thecosy/icecms

🌈冰激凌内容管理系统🍦,实现MacWK资源站，社区图片视频圈子CMS，支持网页端移动端小程序🌟适合做 资讯商城，社区论坛，聊天交友 社区，博客，圈子，论坛，图片，视频，社交。

简介

基于 Spring Boot + Vue 前后端分离的内容管理系统

演示: （www.icecmspro.com） 后台:（admin.icecmspro.com）

官网: （www.icecms.cn）

IceCMS 文档： （http://www.icecms.cn）

内容管理：文章、图片、资源等多种类型的内容管理；

栏目管理：自定义栏目，对栏目进行增删改查等操作；

用户管理：管理后台用户，包括添加、删除、修改、权限分配等功能；

数据统计：对网站访问量、用户行为等进行统计分析；

模板管理：自定义网站模板，方便快速搭建网站；

SEO优化：网站标题、关键词、描述等SEO优化功能。

预览地址：

前台：www.icecmspro.com

uniapp移动端：uni.icecmspro.com

后台：admin.icecmspro.com 账号admin密码admin123

API文档：api.icecmspro.com/doc.html

PC端

后台

UniApp H5、小程序移动端

后端

1. 核心框架：Spring Boot
2. 安全框架：Spring Security
3. Token 认证：jjwt
4. 持久层框架：MyBatis
5. 分页插件：PageHelper
6. NoSQL缓存：Redis
7. Markdown 转 HTML：commonmark-java
8. 离线 IP 地址库：ip2region

基于 JDK8 开发，8以上要添加依赖：

<dependency>
  <groupId>javax.xml.bind</groupId>
  <artifactId>jaxb-api</artifactId>
  <version>2.3.0</version>
</dependency>

前端

核心框架：Vue2.x、Vue Router、Vuex

Vue 项目基于 @vue/cli4.x 构建

JS 依赖及参考的 css：axios、moment、nprogress、v-viewer、prismjs、APlayer、MetingJS、lodash、mavonEditor、echarts、tocbot、iCSS

后台 UI

后台 CMS 部分基于 vue-admin-template

UI 框架为 Element UI

前台 UI

Element UI：部分使用，一些小组件，更改了ui样式，便于快速实现效果

最近更新

增加标签功能

完善部分ui

docker 前端部署方式

docker compose 一键部署

快速开始

Docker部署方式(推荐,可用于快速上线或测试)

# 未安装docker的请先安装docker，已经安装的跳过此步
yum install docker-ce -y
#启动docker
systemctl start docker
# 配置国内源
# 创建docker目录
sudo mkdir -p /etc/docker
# 创建配置文件
sudo tee /etc/docker/daemon.json <<-'EOF'
{
"registry-mirrors": ["https://mirror.ccs.tencentyun.com"]
}
EOF
# 加载新的配置文件
sudo systemctl daemon-reload
# 重启docker服务
sudo systemctl restart docker

main-命令执行
Ps:按顺序执行

1.运行Mysql容器
docker run -d -p 0:3389 \
--name ice-sql \
--restart always \
thecosy/icemysql:v2.2.0

2.运行Spring容器
docker run -d -p 8181:8181 \
--name ice-api \
--restart always \
--link ice-sql:db \
thecosy/icecms:v2.2.0

3.运行Vue容器
docker run -d -p 3000:80 \
--name ice-vue \
--restart always \
--link  ice-api:iceApi \
thecosy/icevue:v2.2.0

#访问前端地址http://ip:3000

目录结构

iceCMS/
├── HELP.md
├── IceCMS-java.iml
├── IceCMS-main             --java主程序启动入口
│   ├── IceCMS-main.iml
│   ├── main.iml
│   ├── pom.xml
│   ├── src
│   └── target
├── IcePay-ment             --java支付模块
│   ├── IcePay-ment.iml
│   ├── pom.xml
│   ├── src
│   └── target
├── IceWk-ment              --java前端api模块
│   ├── IceWk-ment.iml
│   ├── pom.xml
│   ├── src
│   └── target
├── IceWk-uniApp            --h5Uniapp模块
│   ├── App.vue
│   ├── LICENSE
│   ├── components
│   ├── main.js
│   ├── manifest.json
│   ├── nPro
│   ├── package-lock.json
│   ├── package.json
│   ├── pages
│   ├── pages.json
│   ├── static
│   ├── store
│   ├── subPage
│   ├── template.h5.html
│   ├── theme
│   ├── uni.scss
│   ├── uni_modules
│   ├── utils
│   └── vue.config.js
├── IceWk-vues                --前端vue模块
│   ├── LICENSE
│   ├── README.md
│   ├── babel.config.js
│   ├── build
│   ├── dist
│   ├── jest.config.js
│   ├── jsconfig.json
│   ├── node_modules
│   ├── package-lock.json
│   ├── package.json
│   ├── postcss.config.js
│   ├── public
│   ├── serverless.yml
│   ├── src
│   ├── vue.config.js
│   └── yarn.lock
├── README.md
├── bin
│   ├── clean.bat
│   ├── package.bat
│   └── run.bat
├── doc
│   └── IceCMS环境使用手册.docx
├── mvnw
├── mvnw.cmd
├── pom.xml
└── sql                        --项目sql文件
├── icecms5.6.sql
└── icecms8.0.sql

配置最小开发环境

1.环境配置

MySQL JDK1.8或以上 Maven Nodejs 微信开发者工具

后端部署

2.创建 MySQL 数据库IceCMS，并执行/sql/IceCMS.sql初始化表数据

3.启动iceCMS-main管理后台的后端服务

3.1.修改配置信息IceCMS-main/src/main/resources/application.yml配置数据库连接

3.2.安装 Redis 并启动(不用的话不影响)

3.3.打开命令行，输入以下命令

cd iceCMS
mvn install
mvn clean package
java -Dfile.encoding=UTF-8 -jar iceCMS/iceCMS-main/target/iceCMS.jar
#在iceCMS.jar目录输入 java -jar iceCMS.jar

前端部署

4.进入iceCMS-vues目录

打开命令行，输入以下命令

# 克隆项目
git clone https://github.com/PanJiaChen/vue-admin-template.git

# 进入项目目录
cd IceWk-VUE

# 安装依赖
npm install

# 建议不要直接使用 cnpm 安装以来，会有各种诡异的 bug。可以通过如下操作解决 npm 下载速度慢的问题
npm install --legacy-peer-deps --registry=https://registry.npm.taobao.org
# 启动服务
npm run dev

发布

# 构建测试环境
npm run build:stage

# 构建生产环境
npm run build:prod

5.启动前端

浏览器打开，访问 http://localhost:9528 , 此时进入前端页面。

启动前端后台（后台地址http://localhost:9528/admin）

6.启动uniapp移动端

下载HBuilderX

进入（https://ext.dcloud.net.cn/plugin?id=9261）uniapp移动端插件目录，点击导入，然后即可导入到本地。

也可在本地打开IceCMS-uniapp项目

打开IceWK-uniApp目录,进行编译打包

注意事项

一些常见问题：

• MySQL 确保数据库字符集为utf8mb4的情况下通常没有问题（”站点设置“及”文章详情“等许多表字段需要utf8mb4格式字符集来支持 emoji 表情，否则在导入 sql 文件时，即使成功导入，也会有部分字段内容不完整，导致前端页面渲染数据时报错）
• 确保 Maven 能够成功导入现版本依赖，请勿升级或降低依赖版本
• 数据库中默认用户名密码为root，123123，因为是个人项目，没打算做修改密码的页面，可在top.naccl.util.HashUtils下的main方法手动生成密码存入数据库
• 注意修改IceCMS-main目录下的application-dev.properties的配置信息
  • Redis 若没有密码，留空即可
  • 注意修改token.secretKey，否则无法保证 token 安全性

QQ交流群

QQ交流群：（951286996）

Tg群组：[https://t.me/+1rau4SBwFyE1OTA1](https://t.me/+1rau4SBwFyE1OTA1）

该群是一个学习交流群，如果是程序相关问题，请直接提交issues

软著

开源协议

GPL-3.0 license © pipipi-pikachu

商业用途

• 如果你希望将本项目商用盈利，我希望你能严格遵循 GPL-3.0 协议；
• 如果你真的需要闭源商用，无法执行 GPL-3.0 协议，可以选择：
• 成为项目的贡献者，大致包括：
• 你的代码被本项目作为依赖引用；
• 你提交的 PR 被本项目合并（仅限有价值的，不包括简单的错别字或拼写错误修改等）；
• 你参与过本项目的设计、实现（也包括对各种功能/模块的实现或Bug的修复提供了有价值的思路）；
• 联系作者付费商用

Thanks

感谢 JetBrains 提供的非商业开源软件 License

Star History

icecms's Issues

Two open worry-free authorized version(￥199)

Is the ¥199 authorized version of Erkai Wuyou open-source with full code access, and can it be used for commercial purposes? Does it lock any part of the code? Is there a fundamental difference in functionality between this version and the highest cost-effective Enterprise edition (¥2999)? What is the distinction between 'open-source' and 'full source code' in terms of the source code?

二开无忧授权版(¥ 199) 是否是开放全部代码 并且能用作商用,会不会锁住部分代码 和性价比最高企业版(¥ 2999) 本质上是功能的区别吗? 源码方面的"开源"和"全部源码"是有什么区别的

创建资源点击提交后不会跳转到资源列表，并且可以再次点击提交

There is unauthorized access to the API, resulting in the disclosure of sensitive information

This api does not require login, obtains user information through user_id, and returns the user name, password, and email address in plain text.

It is like the preview address provided by the project, macwk.cc, and the backend service address is macwk.cc/api through the request body. So we can get any user information, including the administrator.

[vulnerability security] Vertical Privilege Escalation Vulnerability

Recently, our team discovered a security vulnerability that has led to an unauthorized access issue in the latest version of the project, which could pose a serious risk of information leakage.

The URL of the vulnerability is http://localhost:port/User/GetUserInfoByid/{userid} within the method. This means that attackers can use the backend API directly without authentication.

Please note that the URL provided is a placeholder and should be replaced with the actual URL of the vulnerability if you are sharing this information with others. Also, it's important to address such vulnerabilities promptly to mitigate any potential risks.

[vulnerability security] Vertical Privilege Escalation Vulnerability

Recently, our team discovered a security vulnerability that has led to an unauthorized access issue in the latest version of the project, which could pose a serious risk of information leakage.

The URL of the vulnerability is http://localhost:port/square/GetAllSquareUser within the method. This means that attackers can use the backend API directly without authentication.

Please note that the URL provided is a placeholder and should be replaced with the actual URL of the vulnerability if you are sharing this information with others. Also, it's important to address such vulnerabilities promptly to mitigate any potential risks.

There is a Stored-XSS vulnerability in IceCMS v1.0.0

There is a Stored-XSS vulnerability in IceCMS v1.0.0

api : /Websquare/create/circle
planet - circle

POC：
The payload is <img src=1 onerror=alert(1)>

在后台将资源设置为免费，但下载时还是需要扫码支付0元

IceWk-uniApp 小程序hbuilder下载依赖失败

项目 'IceWk-uniApp' 开始编译...
请注意运行模式下，因日志输出、sourcemap以及未压缩源码等原因，性能和包体积，均不及发行模式。若要正式发布，请点击发行菜单或使用cli发布命令进行发布
小程序各家浏览器内核及自定义组件实现机制存在差异，可能存在样式布局兼容问题，参考：https://uniapp.dcloud.io/matter?id=mp
正在编译中...
​Browserslist: caniuse-lite is outdated. Please run:
npx update-browserslist-db@latest
Why you should do it regularly: https://github.com/browserslist/update-db#readme​
at subPage/commen/post.vue:1
Module build failed (from ./node_modules/@dcloudio/webpack-uni-mp-loader/lib/script.js):
Error: 组件 bgyxedit 引用错误，仅支持 import 方式引入组件
at /Applications/HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli/node_modules/@dcloudio/webpack-uni-mp-loader/lib/babel/util.js:38:13
at Array.forEach ()
at parseComponents (/Applications/HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli/node_modules/@dcloudio/webpack-uni-mp-loader/lib/babel/util.js:32:9)

请问能否增添用户个人信息主界面

该cms的ui还是不错的，但是功能还不是太完善，能否增添一些功能，谢谢🙏🙏

感谢大佬开源,可惜^_^报错有点多,注释实在少!跑起来还有好多不对的地方

后台文章列表一直打转（已经无请求），且会重复发送相同请求

页面代码很多报错 而且和演示网址效果差异较大

作者你好 是页面的代码没更新吗 页面运行起来很多报错，跟演示效果长得不一样呀

Unauthorized and Over-Privileged API Access Vulnerability: Harvesting All Usernames and Passwords

You can see in the figure below that the following API interface lacks authentication.(hithub is me)

Iterate through the numbers in the figure below.

By iterating through these numbers, you can obtain all users' usernames and passwords, as shown in the figure below.

网站演示

亲 网站演示地址都访问不了吗

【问题】关于文档图片不显示的问题

大神，
说明文档里，圈的选项里，有大量图片无法显示！！！

提交商品时 addtime 字段错误不匹配

msg: "nested exception is org.apache.ibatis.reflection.ReflectionException: Could not set property 'updateTime' of 'class com.ttice.icewkment.entity.Resource' with value 'Fri Dec 16 09:12:59 UTC 2022' Cause: java.lang.IllegalArgumentException: argument type mismatch"

前端传的时间对的，以及数据库，需要改一下后端

编辑器的Markdown格式无效，发送给后端的请求会自动加上<p>标签导致Markdown无效

There is a CSRF vulnerability that can delete the message

After the administrator open the following page, and click the the Submit request, square message with ID 264 will be deleted.

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.146.129:8181/square/DelectSquareById/264">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

[vulnerability security] Vertical Privilege Escalation Vulnerability

Recently, our team discovered a security vulnerability that has led to an unauthorized access issue in the latest version of the project, which could pose a serious risk of information leakage.

The URL of the vulnerability is http://localhost:port/squareComment/getAllSquare/{page}/{limit} within the method. This means that attackers can use the backend API directly without authentication.

Please note that the URL provided is a placeholder and should be replaced with the actual URL of the vulnerability if you are sharing this information with others. Also, it's important to address such vulnerabilities promptly to mitigate any potential risks.

[vulnerability security] Vertical Privilege Escalation Vulnerability

Recently, our team discovered a security vulnerability that has led to an unauthorized access issue in the latest version of the project, which could pose a serious risk of information leakage.

The URL of the vulnerability is http://localhost:port/UserRole/getAllUserRole within the method. This means that attackers can use the backend API directly without authentication.

Please note that the URL provided is a placeholder and should be replaced with the actual URL of the vulnerability if you are sharing this information with others. Also, it's important to address such vulnerabilities promptly to mitigate any potential risks.

和macwk.com差别太大了，希望做的差不多就好

和macwk.com差别太大了，希望做的差不多就好

[vulnerability security] Vertical Privilege Escalation Vulnerability

Recently, our team discovered a security vulnerability that has led to an unauthorized access issue in the latest version of the project, which could pose a serious risk of information leakage.

The URL of the vulnerability is http://localhost:port/UserRole/getAllUserName within the method. This means that attackers can use the backend API directly without authentication.

Please note that the URL provided is a placeholder and should be replaced with the actual URL of the vulnerability if you are sharing this information with others. Also, it's important to address such vulnerabilities promptly to mitigate any potential risks.

点击修改圈子分类跳转到文章编辑

change the user password by brute force cracking

The impact code in IceCMS/IceWk-ment/src/main/java/com/ttice/icewkment/controller/UserController.java：

if(!claims){
//前端接收后进行处理
Result.fail(403,"Token已过期",null);
}
//验证之前密码是否正确
QueryWrapper wrapper = new QueryWrapper<>();
wrapper.eq("user_id",userid);
User usercheak = userMapper.selectOne(wrapper);
String password = usercheak.getPassword();
if(Objects.equals(password, yuanPassWord)) {
User user = new User();
user.setUserId(userid);
user.setPassword(NewPassWord);
userMapper.updateById(user);
return Result.succ(200, "修改成功", null);
}
Changing the password does not need to verify the current jwt, so after getting this api address, Hacker can change the password by brute force cracking ，especially when the user password is weak。

Vulnerabilities that allow arbitrary information traversal and modification by any user

api:/api/User/ChangeUser/(self_token)
Calling this interface, we can modify the information of any user by modifying the UserID field.there will be no validation

Try to log in to user test39, it goes well

It is obvious that developers only modify user information through UserID without any judgment and filtering

Arbitrary file upload

In the updateimage path of the imageApi file, the upload file type is not restricted, causing any file to be uploaded. At the same time, it is set to store the file locally if there is no remote bucket.

APIPath：IceWk-vues/src/api/updateImage.js
updateImage Path： IceWk-ment/src/main/java/com/ttice/icewkment/controller/ImageApi.java

两个安全漏洞

【腾讯云】尊敬的腾讯云用户，您好！您的腾讯云账号XXXXXXXXXXXXXX下的服务器：XXXXXXXXXXXXXXXX[CentOS-YO0q]，实例ID：XXXXXXXXXX，地域：华北地区 (北京)，时间：2023-05-12 06:27:51(GMT+8:00)，检测到存在待处理的应用漏洞：Apache Shiro 身份验证绕过漏洞(CVE-2022-32532)，威胁等级：严重，可能会给黑客留下可乘之机

【腾讯云】尊敬的腾讯云用户，您好！您的腾讯云账号（账号ID：XXXXXXXXXXX）下的服务器：XXXXXXXXXXXXXXX [CentOS-YO0q]，实例ID：XXXXXXXXXXXXXXXXX，地域：华北地区 (北京)，时间：2023-05-07 04:18:03(GMT+8:00)，检测到存在待处理的应急漏洞：FastJson代码执行漏洞(CVE-2022-25845)，威胁等级：严重，可能会给黑客留下可乘之机

资源列表 添加报错

vue.runtime.esm.js:619 [Vue warn]: Property or method "input" is not defined on the instance but referenced during render. Make sure that this property is reactive, either in the data option, or for class-based components, by initializing the property. See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.

found in

---> at src/admin/ResourceList.vue
at src/layout/components/AppMain.vue
at src/layout/index.vue
at src/App.vue

warn @ vue.runtime.esm.js:619
2vue.runtime.esm.js:619 [Vue warn]: Property or method "handleAdd" is not defined on the instance but referenced during render. Make sure that this property is reactive, either in the data option, or for class-based components, by initializing the property. See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.

found in

---> at src/admin/ResourceList.vue
at src/layout/components/AppMain.vue
at src/layout/index.vue
at src/App.vue

warn @ vue.runtime.esm.js:619
vue.runtime.esm.js:619 [Vue warn]: Property or method "handleDelete" is not defined on the instance but referenced during render. Make sure that this property is reactive, either in the data option, or for class-based components, by initializing the property. See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.

found in