从此踏入高富帅、白富美行业
 - 也是接私活的利器，能快速完成项目并交付，轻松赚取外快，实现财务自由，走向人生巅峰（接私活赚了钱，可以给作者打赏点辛苦费，让作者更有动力持续优化、完善）
-
+ 
 
 
 **具有如下特点** 

pom.xml

@@ -292,7 +292,7 @@
 			<plugin>
 				<groupId>org.apache.tomcat.maven</groupId>
 				<artifactId>tomcat7-maven-plugin</artifactId>
-				<version>2.1</version>
+				<version>2.2</version>
 				<configuration>
 					<path>/</path>
 					<charset>UTF-8</charset>

renren-api/src/main/java/io/renren/interceptor/AuthorizationInterceptor.java

@@ -40,8 +40,12 @@ public boolean preHandle(HttpServletRequest request, HttpServletResponse respons
             return true;
         }
 
-        //获取token
-        String token = request.getParameter("token");
+        //从header中获取token
+        String token = request.getHeader("token");
+        //如果header中不存在token，则从参数中获取token
+        if(StringUtils.isBlank(token)){
+            token = request.getParameter("token");
+        }
 
         //token为空
         if(StringUtils.isBlank(token)){

renren-api/src/main/resources/renren-api.xml

@@ -26,6 +26,8 @@
 						<value>WriteMapNullValue</value>
 						<value>QuoteFieldNames</value>
 						<value>WriteDateUseDateFormat</value>
+						<!-- 禁用fastjson循环引用检测 -->
+						<value>DisableCircularReferenceDetect</value>
 					</list>
 				</property>
 			</bean>

renren-common/pom.xml

@@ -12,7 +12,7 @@
 	<properties>
 		<qiniu-version>[7.2.0, 7.2.99]</qiniu-version>
 		<aliyun-oss-version>2.5.0</aliyun-oss-version>
-		<qcloud-cos-version>3.3</qcloud-cos-version>
+		<qcloud-cos-version>4.4</qcloud-cos-version>
 	</properties>
 
 	<dependencies>

renren-common/src/main/java/io/renren/oss/CloudStorageConfig.java

@@ -76,6 +76,9 @@ public class CloudStorageConfig implements Serializable {
     //腾讯云BucketName
     @NotBlank(message="腾讯云BucketName不能为空", groups = QcloudGroup.class)
     private String qcloudBucketName;
+    //腾讯云COS所属地区
+    @NotBlank(message="所属地区不能为空", groups = QcloudGroup.class)
+    private String qcloudRegion;
 
     public Integer getType() {
         return type;
@@ -220,4 +223,12 @@ public String getQcloudBucketName() {
     public void setQcloudBucketName(String qcloudBucketName) {
         this.qcloudBucketName = qcloudBucketName;
     }
+
+	public String getQcloudRegion() {
+		return qcloudRegion;
+	}
+
+	public void setQcloudRegion(String qcloudRegion) {
+		this.qcloudRegion = qcloudRegion;
+	}
 }

renren-common/src/main/java/io/renren/oss/QcloudCloudStorageService.java

@@ -1,80 +1,81 @@
-package io.renren.oss;
-
-import com.alibaba.fastjson.JSON;
-import com.alibaba.fastjson.JSONObject;
-import com.qcloud.cos.COSClient;
-import com.qcloud.cos.request.UploadFileRequest;
-import io.renren.utils.RRException;
-import org.apache.commons.io.FileUtils;
-
-import java.io.ByteArrayInputStream;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-
-/**
- * 腾讯云存储
- * @author chenshun
- * @email sunlightcs@gmail.com
- * @date 2017-03-26 20:51
- */
-public class QcloudCloudStorageService extends CloudStorageService{
-    private COSClient client;
-
-    public QcloudCloudStorageService(CloudStorageConfig config){
-        this.config = config;
-
-        //初始化
-        init();
-    }
-
-    private void init(){
-        client = new COSClient(config.getQcloudAppId(), config.getQcloudSecretId(),
-                config.getQcloudSecretKey());
-    }
-
-    @Override
-    public String upload(byte[] data, String path) {
-        return this.upload(new ByteArrayInputStream(data), path);
-    }
-
-    @Override
-    public String upload(InputStream inputStream, String path) {
-        String tmp = System.getProperty("java.io.tmpdir");
-        File file = new File(tmp + path);
-        try {
-            FileUtils.copyInputStreamToFile(inputStream, file);
-        } catch (IOException e) {
-            throw new RRException("上传文件失败", e);
-        }
-
-        //腾讯云必需要以"/"开头
-        if(!path.startsWith("/")) {
-            path = "/" + path;
-        }
-
-        //上传到腾讯云
-        UploadFileRequest request = new UploadFileRequest(config.getQcloudBucketName(), path, file.getPath());
-        String response = client.uploadFile(request);
-
-        //删除临时文件
-        file.delete();
-
-        JSONObject jsonObject = JSON.parseObject(response);
-        if(jsonObject.getIntValue("code") != 0) {
-            throw new RRException("文件上传失败，" + jsonObject.getString("message"));
-        }
-
-        return config.getQcloudDomain() + path;
-    }
-
-    @Override
-    public String upload(byte[] data) {
-        return upload(data, getPath(config.getQcloudPrefix()));
-    }
-
-    @Override
-    public String upload(InputStream inputStream) {
-        return upload(inputStream, getPath(config.getQcloudPrefix()));
-    }
-}
+package io.renren.oss;
+
+import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONObject;
+import com.qcloud.cos.COSClient;
+import com.qcloud.cos.ClientConfig;
+import com.qcloud.cos.request.UploadFileRequest;
+import com.qcloud.cos.sign.Credentials;
+import io.renren.utils.RRException;
+import org.apache.commons.io.IOUtils;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * 腾讯云存储
+ * @author chenshun
+ * @email sunlightcs@gmail.com
+ * @date 2017-03-26 20:51
+ */
+public class QcloudCloudStorageService extends CloudStorageService{
+    private COSClient client;
+
+    public QcloudCloudStorageService(CloudStorageConfig config){
+        this.config = config;
+
+        //初始化
+        init();
+    }
+
+    private void init(){
+    	Credentials credentials = new Credentials(config.getQcloudAppId(), config.getQcloudSecretId(),
+                config.getQcloudSecretKey());
+
+    	//初始化客户端配置
+        ClientConfig clientConfig = new ClientConfig();
+        //设置bucket所在的区域，华南：gz 华北：tj 华东：sh
+        clientConfig.setRegion(config.getQcloudRegion());
+
+    	client = new COSClient(clientConfig, credentials);
+    }
+
+    @Override
+    public String upload(byte[] data, String path) {
+        //腾讯云必需要以"/"开头
+        if(!path.startsWith("/")) {
+            path = "/" + path;
+        }
+
+        //上传到腾讯云
+        UploadFileRequest request = new UploadFileRequest(config.getQcloudBucketName(), path, data);
+        String response = client.uploadFile(request);
+
+        JSONObject jsonObject = JSON.parseObject(response);
+        if(jsonObject.getIntValue("code") != 0) {
+            throw new RRException("文件上传失败，" + jsonObject.getString("message"));
+        }
+
+        return config.getQcloudDomain() + path;
+    }
+
+    @Override
+    public String upload(InputStream inputStream, String path) {
+    	try {
+            byte[] data = IOUtils.toByteArray(inputStream);
+            return this.upload(data, path);
+        } catch (IOException e) {
+            throw new RRException("上传文件失败", e);
+        }
+    }
+
+    @Override
+    public String upload(byte[] data) {
+        return upload(data, getPath(config.getQcloudPrefix()));
+    }
+
+    @Override
+    public String upload(InputStream inputStream) {
+        return upload(inputStream, getPath(config.getQcloudPrefix()));
+    }
+}

renren-common/src/main/java/io/renren/oss/QiniuCloudStorageService.java

@@ -29,7 +29,7 @@ public QiniuCloudStorageService(CloudStorageConfig config){
     }
 
     private void init(){
-        uploadManager = new UploadManager(new Configuration(Zone.zone0()));
+        uploadManager = new UploadManager(new Configuration(Zone.autoZone()));
         token = Auth.create(config.getQiniuAccessKey(), config.getQiniuSecretKey()).
                 uploadToken(config.getQiniuBucketName());
     }

renren-common/src/main/java/io/renren/service/impl/SysConfigServiceImpl.java

@@ -71,7 +71,7 @@ public <T> T getConfigObject(String key, Class<T> clazz) {
 		try {
 			return clazz.newInstance();
 		} catch (Exception e) {
-			throw new RRException("获取云存储配置信息失败");
+			throw new RRException("获取参数失败");
 		}
 	}
 }

renren-common/src/main/java/io/renren/utils/Constant.java

@@ -76,7 +76,7 @@ public int getValue() {
      */
     public enum CloudService {
         /**
-         * 阿里云
+         * 七牛云
          */
         QINIU(1),
         /**

renren-common/src/main/java/io/renren/utils/Query.java

@@ -1,5 +1,7 @@
 package io.renren.utils;
 
+import io.renren.xss.SQLFilter;
+
 import java.util.LinkedHashMap;
 import java.util.Map;
 
@@ -26,6 +28,12 @@ public Query(Map<String, Object> params){
         this.put("offset", (page - 1) * limit);
         this.put("page", page);
         this.put("limit", limit);
+
+        //防止SQL注入（因为sidx、order是通过拼接SQL实现排序的，会有SQL注入风险）
+        String sidx = params.get("sidx").toString();
+        String order = params.get("order").toString();
+        this.put("sidx", SQLFilter.sqlInject(sidx));
+        this.put("order", SQLFilter.sqlInject(order));
     }