struts 开发的blog系统（有漏洞）

package com.tarena.blog.action; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.struts.action.ActionForm; import org.apache.struts.action.ActionForward; import org.apache.struts.action.ActionMapping; import org.apache.struts.actions.MappingDispatchAction; import java.util.ArrayList; import java.util.Collection; import java.util.Date; import java.util.List; import com.tarena.blog.dao.SystemDAO; import com.tarena.blog.dao.impl.SystemDAOImpl; import com.tarena.blog.entity.Blog; import com.tarena.blog.entity.Type; import com.tarena.blog.entity.BlogComment; import com.tarena.blog.entity.User; import com.tarena.blog.service.BlogService; import com.tarena.blog.service.impl.BlogServiceImpl; import com.tarena.blog.util.PageParameter; import com.tarena.blog.util.QueryResult; import com.tarena.blog.util.TokenUtil; public class BlogAction extends MappingDispatchAction { BlogService b=new BlogServiceImpl(); int bid=0; public ActionForward blog(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { // TODO Auto-generated method stub分页显示日志 及日志类型 User u =(User) request.getSession().getAttribute("domainUser"); String page= request.getParameter("page"); String type= request.getParameter("type"); int num=PageParameter.BLOG_ITEMS_EACH_PAGE; int ipage=1; if(page!=null&&!page.matches("^[0-9]{0,9}$")){ request.getSession().setAttribute("info","访问错误，请<a href='/Blog/login.jsp'>返回</a>"); return mapping.findForward("fail"); } if (page!=null) ipage = Integer.parseInt(page); List<Type> types = b.findAllType(u.getId()); QueryResult<Blog> qr=null; String path=null; if(type==null){ qr=b.findAll(u.getId(), ipage, num);//获得用户的所有日志 path="/Blog/blog.do?assise="; }else{ qr=b.findAllByType(u.getId(),Integer.parseInt(type),ipage,num); path="/Blog/blog.do?assise=&type="+type; } if(qr!=null){ long tpage=(qr.getCount()%num==0)?(qr.getCount()/num):(qr.getCount()/num)+1; path=PageParameter.pageNavigator((int)tpage, ipage, path); request.getSession().setAttribute("type", types); request.setAttribute("blog", qr.getData()); request.setAttribute("page", path); } return mapping.findForward("success"); } public ActionForward sendComment(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { User u = (User) request.getSession().getAttribute("domainUser"); String nickname=request.getParameter("nickname"); String content=request.getParameter("content"); //String blogid=request.getParameter("blogid"); BlogComment bc=new BlogComment(); Blog blog= b.findSingleBlog(bid); bc.setBlog(blog); bc.setName(nickname); bc.setBlog(blog); bc.setContent(content); Date date = new Date(); bc.setPublishTime(date); blog.addComments(bc); b.addBlogCom(bc); blog= b.findSingleBlog(bid); request.getSession().setAttribute("blog", blog); return mapping.findForward("success"); } public ActionForward publish(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { return mapping.findForward("success"); } public ActionForward blogByType(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { Blog b =(Blog) request.getSession().getAttribute("type"); return null; } public ActionForward singleblog(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { User u = (User) request.getSession().getAttribute("domainUser"); String blogid= request.getParameter("blogid"); bid=Integer.parseInt(blogid); Blog blog= b.findSingleBlog(bid); System.out.println(blog.getTitle()); Collection<BlogComment> com=blog.getComments(); request.setAttribute("blog", blog); request.setAttribute("blogcontent", com); return mapping.findForward("success"); } public ActionForward addblog(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { request.getParameter("token"); request.getSession().getAttribute("token"); if(!TokenUtil.validate(request)){ request.setAttribute("info", "验证码输入错误，请重新输入<a href='/Blog/publish.do'>返回</a>"); return mapping.findForward("fail"); }else{ User u=(User) request.getSession().getAttribute("loginUser"); String content=request.getParameter("editor_body"); String title =request.getParameter("blog_title"); String type=request.getParameter("publish_type"); List<Type> ts=(List<Type>) request.getSession().getAttribute("type"); Blog bg =new Blog(); bg.setContent(content); bg.setTitle(title); bg.setPublishTime(new Date()); bg.setUser(u); Type tp = null; for (int i=0;i<ts.size();i++){ System.out.println(i); System.out.println(ts.get(i).getTypeName()); if(ts.get(i).getTypeName().equals(type)){ tp=ts.get(i); } } if(tp==null){ tp = new Type(); tp.setTypeName(type); } bg.setType(tp); b.addBlog(bg); return mapping.findForward("success"); } } public ActionForward token(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception { String word=TokenUtil.createToken(); request.getSession().setAttribute("token", word); TokenUtil.responseToken(word, response); return null; } }