Pre Merge pull request !421 from AhYi/master

文件支持防盗链配置
优化代码
2026-01-27 04:01:56 +08:00 · 2025-09-02 05:27:31 +00:00 · 2025-09-02 13:26:33 +08:00 · 2025-08-28 13:51:15 +08:00 · 2025-08-27 16:01:28 +08:00 · 2025-08-23 11:46:49 +08:00
37 changed files with 581 additions and 96 deletions
--- a/README.md
+++ b/README.md
@@ -126,4 +126,4 @@ com.ruoyi

 ## 若依微服务交流群

-QQ群： [![加入QQ群](https://img.shields.io/badge/已满-42799195-blue.svg)](https://jq.qq.com/?_wv=1027&k=yqInfq0S) [![加入QQ群](https://img.shields.io/badge/已满-170157040-blue.svg)](https://jq.qq.com/?_wv=1027&k=Oy1mb3p8) [![加入QQ群](https://img.shields.io/badge/已满-130643120-blue.svg)](https://jq.qq.com/?_wv=1027&k=rvxkJtXK) [![加入QQ群](https://img.shields.io/badge/已满-225920371-blue.svg)](https://jq.qq.com/?_wv=1027&k=0Ck3PvTe) [![加入QQ群](https://img.shields.io/badge/已满-201705537-blue.svg)](https://jq.qq.com/?_wv=1027&k=FnHHP4TT) [![加入QQ群](https://img.shields.io/badge/已满-236543183-blue.svg)](https://jq.qq.com/?_wv=1027&k=qdT1Ojpz) [![加入QQ群](https://img.shields.io/badge/已满-213618602-blue.svg)](https://jq.qq.com/?_wv=1027&k=nw3OiyXs) [![加入QQ群](https://img.shields.io/badge/已满-148794840-blue.svg)](https://jq.qq.com/?_wv=1027&k=kiU5WDls) [![加入QQ群](https://img.shields.io/badge/已满-118752664-blue.svg)](https://jq.qq.com/?_wv=1027&k=MtBy6YfT) [![加入QQ群](https://img.shields.io/badge/已满-101038945-blue.svg)](https://jq.qq.com/?_wv=1027&k=FqImHgH2) [![加入QQ群](https://img.shields.io/badge/已满-128355254-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=G4jZ4EtdT50PhnMBudTnEwgonxkXOscJ&authKey=FkGHYfoTKlGE6wHdKdjH9bVoOgQjtLP9WM%2Fj7pqGY1msoqw9uxDiBo39E2mLgzYg&noverify=0&group_code=128355254) [![加入QQ群](https://img.shields.io/badge/已满-179219821-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=irnwcXhbLOQEv1g-TwGifjNTA_f4wZiA&authKey=4bpzEwhcUY%2FvsPDHvzYn6xfoS%2FtOArvZ%2BGXzfr7O0%2FEqLfkKA%2BuCDXlzHIFg8t93&noverify=0&group_code=179219821) [![加入QQ群](https://img.shields.io/badge/158753145-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=lx1uEdEDuxeM7rUvF3qmlFdqKqdJ5Z-R&authKey=rgyPW9yhhh4IIURKVFa6NgP3qiqH04WAzrJ0trsgkr3pjzm6sKIOGyA58oOjoj%2FJ&noverify=0&group_code=158753145) 点击按钮入群。
+QQ群： [![加入QQ群](https://img.shields.io/badge/已满-42799195-blue.svg)](https://jq.qq.com/?_wv=1027&k=yqInfq0S) [![加入QQ群](https://img.shields.io/badge/已满-170157040-blue.svg)](https://jq.qq.com/?_wv=1027&k=Oy1mb3p8) [![加入QQ群](https://img.shields.io/badge/已满-130643120-blue.svg)](https://jq.qq.com/?_wv=1027&k=rvxkJtXK) [![加入QQ群](https://img.shields.io/badge/已满-225920371-blue.svg)](https://jq.qq.com/?_wv=1027&k=0Ck3PvTe) [![加入QQ群](https://img.shields.io/badge/已满-201705537-blue.svg)](https://jq.qq.com/?_wv=1027&k=FnHHP4TT) [![加入QQ群](https://img.shields.io/badge/已满-236543183-blue.svg)](https://jq.qq.com/?_wv=1027&k=qdT1Ojpz) [![加入QQ群](https://img.shields.io/badge/已满-213618602-blue.svg)](https://jq.qq.com/?_wv=1027&k=nw3OiyXs) [![加入QQ群](https://img.shields.io/badge/已满-148794840-blue.svg)](https://jq.qq.com/?_wv=1027&k=kiU5WDls) [![加入QQ群](https://img.shields.io/badge/已满-118752664-blue.svg)](https://jq.qq.com/?_wv=1027&k=MtBy6YfT) [![加入QQ群](https://img.shields.io/badge/已满-101038945-blue.svg)](https://jq.qq.com/?_wv=1027&k=FqImHgH2) [![加入QQ群](https://img.shields.io/badge/已满-128355254-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=G4jZ4EtdT50PhnMBudTnEwgonxkXOscJ&authKey=FkGHYfoTKlGE6wHdKdjH9bVoOgQjtLP9WM%2Fj7pqGY1msoqw9uxDiBo39E2mLgzYg&noverify=0&group_code=128355254) [![加入QQ群](https://img.shields.io/badge/已满-179219821-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=irnwcXhbLOQEv1g-TwGifjNTA_f4wZiA&authKey=4bpzEwhcUY%2FvsPDHvzYn6xfoS%2FtOArvZ%2BGXzfr7O0%2FEqLfkKA%2BuCDXlzHIFg8t93&noverify=0&group_code=179219821) [![加入QQ群](https://img.shields.io/badge/已满-158753145-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=lx1uEdEDuxeM7rUvF3qmlFdqKqdJ5Z-R&authKey=rgyPW9yhhh4IIURKVFa6NgP3qiqH04WAzrJ0trsgkr3pjzm6sKIOGyA58oOjoj%2FJ&noverify=0&group_code=158753145) [![加入QQ群](https://img.shields.io/badge/112869560-blue.svg)](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Kuaw0Xdlw2Nlgn6s8h9elzuquHGxGObD&authKey=cSrQcWQ%2BzQZAFFrwxaR%2BbzcumX4WRduZnd1O6JO1dlclQMiu%2BKwxAy8t2JfNp67V&noverify=0&group_code=112869560) 点击按钮入群。
--- a/pom.xml
+++ b/pom.xml
@@ -35,7 +35,7 @@
        <springdoc.version>1.6.9</springdoc.version>
        <transmittable-thread-local.version>2.14.4</transmittable-thread-local.version>
        <!-- override dependency version -->
-        <tomcat.version>9.0.105</tomcat.version>
+        <tomcat.version>9.0.108</tomcat.version>
        <logback.version>1.2.13</logback.version>
        <spring-framework.version>5.3.39</spring-framework.version>
    </properties>
--- a/ruoyi-api/ruoyi-api-system/pom.xml
+++ b/ruoyi-api/ruoyi-api-system/pom.xml
@@ -22,7 +22,12 @@
            <groupId>com.ruoyi</groupId>
            <artifactId>ruoyi-common-core</artifactId>
        </dependency>
-        
+
+        <!-- RuoYi Common Sensitive -->
+        <dependency>
+            <groupId>com.ruoyi</groupId>
+            <artifactId>ruoyi-common-sensitive</artifactId>
+        </dependency>
    </dependencies>

 </project>
--- a/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/RemoteFileService.java
+++ b/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/RemoteFileService.java
@@ -2,7 +2,9 @@ package com.ruoyi.system.api;

 import org.springframework.cloud.openfeign.FeignClient;
 import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.multipart.MultipartFile;
 import com.ruoyi.common.core.constant.ServiceNameConstants;
@@ -26,4 +28,13 @@ public interface RemoteFileService
     */
    @PostMapping(value = "/upload", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    public R<SysFile> upload(@RequestPart(value = "file") MultipartFile file);
+
+    /**
+     * 删除文件
+     *
+     * @param fileUrl 文件地址
+     * @return 结果
+     */
+    @DeleteMapping(value = "/delete", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+    public R<Boolean> delete(@RequestParam("fileUrl") String fileUrl);
 }
--- a/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/RemoteLogService.java
+++ b/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/RemoteLogService.java
@@ -1,5 +1,6 @@
 package com.ruoyi.system.api;

+import com.ruoyi.common.core.annotation.NoSensitive;
 import org.springframework.cloud.openfeign.FeignClient;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -16,6 +17,7 @@ import com.ruoyi.system.api.factory.RemoteLogFallbackFactory;
 * 
 * @author ruoyi
 */
+@NoSensitive
@FeignClient(contextId = "remoteLogService", value = ServiceNameConstants.SYSTEM_SERVICE, fallbackFactory = RemoteLogFallbackFactory.class)
 public interface RemoteLogService
 {
--- a/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/RemoteUserService.java
+++ b/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/RemoteUserService.java
@@ -1,5 +1,6 @@
 package com.ruoyi.system.api;

+import com.ruoyi.common.core.annotation.NoSensitive;
 import org.springframework.cloud.openfeign.FeignClient;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -19,6 +20,7 @@ import com.ruoyi.system.api.model.LoginUser;
 * 
 * @author ruoyi
 */
+@NoSensitive
@FeignClient(contextId = "remoteUserService", value = ServiceNameConstants.SYSTEM_SERVICE, fallbackFactory = RemoteUserFallbackFactory.class)
 public interface RemoteUserService
 {
--- a/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/domain/SysUser.java
+++ b/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/domain/SysUser.java
@@ -3,6 +3,10 @@ package com.ruoyi.system.api.domain;
 import java.util.Date;
 import java.util.List;
 import javax.validation.constraints.*;
+
+import com.ruoyi.common.core.annotation.NoSensitive;
+import com.ruoyi.common.sensitive.annotation.Sensitive;
+import com.ruoyi.common.sensitive.enums.DesensitizedType;
 import org.apache.commons.lang3.builder.ToStringBuilder;
 import org.apache.commons.lang3.builder.ToStringStyle;
 import com.ruoyi.common.core.annotation.Excel;
@@ -44,6 +48,7 @@ public class SysUser extends BaseEntity

    /** 手机号码 */
    @Excel(name = "手机号码", cellType = ColumnType.TEXT)
+    @Sensitive(desensitizedType = DesensitizedType.PHONE)
    private String phonenumber;

    /** 用户性别 */
--- a/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/factory/RemoteFileFallbackFactory.java
+++ b/ruoyi-api/ruoyi-api-system/src/main/java/com/ruoyi/system/api/factory/RemoteFileFallbackFactory.java
@@ -30,6 +30,12 @@ public class RemoteFileFallbackFactory implements FallbackFactory<RemoteFileServ
            {
                return R.fail("上传文件失败:" + throwable.getMessage());
            }
+
+            @Override
+            public R<Boolean> delete(String fileUrl)
+            {
+                return R.fail("删除文件失败:" + throwable.getMessage());
+            }
        };
    }
 }
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/annotation/NoSensitive.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/annotation/NoSensitive.java
@@ -0,0 +1,15 @@
+package com.ruoyi.common.core.annotation;
+
+import java.lang.annotation.*;
+
+/**
+ * @Description “关闭” 数据脱敏
+ * @Author AhYi
+ * @Date 2025-07-07 10:23
+ */
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface NoSensitive {
+}
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/aspect/NoSensitiveAspect.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/aspect/NoSensitiveAspect.java
@@ -0,0 +1,29 @@
+package com.ruoyi.common.core.aspect;
+
+import com.ruoyi.common.core.annotation.NoSensitive;
+import com.ruoyi.common.core.context.SensitiveContextHolder;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.springframework.stereotype.Component;
+
+/**
+ * @Description @NoSensitive 注解切面，主要用户对方法的注解
+ * @Author AhYi
+ * @Date 2025-07-07 10:31
+ */
+
+@Aspect
+@Component
+public class NoSensitiveAspect {
+
+    @Around("@annotation(noSensitive)")
+    public Object around(ProceedingJoinPoint joinPoint, NoSensitive noSensitive) throws Throwable {
+        try {
+            SensitiveContextHolder.enterNoSensitiveScope();
+            return joinPoint.proceed();
+        } finally {
+            SensitiveContextHolder.exitNoSensitiveScope();
+        }
+    }
+}
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
@@ -120,7 +120,7 @@ public class Constants
    /**
     * 自动识别json对象白名单配置（仅允许解析的包名，范围越小越安全）
     */
-    public static final String[] JSON_WHITELIST_STR = { "org.springframework", "com.ruoyi" };
+    public static final String[] JSON_WHITELIST_STR = { "com.ruoyi" };

    /**
     * 定时任务白名单配置（仅允许访问的包名，如其他需要可以自行添加）
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/context/SensitiveContextHolder.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/context/SensitiveContextHolder.java
@@ -0,0 +1,36 @@
+package com.ruoyi.common.core.context;
+
+/**
+ * @Description Sensitive 数据脱敏上下文管理，存储当前线程是否需要脱敏
+ * @Author AhYi
+ * @Date 2025-07-07 10:27
+ */
+
+
+public class SensitiveContextHolder {
+    private static final ThreadLocal<Integer> COUNTER = new ThreadLocal<>();
+
+    public static void enterNoSensitiveScope() {
+        Integer count = COUNTER.get();
+        if (count == null) {
+            count = 0;
+        }
+        COUNTER.set(count + 1);
+    }
+
+    public static void exitNoSensitiveScope() {
+        Integer count = COUNTER.get();
+        if (count != null) {
+            if (count <= 1) {
+                COUNTER.remove();
+            } else {
+                COUNTER.set(count - 1);
+            }
+        }
+    }
+
+    public static boolean isNoSensitiveScope() {
+        Integer count = COUNTER.get();
+        return count != null && count > 0;
+    }
+}
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/file/FileUtils.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/file/FileUtils.java
@@ -114,20 +114,20 @@ public class FileUtils
    }

    /**
-     * 检查文件是否可下载
+     * 校验文件路径合法性（安全性与扩展名）
     * 
-     * @param resource 需要下载的文件
+     * @param fileUrl 待校验的文件地址
     * @return true 正常 false 非法
     */
-    public static boolean checkAllowDownload(String resource)
+    public static boolean validateFilePath(String fileUrl)
    {
        // 禁止目录上跳级别
-        if (StringUtils.contains(resource, ".."))
+        if (StringUtils.contains(fileUrl, ".."))
        {
            return false;
        }
        // 判断是否在允许下载的文件规则内
-        return ArrayUtils.contains(MimeTypeUtils.DEFAULT_ALLOWED_EXTENSION, FileTypeUtils.getFileType(resource));
+        return ArrayUtils.contains(MimeTypeUtils.DEFAULT_ALLOWED_EXTENSION, FileTypeUtils.getFileType(fileUrl));
    }

    /**
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
@@ -73,6 +73,8 @@ public class ExcelUtil<T>
 {
    private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class);

+    public static final String SEPARATOR = ",";
+
    public static final String FORMULA_REGEX_STR = "=|-|\\+|@";

    public static final String[] FORMULA_STR = { "=", "-", "+", "@" };
@@ -157,11 +159,6 @@ public class ExcelUtil<T>
     */
    private Map<Integer, Double> statistics = new HashMap<Integer, Double>();

-    /**
-     * 数字格式
-     */
-    private static final DecimalFormat DOUBLE_FORMAT = new DecimalFormat("######0.00");
-
    /**
     * 实体对象
     */
@@ -724,6 +721,7 @@ public class ExcelUtil<T>
        style = wb.createCellStyle();
        style.setAlignment(HorizontalAlignment.CENTER);
        style.setVerticalAlignment(VerticalAlignment.CENTER);
+        style.setDataFormat(dataFormat.getFormat("######0.00"));
        Font totalFont = wb.createFont();
        totalFont.setFontName("Arial");
        totalFont.setFontHeightInPoints((short) 10);
@@ -1130,7 +1128,7 @@ public class ExcelUtil<T>
    public static String convertByExp(String propertyValue, String converterExp, String separator)
    {
        StringBuilder propertyString = new StringBuilder();
-        String[] convertSource = converterExp.split(",");
+        String[] convertSource = converterExp.split(SEPARATOR);
        for (String item : convertSource)
        {
            String[] itemArray = item.split("=");
@@ -1167,7 +1165,7 @@ public class ExcelUtil<T>
    public static String reverseByExp(String propertyValue, String converterExp, String separator)
    {
        StringBuilder propertyString = new StringBuilder();
-        String[] convertSource = converterExp.split(",");
+        String[] convertSource = converterExp.split(SEPARATOR);
        for (String item : convertSource)
        {
            String[] itemArray = item.split("=");
@@ -1255,7 +1253,7 @@ public class ExcelUtil<T>
            {
                cell = row.createCell(key);
                cell.setCellStyle(styles.get("total"));
-                cell.setCellValue(DOUBLE_FORMAT.format(statistics.get(key)));
+                cell.setCellValue(statistics.get(key));
            }
            statistics.clear();
        }
--- a/ruoyi-common/ruoyi-common-security/src/main/java/com/ruoyi/common/security/interceptor/NoSensitiveInterceptor.java
+++ b/ruoyi-common/ruoyi-common-security/src/main/java/com/ruoyi/common/security/interceptor/NoSensitiveInterceptor.java
@@ -0,0 +1,43 @@
+package com.ruoyi.common.security.interceptor;
+
+import com.ruoyi.common.core.annotation.NoSensitive;
+import com.ruoyi.common.core.context.SensitiveContextHolder;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * @Description @NoSensitive 注解的请求拦截器，主要用于对请求的注解，在请求的整个生命周期内有效
+ * @Author AhYi
+ * @Date 2025-07-07 10:35
+ */
+
+public class NoSensitiveInterceptor implements HandlerInterceptor {
+    private static final String SENSITIVE_INTERCEPTOR_APPLIED = "SENSITIVE_INTERCEPTOR_APPLIED";
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        if (handler instanceof HandlerMethod) {
+            HandlerMethod handlerMethod = (HandlerMethod) handler;
+            NoSensitive noSensitive = handlerMethod.getMethodAnnotation(NoSensitive.class);
+            if (noSensitive == null) {
+                noSensitive = handlerMethod.getBeanType().getAnnotation(NoSensitive.class);
+            }
+            if (noSensitive != null) {
+                SensitiveContextHolder.enterNoSensitiveScope();
+                request.setAttribute(SENSITIVE_INTERCEPTOR_APPLIED, Boolean.TRUE);
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
+        Object applied = request.getAttribute(SENSITIVE_INTERCEPTOR_APPLIED);
+        if (applied != null && (Boolean) applied) {
+            SensitiveContextHolder.exitNoSensitiveScope();
+        }
+    }
+}
--- a/ruoyi-common/ruoyi-common-sensitive/src/main/java/com/ruoyi/common/sensitive/config/SensitiveJsonSerializer.java
+++ b/ruoyi-common/ruoyi-common-sensitive/src/main/java/com/ruoyi/common/sensitive/config/SensitiveJsonSerializer.java
@@ -10,6 +10,7 @@ import com.fasterxml.jackson.databind.SerializerProvider;
 import com.fasterxml.jackson.databind.ser.ContextualSerializer;
 import com.ruoyi.common.core.constant.UserConstants;
 import com.ruoyi.common.core.context.SecurityContextHolder;
+import com.ruoyi.common.core.context.SensitiveContextHolder;
 import com.ruoyi.common.sensitive.annotation.Sensitive;
 import com.ruoyi.common.sensitive.enums.DesensitizedType;

@@ -25,7 +26,7 @@ public class SensitiveJsonSerializer extends JsonSerializer<String> implements C
    @Override
    public void serialize(String value, JsonGenerator gen, SerializerProvider serializers) throws IOException
    {
-        if (desensitization())
+        if (desensitization() && !SensitiveContextHolder.isNoSensitiveScope())
        {
            gen.writeString(desensitizedType.desensitizer().apply(value));
        }
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/config/FilterConfig.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/config/FilterConfig.java
@@ -0,0 +1,46 @@
+package com.ruoyi.file.config;
+
+import java.util.HashMap;
+import java.util.Map;
+import javax.servlet.DispatcherType;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import com.ruoyi.file.filter.RefererFilter;
+
+/**
+ * Filter配置
+ *
+ * @author ruoyi
+ */
+@Configuration
+public class FilterConfig
+{
+    /**
+     * 资源映射路径 前缀
+     */
+    @Value("${file.prefix}")
+    public String localFilePrefix;
+    
+    @Value("${referer.allowed-domains}")
+    private String allowedDomains;
+    
+    @SuppressWarnings({"rawtypes", "unchecked"})
+    @Bean
+    @ConditionalOnProperty(value = "referer.enabled", havingValue = "true")
+    public FilterRegistrationBean refererFilterRegistration()
+    {
+        FilterRegistrationBean registration = new FilterRegistrationBean();
+        registration.setDispatcherTypes(DispatcherType.REQUEST);
+        registration.setFilter(new RefererFilter());
+        registration.addUrlPatterns(localFilePrefix + "/*");
+        registration.setName("refererFilter");
+        registration.setOrder(FilterRegistrationBean.HIGHEST_PRECEDENCE);
+        Map<String, String> initParameters = new HashMap<String, String>();
+        initParameters.put("allowedDomains", allowedDomains);
+        registration.setInitParameters(initParameters);
+        return registration;
+    }
+}
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/controller/SysFileController.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/controller/SysFileController.java
@@ -3,10 +3,12 @@ package com.ruoyi.file.controller;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
 import com.ruoyi.common.core.domain.R;
+import com.ruoyi.common.core.utils.StringUtils;
 import com.ruoyi.common.core.utils.file.FileUtils;
 import com.ruoyi.file.service.ISysFileService;
 import com.ruoyi.system.api.domain.SysFile;
@@ -45,4 +47,26 @@ public class SysFileController
            return R.fail(e.getMessage());
        }
    }
-}
+
+    /**
+     * 文件删除请求
+     */
+    @DeleteMapping("delete")
+    public R<Boolean> delete(String fileUrl)
+    {
+        try
+        {
+            if (!FileUtils.validateFilePath(fileUrl))
+            {
+                throw new Exception(StringUtils.format("资源文件({})非法，不允许删除。 ", fileUrl));
+            }
+            sysFileService.deleteFile(fileUrl);
+            return R.ok();
+        }
+        catch (Exception e)
+        {
+            log.error("删除文件失败", e);
+            return R.fail(e.getMessage());
+        }
+    }
+}
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/filter/RefererFilter.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/filter/RefererFilter.java
@@ -0,0 +1,77 @@
+package com.ruoyi.file.filter;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * 防盗链过滤器
+ * 
+ * @author ruoyi
+ */
+public class RefererFilter implements Filter
+{
+    /**
+     * 允许的域名列表
+     */
+    public List<String> allowedDomains;
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException
+    {
+        String domains = filterConfig.getInitParameter("allowedDomains");
+        this.allowedDomains = Arrays.asList(domains.split(","));
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException
+    {
+        HttpServletRequest req = (HttpServletRequest) request;
+        HttpServletResponse resp = (HttpServletResponse) response;
+
+        String referer = req.getHeader("Referer");
+
+        // 如果Referer为空，拒绝访问
+        if (referer == null || referer.isEmpty())
+        {
+            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied: Referer header is required");
+            return;
+        }
+
+        // 检查Referer是否在允许的域名列表中
+        boolean allowed = false;
+        for (String domain : allowedDomains)
+        {
+            if (referer.contains(domain))
+            {
+                allowed = true;
+                break;
+            }
+        }
+
+        // 根据检查结果决定是否放行
+        if (allowed)
+        {
+            chain.doFilter(request, response);
+        }
+        else
+        {
+            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied: Referer '" + referer + "' is not allowed");
+        }
+    }
+
+    @Override
+    public void destroy()
+    {
+
+    }
+}
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/FastDfsSysFileServiceImpl.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/FastDfsSysFileServiceImpl.java
@@ -1,11 +1,11 @@
 package com.ruoyi.file.service;

 import java.io.InputStream;
-import com.alibaba.nacos.common.utils.IoUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
+import com.alibaba.nacos.common.utils.IoUtils;
 import com.github.tobato.fastdfs.domain.fdfs.StorePath;
 import com.github.tobato.fastdfs.service.FastFileStorageClient;
 import com.ruoyi.common.core.utils.file.FileTypeUtils;
@@ -53,4 +53,24 @@ public class FastDfsSysFileServiceImpl implements ISysFileService
            IoUtils.closeQuietly(inputStream);
        }
    }
+
+    /**
+     * FastDFS文件删除接口
+     * 
+     * @param fileUrl 文件访问URL
+     * @throws Exception
+     */
+    @Override
+    public void deleteFile(String fileUrl) throws Exception
+    {
+        try
+        {
+            StorePath storePath = StorePath.parseFromUrl(fileUrl);
+            storageClient.deleteFile(storePath.getGroup(), storePath.getPath());
+        }
+        catch (Exception e)
+        {
+            throw new RuntimeException("FastDfs Failed to delete file: ", e);
+        }
+    }
 }
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/ISysFileService.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/ISysFileService.java
@@ -17,4 +17,12 @@ public interface ISysFileService
     * @throws Exception
     */
    public String uploadFile(MultipartFile file) throws Exception;
+
+    /**
+     * 文件删除接口
+     * 
+     * @param fileUrl 文件访问URL
+     * @throws Exception
+     */
+    public void deleteFile(String fileUrl) throws Exception;
 }
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/LocalSysFileServiceImpl.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/LocalSysFileServiceImpl.java
@@ -4,6 +4,8 @@ import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Primary;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
+import com.ruoyi.common.core.utils.StringUtils;
+import com.ruoyi.common.core.utils.file.FileUtils;
 import com.ruoyi.file.utils.FileUploadUtils;

 /**
@@ -47,4 +49,17 @@ public class LocalSysFileServiceImpl implements ISysFileService
        String url = domain + localFilePrefix + name;
        return url;
    }
+
+    /**
+     * 本地文件删除接口
+     * 
+     * @param fileUrl 文件访问URL
+     * @throws Exception
+     */
+    @Override
+    public void deleteFile(String fileUrl) throws Exception
+    {
+        String localFile = StringUtils.substringAfter(fileUrl, localFilePrefix);
+        FileUtils.deleteFile(localFilePath + localFile);
+    }
 }
--- a/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/MinioSysFileServiceImpl.java
+++ b/ruoyi-modules/ruoyi-file/src/main/java/com/ruoyi/file/service/MinioSysFileServiceImpl.java
@@ -5,10 +5,12 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
 import com.alibaba.nacos.common.utils.IoUtils;
+import com.ruoyi.common.core.utils.StringUtils;
 import com.ruoyi.file.config.MinioConfig;
 import com.ruoyi.file.utils.FileUploadUtils;
 import io.minio.MinioClient;
 import io.minio.PutObjectArgs;
+import io.minio.RemoveObjectArgs;

 /**
 * Minio 文件存储
@@ -57,4 +59,24 @@ public class MinioSysFileServiceImpl implements ISysFileService
            IoUtils.closeQuietly(inputStream);
        }
    }
+
+    /**
+     * Minio文件删除接口
+     * 
+     * @param fileUrl 文件访问URL
+     * @throws Exception
+     */
+    @Override
+    public void deleteFile(String fileUrl) throws Exception
+    {
+        try
+        {
+            String minioFile = StringUtils.substringAfter(fileUrl, minioConfig.getBucketName());
+            client.removeObject(RemoveObjectArgs.builder().bucket(minioConfig.getBucketName()).object(minioFile).build());
+        }
+        catch (Exception e)
+        {
+            throw new RuntimeException("Minio Failed to delete file", e);
+        }
+    }
 }
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/util/ScheduleUtils.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/util/ScheduleUtils.java
@@ -131,11 +131,11 @@ public class ScheduleUtils
        int count = StringUtils.countMatches(packageName, ".");
        if (count > 1)
        {
-            return StringUtils.containsAnyIgnoreCase(invokeTarget, Constants.JOB_WHITELIST_STR);
+            return StringUtils.startsWithAny(invokeTarget, Constants.JOB_WHITELIST_STR);
        }
        Object obj = SpringUtils.getBean(StringUtils.split(invokeTarget, ".")[0]);
        String beanPackageName = obj.getClass().getPackage().getName();
-        return StringUtils.containsAnyIgnoreCase(beanPackageName, Constants.JOB_WHITELIST_STR)
-                && !StringUtils.containsAnyIgnoreCase(beanPackageName, Constants.JOB_ERROR_STR);
+        return StringUtils.startsWithAny(beanPackageName, Constants.JOB_WHITELIST_STR)
+                && !StringUtils.startsWithAny(beanPackageName, Constants.JOB_ERROR_STR);
    }
 }
--- a/ruoyi-modules/ruoyi-system/pom.xml
+++ b/ruoyi-modules/ruoyi-system/pom.xml
@@ -71,6 +71,11 @@
            <artifactId>ruoyi-common-swagger</artifactId>
        </dependency>

+        <!-- RuoYi Common Sensitive -->
+        <dependency>
+            <groupId>com.ruoyi</groupId>
+            <artifactId>ruoyi-common-sensitive</artifactId>
+        </dependency>
    </dependencies>

    <build>
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/WebMvcConfig.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/WebMvcConfig.java
@@ -0,0 +1,23 @@
+package com.ruoyi.system;
+
+import com.ruoyi.common.security.interceptor.NoSensitiveInterceptor;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+/**
+ * @Description WebMvcConfig
+ * @Author AhYi
+ * @Date 2025-07-07 10:46
+ */
+
+@Configuration
+public class WebMvcConfig implements WebMvcConfigurer {
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(new NoSensitiveInterceptor())
+                .addPathPatterns("/**")
+                .order(-1);
+    }
+}
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysProfileController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysProfileController.java
@@ -2,6 +2,8 @@ package com.ruoyi.system.controller;

 import java.util.Arrays;
 import java.util.Map;
+
+import com.ruoyi.common.core.annotation.NoSensitive;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -49,6 +51,7 @@ public class SysProfileController extends BaseController
    /**
     * 个人信息
     */
+    @NoSensitive
    @GetMapping
    public AjaxResult profile()
    {
@@ -100,7 +103,7 @@ public class SysProfileController extends BaseController
        String oldPassword = params.get("oldPassword");
        String newPassword = params.get("newPassword");
        LoginUser loginUser = SecurityUtils.getLoginUser();
-        String userName = loginUser.getUsername();
+        Long userId = loginUser.getUserid();
        String password = loginUser.getSysUser().getPassword();
        if (!SecurityUtils.matchesPassword(oldPassword, password))
        {
@@ -111,7 +114,7 @@ public class SysProfileController extends BaseController
            return error("新密码不能与旧密码相同");
        }
        newPassword = SecurityUtils.encryptPassword(newPassword);
-        if (userService.resetUserPwd(userName, newPassword) > 0)
+        if (userService.resetUserPwd(userId, newPassword) > 0)
        {
            // 更新缓存用户密码&密码最后更新时间
            loginUser.getSysUser().setPwdUpdateDate(DateUtils.getNowDate());
@@ -143,8 +146,13 @@ public class SysProfileController extends BaseController
                return error("文件服务异常，请联系管理员");
            }
            String url = fileResult.getData().getUrl();
-            if (userService.updateUserAvatar(loginUser.getUsername(), url))
+            if (userService.updateUserAvatar(loginUser.getUserid(), url))
            {
+                String oldAvatarUrl = loginUser.getSysUser().getAvatar();
+                if (StringUtils.isNotEmpty(oldAvatarUrl))
+                {
+                    remoteFileService.delete(oldAvatarUrl);
+                }
                AjaxResult ajax = AjaxResult.success();
                ajax.put("imgUrl", url);
                // 更新缓存用户头像
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -6,6 +6,8 @@ import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
 import javax.servlet.http.HttpServletResponse;
+
+import com.ruoyi.common.core.annotation.NoSensitive;
 import org.apache.commons.lang3.ArrayUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.validation.annotation.Validated;
@@ -117,6 +119,7 @@ public class SysUserController extends BaseController
    /**
     * 获取当前用户信息
     */
+    @NoSensitive
    @InnerAuth
    @GetMapping("/info/{username}")
    public R<LoginUser> info(@PathVariable("username") String username)
@@ -163,7 +166,7 @@ public class SysUserController extends BaseController
    @PutMapping("/recordlogin")
    public R<Boolean> recordlogin(@RequestBody SysUser sysUser)
    {
-        return R.ok(userService.updateUserProfile(sysUser));
+        return R.ok(userService.updateLoginInfo(sysUser));
    }

    /**
@@ -171,6 +174,7 @@ public class SysUserController extends BaseController
     * 
     * @return 用户信息
     */
+    @NoSensitive
    @GetMapping("getInfo")
    public AjaxResult getInfo()
    {
@@ -221,6 +225,7 @@ public class SysUserController extends BaseController
    /**
     * 根据用户编号获取详细信息
     */
+    @NoSensitive
    @RequiresPermissions("system:user:query")
    @GetMapping(value = { "/", "/{userId}" })
    public AjaxResult getInfo(@PathVariable(value = "userId", required = false) Long userId)
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
@@ -70,20 +70,37 @@ public interface SysUserMapper
    /**
     * 修改用户头像
     * 
-     * @param userName 用户名
+     * @param userId 用户ID
     * @param avatar 头像地址
     * @return 结果
     */
-    public int updateUserAvatar(@Param("userName") String userName, @Param("avatar") String avatar);
+    public int updateUserAvatar(@Param("userId") Long userId, @Param("avatar") String avatar);
+
+    /**
+     * 修改用户状态
+     * 
+     * @param userId 用户ID
+     * @param status 状态
+     * @return 结果
+     */
+    public int updateUserStatus(@Param("userId") Long userId, @Param("status") String status);
+
+    /**
+     * 更新用户登录信息（IP和登录时间）
+     * 
+     * @param user 用户信息
+     * @return 结果
+     */
+    public int updateLoginInfo(SysUser user);

    /**
     * 重置用户密码
     * 
-     * @param userName 用户名
+     * @param userId 用户ID
     * @param password 密码
     * @return 结果
     */
-    public int resetUserPwd(@Param("userName") String userName, @Param("password") String password);
+    public int resetUserPwd(@Param("userId") Long userId, @Param("password") String password);

    /**
     * 通过用户ID删除用户
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/ISysUserService.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/ISysUserService.java
@@ -155,11 +155,19 @@ public interface ISysUserService
    /**
     * 修改用户头像
     * 
-     * @param userName 用户名
+     * @param userId 用户ID
     * @param avatar 头像地址
     * @return 结果
     */
-    public boolean updateUserAvatar(String userName, String avatar);
+    public boolean updateUserAvatar(Long userId, String avatar);
+
+    /**
+     * 更新用户登录信息（IP和登录时间）
+     * 
+     * @param user 用户信息
+     * @return 结果
+     */
+    public boolean updateLoginInfo(SysUser user);

    /**
     * 重置用户密码
@@ -172,11 +180,11 @@ public interface ISysUserService
    /**
     * 重置用户密码
     * 
-     * @param userName 用户名
+     * @param userId 用户ID
     * @param password 密码
     * @return 结果
     */
-    public int resetUserPwd(String userName, String password);
+    public int resetUserPwd(Long userId, String password);

    /**
     * 通过用户ID删除用户
--- a/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
+++ b/ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
@@ -326,7 +326,7 @@ public class SysUserServiceImpl implements ISysUserService
    @Override
    public int updateUserStatus(SysUser user)
    {
-        return userMapper.updateUser(user);
+        return userMapper.updateUserStatus(user.getUserId(), user.getStatus());
    }

    /**
@@ -344,14 +344,25 @@ public class SysUserServiceImpl implements ISysUserService
    /**
     * 修改用户头像
     * 
-     * @param userName 用户名
+     * @param userId 用户ID
     * @param avatar 头像地址
     * @return 结果
     */
    @Override
-    public boolean updateUserAvatar(String userName, String avatar)
+    public boolean updateUserAvatar(Long userId, String avatar)
    {
-        return userMapper.updateUserAvatar(userName, avatar) > 0;
+        return userMapper.updateUserAvatar(userId, avatar) > 0;
+    }
+
+    /**
+     * 更新用户登录信息（IP和登录时间）
+     * 
+     * @param user 用户信息
+     * @return 结果
+     */
+    public boolean updateLoginInfo(SysUser user)
+    {
+        return userMapper.updateLoginInfo(user) > 0;
    }

    /**
@@ -363,20 +374,20 @@ public class SysUserServiceImpl implements ISysUserService
    @Override
    public int resetPwd(SysUser user)
    {
-        return userMapper.updateUser(user);
+        return userMapper.resetUserPwd(user.getUserId(), user.getPassword());
    }

    /**
     * 重置用户密码
     * 
-     * @param userName 用户名
+     * @param userId 用户ID
     * @param password 密码
     * @return 结果
     */
    @Override
-    public int resetUserPwd(String userName, String password)
+    public int resetUserPwd(Long userId, String password)
    {
-        return userMapper.resetUserPwd(userName, password);
+        return userMapper.resetUserPwd(userId, password);
    }

    /**
@@ -517,6 +528,7 @@ public class SysUserServiceImpl implements ISysUserService
                    checkUserDataScope(u.getUserId());
                    deptService.checkDeptDataScope(user.getDeptId());
                    user.setUserId(u.getUserId());
+                    user.setDeptId(u.getDeptId());
                    user.setUpdateBy(operName);
                    userMapper.updateUser(user);
                    successNum++;
--- a/ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
+++ b/ruoyi-modules/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
@@ -19,13 +19,13 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        <result property="loginIp"       column="login_ip"        />
        <result property="loginDate"     column="login_date"      />
        <result property="pwdUpdateDate" column="pwd_update_date" />
-        <result property="createBy"     column="create_by"        />
-        <result property="createTime"   column="create_time"      />
-        <result property="updateBy"     column="update_by"        />
-        <result property="updateTime"   column="update_time"      />
-        <result property="remark"       column="remark"           />
-        <association property="dept"    javaType="SysDept"         resultMap="deptResult" />
-        <collection  property="roles"   javaType="java.util.List"  resultMap="RoleResult" />
+        <result property="createBy"      column="create_by"       />
+        <result property="createTime"    column="create_time"     />
+        <result property="updateBy"      column="update_by"       />
+        <result property="updateTime"    column="update_time"     />
+        <result property="remark"        column="remark"          />
+        <association property="dept"     javaType="SysDept"         resultMap="deptResult" />
+        <collection  property="roles"    javaType="java.util.List"  resultMap="RoleResult" />
    </resultMap>
 	
    <resultMap id="deptResult" type="SysDept">
@@ -180,7 +180,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
 	<update id="updateUser" parameterType="SysUser">
 		update sys_user
 		<set>
- 			<if test="deptId != null and deptId != 0">dept_id = #{deptId},</if>
+ 			<if test="deptId != 0">dept_id = #{deptId},</if>
 			<if test="nickName != null and nickName != ''">nick_name = #{nickName},</if>
 			<if test="email != null ">email = #{email},</if>
 			<if test="phonenumber != null ">phonenumber = #{phonenumber},</if>
@@ -198,15 +198,19 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
 	</update>
 	
 	<update id="updateUserStatus" parameterType="SysUser">
- 		update sys_user set status = #{status} where user_id = #{userId}
+ 		update sys_user set status = #{status}, update_time = sysdate() where user_id = #{userId}
 	</update>
 	
 	<update id="updateUserAvatar" parameterType="SysUser">
- 		update sys_user set avatar = #{avatar} where user_name = #{userName}
+ 		update sys_user set avatar = #{avatar}, update_time = sysdate() where user_id = #{userId}
+	</update>
+	
+  	<update id="updateLoginInfo" parameterType="SysUser">
+ 		update sys_user set login_ip = #{loginIp}, login_date = #{loginDate} where user_id = #{userId}
 	</update>
 	
 	<update id="resetUserPwd" parameterType="SysUser">
- 		update sys_user set pwd_update_date = sysdate(), password = #{password} where user_name = #{userName}
+ 		update sys_user set pwd_update_date = sysdate(), password = #{password}, update_time = sysdate() where user_id = #{userId}
 	</update>
 	
 	<delete id="deleteUserById" parameterType="Long">
--- a/ruoyi-ui/src/components/RightToolbar/index.vue
+++ b/ruoyi-ui/src/components/RightToolbar/index.vue
@@ -7,7 +7,7 @@
      <el-tooltip class="item" effect="dark" content="刷新" placement="top">
        <el-button size="mini" circle icon="el-icon-refresh" @click="refresh()" />
      </el-tooltip>
-      <el-tooltip class="item" effect="dark" content="显隐列" placement="top" v-if="columns">
+      <el-tooltip class="item" effect="dark" content="显隐列" placement="top" v-if="Object.keys(columns).length > 0">
        <el-button size="mini" circle icon="el-icon-menu" @click="showColumn()" v-if="showColumnsType == 'transfer'"/>
        <el-dropdown trigger="click" :hide-on-click="false" style="padding-left: 12px" v-if="showColumnsType == 'checkbox'">
          <el-button size="mini" circle icon="el-icon-menu" />
@@ -17,9 +17,9 @@
              <el-checkbox :indeterminate="isIndeterminate" v-model="isChecked" @change="toggleCheckAll"> 列展示 </el-checkbox>
            </el-dropdown-item>
            <div class="check-line"></div>
-            <template v-for="item in columns">
-              <el-dropdown-item :key="item.key">
-                <el-checkbox v-model="item.visible" @change="checkboxChange($event, item.label)" :label="item.label" />
+            <template v-for="(item, key) in columns">
+              <el-dropdown-item :key="key">
+                <el-checkbox v-model="item.visible" @change="checkboxChange($event, key)" :label="item.label" />
              </el-dropdown-item>
            </template>
          </el-dropdown-menu>
@@ -30,12 +30,13 @@
      <el-transfer
        :titles="['显示', '隐藏']"
        v-model="value"
-        :data="columns"
+        :data="transferData"
        @change="dataChange"
      ></el-transfer>
    </el-dialog>
  </div>
 </template>
+
 <script>
 export default {
  name: "RightToolbar",
@@ -55,9 +56,10 @@ export default {
      type: Boolean,
      default: true
    },
-    /* 显隐列信息 */
+    /* 显隐列信息（数组格式、对象格式） */
    columns: {
-      type: Array
+      type: [Array, Object],
+      default: () => ({})
    },
    /* 是否显示检索图标 */
    search: {
@@ -85,21 +87,36 @@ export default {
    },
    isChecked: {
      get() {
-        return this.columns.every((col) => col.visible)
+        return Array.isArray(this.columns) ? this.columns.every((col) => col.visible) : Object.values(this.columns).every((col) => col.visible)
      },
      set() {}
    },
    isIndeterminate() {
-      return this.columns.some((col) => col.visible) && !this.isChecked
+      return Array.isArray(this.columns) ? this.columns.some((col) => col.visible) && !this.isChecked : Object.values(this.columns).some((col) => col.visible) && !this.isChecked
+    },
+    transferData() {
+      if (Array.isArray(this.columns)) {
+        return this.columns.map((item, index) => ({ key: index, label: item.label }))
+      } else {
+        return Object.keys(this.columns).map((key, index) => ({ key: index, label: this.columns[key].label }))
+      }
    }
  },
  created() {
    if (this.showColumnsType == 'transfer') {
-      // 显隐列初始默认隐藏列
-      for (let item in this.columns) {
-        if (this.columns[item].visible === false) {
-          this.value.push(parseInt(item))
+      // transfer穿梭显隐列初始默认隐藏列
+      if (Array.isArray(this.columns)) {
+        for (let item in this.columns) {
+          if (this.columns[item].visible === false) {
+            this.value.push(parseInt(item))
+          }
        }
+      } else {
+        Object.keys(this.columns).forEach((key, index) => {
+          if (this.columns[key].visible === false) {
+            this.value.push(index)
+          }
+        })
      }
    }
  },
@@ -114,9 +131,15 @@ export default {
    },
    // 右侧列表元素变化
    dataChange(data) {
-      for (let item in this.columns) {
-        const key = this.columns[item].key
-        this.columns[item].visible = !data.includes(key)
+      if (Array.isArray(this.columns)) {
+        for (let item in this.columns) {
+          const key = this.columns[item].key
+          this.columns[item].visible = !data.includes(key)
+        }
+      } else {
+        Object.keys(this.columns).forEach((key, index) => {
+          this.columns[key].visible = !data.includes(index)
+        })
      }
    },
    // 打开显隐列dialog
@@ -124,17 +147,26 @@ export default {
      this.open = true
    },
    // 单勾选
-    checkboxChange(event, label) {
-      this.columns.filter(item => item.label == label)[0].visible = event
+    checkboxChange(event, key) {
+      if (Array.isArray(this.columns)) {
+        this.columns.filter(item => item.key == key)[0].visible = event
+      } else {
+        this.columns[key].visible = event
+      }
    },
    // 切换全选/反选
    toggleCheckAll() {
      const newValue = !this.isChecked
-      this.columns.forEach((col) => (col.visible = newValue))
+      if (Array.isArray(this.columns)) {
+        this.columns.forEach((col) => (col.visible = newValue))
+      } else {
+        Object.values(this.columns).forEach((col) => (col.visible = newValue))
+      }
    }
  },
 }
 </script>
+
 <style lang="scss" scoped>
 ::v-deep .el-transfer__button {
  border-radius: 50%;
--- a/ruoyi-ui/src/layout/components/Navbar.vue
+++ b/ruoyi-ui/src/layout/components/Navbar.vue
@@ -34,15 +34,14 @@
          <router-link to="/user/profile">
            <el-dropdown-item>个人中心</el-dropdown-item>
          </router-link>
+          <el-dropdown-item @click.native="setLayout" v-if="setting">
+            <span>布局设置</span>
+          </el-dropdown-item>
          <el-dropdown-item divided @click.native="logout">
            <span>退出登录</span>
          </el-dropdown-item>
        </el-dropdown-menu>
      </el-dropdown>
-
-      <div class="right-menu-item hover-effect setting" @click="setLayout" v-if="setting">
-        <svg-icon icon-class="more-up" />
-      </div>
    </div>
  </div>
 </template>
@@ -178,6 +177,7 @@ export default {

      .avatar-wrapper {
        margin-top: 10px;
+        right: 8px;
        position: relative;

        .user-avatar {
@@ -190,6 +190,7 @@ export default {
        .user-nickname{
          position: relative;
          bottom: 10px;
+          left: 2px;
          font-size: 14px;
          font-weight: bold;
        }
--- a/ruoyi-ui/src/views/index.vue
+++ b/ruoyi-ui/src/views/index.vue
@@ -81,10 +81,10 @@
              >
            </p>
            <p>
-              <i class="el-icon-user-solid"></i> QQ群： <s> 满42799195 </s>  <s> 满170157040 </s>
+              <i class="el-icon-user-solid"></i> QQ群： <s> 满42799195  </s> <s> 满170157040 </s>
              <s> 满130643120 </s> <s> 满225920371 </s> <s> 满201705537 </s> <s> 满236543183 </s>
              <s> 满213618602 </s> <s> 满148794840 </s> <s> 满118752664 </s> <s> 满101038945 </s>
-              <s> 满128355254 </s> <s> 满179219821 </s> <a href="http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Z6j1amUmIPBXamuZzxpwjY8GwaP45XB6&authKey=zfSnxECfnScfY1HLCWilSqCq%2BmSVtr%2Bi%2F4oXeBcuQVwlq6XlrAfbZ0awp3%2B4Bdec&noverify=0&group_code=158753145" target="_blank">158753145</a>
+              <s> 满128355254 </s> <s> 满179219821 </s> <s> 满158753145 </s> <a href="http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=jR7HqTiLzuLocIH6aNNtTW3LlCV8UQ6d&authKey=GJZj%2Bnwmsvk6j%2FWrX7FKstAaRjgUC1WL%2F%2B8aVTaPbHX5wOimH5q9igaOSXP7cF9L&noverify=0&group_code=112869560" target="_blank">112869560</a>
            </p>
            <p>
              <i class="el-icon-chat-dot-round"></i> 微信：<a
--- a/ruoyi-ui/src/views/system/user/index.vue
+++ b/ruoyi-ui/src/views/system/user/index.vue
@@ -58,17 +58,17 @@

            <el-table v-loading="loading" :data="userList" @selection-change="handleSelectionChange">
              <el-table-column type="selection" width="50" align="center" />
-              <el-table-column label="用户编号" align="center" key="userId" prop="userId" v-if="columns[0].visible" />
-              <el-table-column label="用户名称" align="center" key="userName" prop="userName" v-if="columns[1].visible" :show-overflow-tooltip="true" />
-              <el-table-column label="用户昵称" align="center" key="nickName" prop="nickName" v-if="columns[2].visible" :show-overflow-tooltip="true" />
-              <el-table-column label="部门" align="center" key="deptName" prop="dept.deptName" v-if="columns[3].visible" :show-overflow-tooltip="true" />
-              <el-table-column label="手机号码" align="center" key="phonenumber" prop="phonenumber" v-if="columns[4].visible" width="120" />
-              <el-table-column label="状态" align="center" key="status" v-if="columns[5].visible">
+              <el-table-column label="用户编号" align="center" key="userId" prop="userId" v-if="columns.userId.visible" />
+              <el-table-column label="用户名称" align="center" key="userName" prop="userName" v-if="columns.userName.visible" :show-overflow-tooltip="true" />
+              <el-table-column label="用户昵称" align="center" key="nickName" prop="nickName" v-if="columns.nickName.visible" :show-overflow-tooltip="true" />
+              <el-table-column label="部门" align="center" key="deptName" prop="dept.deptName" v-if="columns.deptName.visible" :show-overflow-tooltip="true" />
+              <el-table-column label="手机号码" align="center" key="phonenumber" prop="phonenumber" v-if="columns.phonenumber.visible" width="120" />
+              <el-table-column label="状态" align="center" key="status" v-if="columns.status.visible">
                <template slot-scope="scope">
                  <el-switch v-model="scope.row.status" active-value="0" inactive-value="1" @change="handleStatusChange(scope.row)"></el-switch>
                </template>
              </el-table-column>
-              <el-table-column label="创建时间" align="center" prop="createTime" v-if="columns[6].visible" width="160">
+              <el-table-column label="创建时间" align="center" prop="createTime" v-if="columns.createTime.visible" width="160">
                <template slot-scope="scope">
                  <span>{{ parseTime(scope.row.createTime) }}</span>
                </template>
@@ -277,15 +277,15 @@ export default {
        deptId: undefined
      },
      // 列信息
-      columns: [
-        { key: 0, label: `用户编号`, visible: true },
-        { key: 1, label: `用户名称`, visible: true },
-        { key: 2, label: `用户昵称`, visible: true },
-        { key: 3, label: `部门`, visible: true },
-        { key: 4, label: `手机号码`, visible: true },
-        { key: 5, label: `状态`, visible: true },
-        { key: 6, label: `创建时间`, visible: true }
-      ],
+      columns: {
+        userId: { label: '用户编号', visible: true },
+        userName: { label: '用户名称', visible: true },
+        nickName: { label: '用户昵称', visible: true },
+        deptName: { label: '部门', visible: true },
+        phonenumber: { label: '手机号码', visible: true },
+        status: { label: '状态', visible: true },
+        createTime: { label: '创建时间', visible: true }
+      },
      // 表单校验
      rules: {
        userName: [
@@ -546,6 +546,11 @@ export default {
    },
    // 提交上传文件
    submitFileForm() {
+      const file = this.$refs.upload.uploadFiles
+      if (!file || file.length === 0 || !file[0].name.toLowerCase().endsWith('.xls') && !file[0].name.toLowerCase().endsWith('.xlsx')) {
+        this.$modal.msgError("请选择后缀为 “xls”或“xlsx”的文件。")
+        return
+      }
      this.$refs.upload.submit()
    }
  }
--- a/sql/ry_config_20250902.sql
+++ b/sql/ry_config_20250902.sql
@@ -40,7 +40,7 @@ insert into config_info(id, data_id, group_id, content, md5, gmt_create, gmt_mod
 (5,'ruoyi-system-dev.yml','DEFAULT_GROUP','# spring配置\nspring:\n  redis:\n    host: localhost\n    port: 6379\n    password: \n  datasource:\n    druid:\n      stat-view-servlet:\n        enabled: true\n        loginUsername: ruoyi\n        loginPassword: 123456\n    dynamic:\n      druid:\n        initial-size: 5\n        min-idle: 5\n        maxActive: 20\n        maxWait: 60000\n        connectTimeout: 30000\n        socketTimeout: 60000\n        timeBetweenEvictionRunsMillis: 60000\n        minEvictableIdleTimeMillis: 300000\n        validationQuery: SELECT 1 FROM DUAL\n        testWhileIdle: true\n        testOnBorrow: false\n        testOnReturn: false\n        poolPreparedStatements: true\n        maxPoolPreparedStatementPerConnectionSize: 20\n        filters: stat,slf4j\n        connectionProperties: druid.stat.mergeSql\\=true;druid.stat.slowSqlMillis\\=5000\n      datasource:\n          # 主库数据源\n          master:\n            driver-class-name: com.mysql.cj.jdbc.Driver\n            url: jdbc:mysql://localhost:3306/ry-cloud?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8\n            username: root\n            password: password\n          # 从库数据源\n          # slave:\n            # username: \n            # password: \n            # url: \n            # driver-class-name: \n\n# mybatis配置\nmybatis:\n    # 搜索指定包别名\n    typeAliasesPackage: com.ruoyi.system\n    # 配置mapper的扫描，找到所有的mapper.xml映射文件\n    mapperLocations: classpath:mapper/**/*.xml\n\n# springdoc配置\nspringdoc:\n  gatewayUrl: http://localhost:8080/${spring.application.name}\n  api-docs:\n    # 是否开启接口文档\n    enabled: true\n  info:\n    # 标题\n    title: \'系统模块接口文档\'\n    # 描述\n    description: \'系统模块接口描述\'\n    # 作者信息\n    contact:\n      name: RuoYi\n      url: https://ruoyi.vip\n','786c7daf4543411fc65c3e48dfb15243','2020-11-20 00:00:00','2024-09-02 12:14:33','nacos','0:0:0:0:0:0:0:1','','','系统模块','null','null','yaml','',''),
 (6,'ruoyi-gen-dev.yml','DEFAULT_GROUP','# spring配置\nspring:\n  redis:\n    host: localhost\n    port: 6379\n    password: \n  datasource:\n    driver-class-name: com.mysql.cj.jdbc.Driver\n    url: jdbc:mysql://localhost:3306/ry-cloud?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8\n    username: root\n    password: password\n\n# mybatis配置\nmybatis:\n    # 搜索指定包别名\n    typeAliasesPackage: com.ruoyi.gen.domain\n    # 配置mapper的扫描，找到所有的mapper.xml映射文件\n    mapperLocations: classpath:mapper/**/*.xml\n\n# springdoc配置\nspringdoc:\n  gatewayUrl: http://localhost:8080/${spring.application.name}\n  api-docs:\n    # 是否开启接口文档\n    enabled: true\n  info:\n    # 标题\n    title: \'代码生成接口文档\'\n    # 描述\n    description: \'代码生成接口描述\'\n    # 作者信息\n    contact:\n      name: RuoYi\n      url: https://ruoyi.vip\n\n# 代码生成\ngen:\n  # 作者\n  author: ruoyi\n  # 默认生成包路径 system 需改成自己的模块名称 如 system monitor tool\n  packageName: com.ruoyi.system\n  # 自动去除表前缀，默认是false\n  autoRemovePre: false\n  # 表前缀（生成类名不会包含表前缀，多个用逗号分隔）\n  tablePrefix: sys_\n  # 是否允许生成文件覆盖到本地（自定义路径），默认不允许\n  allowOverwrite: false','43d807aa0a4accbb193b6dc7e38ac8a3','2020-11-20 00:00:00','2024-12-25 08:29:33','nacos','0:0:0:0:0:0:0:1','','','代码生成','null','null','yaml','',''),
 (7,'ruoyi-job-dev.yml','DEFAULT_GROUP','# spring配置\nspring:\n  redis:\n    host: localhost\n    port: 6379\n    password: \n  datasource:\n    driver-class-name: com.mysql.cj.jdbc.Driver\n    url: jdbc:mysql://localhost:3306/ry-cloud?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8\n    username: root\n    password: password\n\n# mybatis配置\nmybatis:\n    # 搜索指定包别名\n    typeAliasesPackage: com.ruoyi.job.domain\n    # 配置mapper的扫描，找到所有的mapper.xml映射文件\n    mapperLocations: classpath:mapper/**/*.xml\n\n# springdoc配置\nspringdoc:\n  gatewayUrl: http://localhost:8080/${spring.application.name}\n  api-docs:\n    # 是否开启接口文档\n    enabled: true\n  info:\n    # 标题\n    title: \'定时任务接口文档\'\n    # 描述\n    description: \'定时任务接口描述\'\n    # 作者信息\n    contact:\n      name: RuoYi\n      url: https://ruoyi.vip\n','f78483f845777335b9ed4a9f84758848','2020-11-20 00:00:00','2024-09-02 12:14:56','nacos','0:0:0:0:0:0:0:1','','','定时任务','null','null','yaml','',''),
-(8,'ruoyi-file-dev.yml','DEFAULT_GROUP','# 本地文件上传    \r\nfile:\r\n    domain: http://127.0.0.1:9300\r\n    path: D:/ruoyi/uploadPath\r\n    prefix: /statics\r\n\r\n# FastDFS配置\r\nfdfs:\r\n  domain: http://8.129.231.12\r\n  soTimeout: 3000\r\n  connectTimeout: 2000\r\n  trackerList: 8.129.231.12:22122\r\n\r\n# Minio配置\r\nminio:\r\n  url: http://8.129.231.12:9000\r\n  accessKey: minioadmin\r\n  secretKey: minioadmin\r\n  bucketName: test','5382b93f3d8059d6068c0501fdd41195','2020-11-20 00:00:00','2020-12-21 21:01:59',NULL,'0:0:0:0:0:0:0:1','','','文件服务','null','null','yaml',NULL,''),
+(8,'ruoyi-file-dev.yml','DEFAULT_GROUP','# 本地文件上传    \nfile:\n    domain: http://127.0.0.1:9300\n    path: D:/ruoyi/uploadPath\n    prefix: /statics\n\n# FastDFS配置\nfdfs:\n  domain: http://127.0.0.1\n  soTimeout: 3000\n  connectTimeout: 2000\n  trackerList: 127.0.0.1:22122\n\n# Minio配置\nminio:\n  url: http://127.0.0.1:9000\n  accessKey: minioadmin\n  secretKey: minioadmin\n  bucketName: test\n\n  # 防盗链配置\nreferer:\n  # 防盗链开关\n  enabled: false\n  # 允许的域名列表\n  allowed-domains: localhost,127.0.0.1,ruoyi.vip,www.ruoyi.vip\n','095791a04211d6e3d294359b21357394','2020-11-20 00:00:00','2025-09-02 05:10:11','nacos','0:0:0:0:0:0:0:1','','','文件服务','null','null','yaml','',''),
 (9,'sentinel-ruoyi-gateway','DEFAULT_GROUP','[\r\n    {\r\n        \"resource\": \"ruoyi-auth\",\r\n        \"count\": 500,\r\n        \"grade\": 1,\r\n        \"limitApp\": \"default\",\r\n        \"strategy\": 0,\r\n        \"controlBehavior\": 0\r\n    },\r\n	{\r\n        \"resource\": \"ruoyi-system\",\r\n        \"count\": 1000,\r\n        \"grade\": 1,\r\n        \"limitApp\": \"default\",\r\n        \"strategy\": 0,\r\n        \"controlBehavior\": 0\r\n    },\r\n	{\r\n        \"resource\": \"ruoyi-gen\",\r\n        \"count\": 200,\r\n        \"grade\": 1,\r\n        \"limitApp\": \"default\",\r\n        \"strategy\": 0,\r\n        \"controlBehavior\": 0\r\n    },\r\n	{\r\n        \"resource\": \"ruoyi-job\",\r\n        \"count\": 300,\r\n        \"grade\": 1,\r\n        \"limitApp\": \"default\",\r\n        \"strategy\": 0,\r\n        \"controlBehavior\": 0\r\n    }\r\n]','9f3a3069261598f74220bc47958ec252','2020-11-20 00:00:00','2020-11-20 00:00:00',NULL,'0:0:0:0:0:0:0:1','','','限流策略','null','null','json',NULL,'');
Author	SHA1	Message	Date
AhYi	93bb6914f9	Pre Merge pull request !421 from AhYi/master	2025-09-02 05:27:31 +00:00
RuoYi	1d2c8378f7	文件支持防盗链配置	2025-09-02 13:26:33 +08:00
RuoYi	50a9337ee8	优化代码	2025-08-28 13:51:15 +08:00
RuoYi	e6a3415a71	优化代码	2025-08-27 16:01:28 +08:00
RuoYi	7919af54da	用户导入添加验证提示	2025-08-23 11:46:49 +08:00
RuoYi	3503005f9d	优化布局设置显示	2025-08-23 11:46:39 +08:00
RuoYi	b304a41194	修复用户归属部门无法修改为空问题	2025-08-21 14:59:10 +08:00
RuoYi	a39ae33c82	columns default value	2025-08-09 16:13:49 +08:00
RuoYi	b9a27657c5	显示列信息支持对象格式	2025-08-09 15:19:13 +08:00
RuoYi	2e009841ca	自动识别json对象白名单配置范围缩小	2025-08-09 15:18:29 +08:00
RuoYi	2cbe4a8234	升级tomcat到最新版本9.0.108	2025-08-09 15:17:10 +08:00
RuoYi	4b37049713	添加新群号：112869560	2025-07-19 19:28:44 +08:00
ayi	2622d9147e	增加 @NoSensitive 注解 - 在 SysUser 实体类中为手机号码字段添加 @Sensitive 注解 - 新增 @NoSensitive 注解和相关切面、拦截器，用于 “关闭” 数据脱敏 - 在用户信息相关接口中添加 @NoSensitive 注解，以 “关闭” 数据脱敏 - 新增 WebMvcConfig 配置类，注册 NoSensitiveInterceptor 拦截器	2025-07-07 11:10:52 +08:00
RuoYi	e549210ad6	优化定时任务包名白名单匹配方式	2025-06-20 11:56:03 +08:00
RuoYi	ad988d54bb	优化Excel统计行数值的单元格样式显示	2025-06-19 14:54:00 +08:00
RuoYi	51a6fce0a5	升级tomcat到最新版本9.0.106	2025-06-18 13:41:37 +08:00
RuoYi	c86bfa9243	用户头像更换后移除旧头像文件	2025-06-06 19:36:36 +08:00