Skip to content

Commit 954859b

Browse files
奇淼（piexlmaxbypanghutesunpncktask
authored
修复漏洞，重构初始化功能，优化媒体库 (#1024)
* 媒体库增加 普通上传、压缩上传按钮，方便媒体库直接上传图片 * 增加数据类型切换后的的校验，避免使用错误的查询条件和字典条件。 * refactor: 重构初始化逻辑 * 媒体库功能丰富 * 修复注入漏洞和路径穿越 * 修复自动化接口获取数据库表失败后未能终止的bug * 微调媒体库样式 Co-authored-by: bypanghu <bypanghu@163.com> Co-authored-by: tesun <36953434+tesun@users.noreply.github.com> Co-authored-by: pnck <hio131@gmail.com> Co-authored-by: task <121913992@qq.com>
1 parent 4d43583 commit 954859b

40 files changed

+1352
-778
lines changed

‎server/api/v1/example/exa_excel.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
package example
22

33
import (
4-
"os"
5-
64
"github.com/flipped-aurora/gin-vue-admin/server/global"
75
"github.com/flipped-aurora/gin-vue-admin/server/model/common/response"
86
"github.com/flipped-aurora/gin-vue-admin/server/model/example"
97
"github.com/gin-gonic/gin"
108
"go.uber.org/zap"
9+
"os"
10+
"strings"
1111
)
1212

1313
type ExcelApi struct{}
@@ -28,6 +28,10 @@ type ExcelApi struct{}
2828
func (e *ExcelApi) ExportExcel(c *gin.Context) {
2929
var excelInfo example.ExcelInfo
3030
_ = c.ShouldBindJSON(&excelInfo)
31+
if strings.Index(excelInfo.FileName, "..") > -1 {
32+
response.FailWithMessage("包含非法字符", c)
33+
return
34+
}
3135
filePath := global.GVA_CONFIG.Excel.Dir + excelInfo.FileName
3236
err := excelService.ParseInfoList2Excel(excelInfo.InfoList, filePath)
3337
if err != nil {

‎server/api/v1/example/exa_file_upload_download.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,18 @@ func (u *FileUploadAndDownloadApi) UploadFile(c *gin.Context) {
3838
response.OkWithDetailed(exampleRes.ExaFileResponse{File: file}, "上传成功", c)
3939
}
4040

41+
// EditFileName 编辑文件名或者备注
42+
func (u *FileUploadAndDownloadApi) EditFileName(c *gin.Context) {
43+
var file example.ExaFileUploadAndDownload
44+
_ = c.ShouldBindJSON(&file)
45+
if err := fileUploadAndDownloadService.EditFileName(file); err != nil {
46+
global.GVA_LOG.Error("编辑失败!", zap.Error(err))
47+
response.FailWithMessage("编辑失败", c)
48+
return
49+
}
50+
response.OkWithMessage("编辑成功", c)
51+
}
52+
4153
// @Tags ExaFileUploadAndDownload
4254
// @Summary 删除文件
4355
// @Security ApiKeyAuth

‎server/api/v1/system/sys_auto_code.go

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,9 @@ func (autoApi *AutoCodeApi) GetDB(c *gin.Context) {
104104
if err != nil {
105105
global.GVA_LOG.Error("获取失败!", zap.Error(err))
106106
response.FailWithMessage("获取失败", c)
107+
} else {
108+
response.OkWithDetailed(gin.H{"dbs": dbs}, "获取成功", c)
107109
}
108-
response.OkWithDetailed(gin.H{"dbs": dbs}, "获取成功", c)
109110
}
110111

111112
// GetTables
@@ -142,11 +143,11 @@ func (autoApi *AutoCodeApi) GetColumn(c *gin.Context) {
142143
if err != nil {
143144
global.GVA_LOG.Error("获取失败!", zap.Error(err))
144145
response.FailWithMessage("获取失败", c)
146+
} else {
147+
response.OkWithDetailed(gin.H{"columns": columns}, "获取成功", c)
145148
}
146-
response.OkWithDetailed(gin.H{"columns": columns}, "获取成功", c)
147149
}
148150

149-
150151
// CreatePackage
151152
// @Tags AutoCode
152153
// @Summary 创建package
@@ -172,7 +173,6 @@ func (autoApi *AutoCodeApi) CreatePackage(c *gin.Context) {
172173
}
173174
}
174175

175-
176176
// GetPackage
177177
// @Tags AutoCode
178178
// @Summary 获取package
@@ -182,17 +182,15 @@ func (autoApi *AutoCodeApi) CreatePackage(c *gin.Context) {
182182
// @Success 200 {object} response.Response{data=map[string]interface{},msg=string} "创建package成功"
183183
// @Router /autoCode/getPackage [post]
184184
func (autoApi *AutoCodeApi) GetPackage(c *gin.Context) {
185-
pkgs,err := autoCodeService.GetPackage()
185+
pkgs, err := autoCodeService.GetPackage()
186186
if err != nil {
187187
global.GVA_LOG.Error("获取失败!", zap.Error(err))
188188
response.FailWithMessage("获取失败", c)
189189
} else {
190-
response.OkWithDetailed(gin.H{"pkgs": pkgs},"获取成功", c)
190+
response.OkWithDetailed(gin.H{"pkgs": pkgs}, "获取成功", c)
191191
}
192192
}
193193

194-
195-
196194
// DelPackage
197195
// @Tags AutoCode
198196
// @Summary 删除package

‎server/initialize/ensure_tables.go

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
package initialize
2+
3+
import (
4+
"context"
5+
adapter "github.com/casbin/gorm-adapter/v3"
6+
"github.com/flipped-aurora/gin-vue-admin/server/model/example"
7+
sysModel "github.com/flipped-aurora/gin-vue-admin/server/model/system"
8+
"github.com/flipped-aurora/gin-vue-admin/server/service/system"
9+
"gorm.io/gorm"
10+
)
11+
12+
const initOrderEnsureTables = system.InitOrderExternal - 1
13+
14+
type ensureTables struct{}
15+
16+
// auto run
17+
func init() {
18+
system.RegisterInit(initOrderEnsureTables, &ensureTables{})
19+
}
20+
21+
func (ensureTables) InitializerName() string {
22+
return "ensure_tables_created"
23+
}
24+
func (e *ensureTables) InitializeData(ctx context.Context) (next context.Context, err error) {
25+
return ctx, nil
26+
}
27+
28+
func (e *ensureTables) DataInserted(ctx context.Context) bool {
29+
return true
30+
}
31+
32+
func (e *ensureTables) MigrateTable(ctx context.Context) (context.Context, error) {
33+
db, ok := ctx.Value("db").(*gorm.DB)
34+
if !ok {
35+
return ctx, system.ErrMissingDBContext
36+
}
37+
tables := []interface{}{
38+
sysModel.SysApi{},
39+
sysModel.SysUser{},
40+
sysModel.SysBaseMenu{},
41+
sysModel.SysAuthority{},
42+
sysModel.JwtBlacklist{},
43+
sysModel.SysDictionary{},
44+
sysModel.SysAutoCodeHistory{},
45+
sysModel.SysOperationRecord{},
46+
sysModel.SysDictionaryDetail{},
47+
sysModel.SysBaseMenuParameter{},
48+
sysModel.SysBaseMenuBtn{},
49+
sysModel.SysAuthorityBtn{},
50+
sysModel.SysAutoCode{},
51+
52+
adapter.CasbinRule{},
53+
54+
example.ExaFile{},
55+
example.ExaCustomer{},
56+
example.ExaFileChunk{},
57+
example.ExaFileUploadAndDownload{},
58+
}
59+
for _, t := range tables {
60+
_ = db.AutoMigrate(&t)
61+
// 视图 authority_menu 会被当成表来创建，引发冲突错误（更新版本的gorm似乎不会）
62+
// 由于 AutoMigrate() 基本无需考虑错误，因此显式忽略
63+
}
64+
return ctx, nil
65+
}
66+
67+
func (e *ensureTables) TableCreated(ctx context.Context) bool {
68+
db, ok := ctx.Value("db").(*gorm.DB)
69+
if !ok {
70+
return false
71+
}
72+
tables := []interface{}{
73+
sysModel.SysApi{},
74+
sysModel.SysUser{},
75+
sysModel.SysBaseMenu{},
76+
sysModel.SysAuthority{},
77+
sysModel.JwtBlacklist{},
78+
sysModel.SysDictionary{},
79+
sysModel.SysAutoCodeHistory{},
80+
sysModel.SysOperationRecord{},
81+
sysModel.SysDictionaryDetail{},
82+
sysModel.SysBaseMenuParameter{},
83+
sysModel.SysBaseMenuBtn{},
84+
sysModel.SysAuthorityBtn{},
85+
sysModel.SysAutoCode{},
86+
87+
adapter.CasbinRule{},
88+
89+
example.ExaFile{},
90+
example.ExaCustomer{},
91+
example.ExaFileChunk{},
92+
example.ExaFileUploadAndDownload{},
93+
}
94+
yes := true
95+
for _, t := range tables {
96+
yes = yes && db.Migrator().HasTable(t)
97+
}
98+
return yes
99+
}

‎server/initialize/register_init.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
package initialize
2+
3+
import (
4+
_ "github.com/flipped-aurora/gin-vue-admin/server/source/example"
5+
_ "github.com/flipped-aurora/gin-vue-admin/server/source/system"
6+
)
7+
8+
func init() {
9+
// do nothing,only import source package so that inits can be registered
10+
}

‎server/model/common/request/common.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ package request
44
type PageInfo struct {
55
Page int `json:"page" form:"page"` // 页码
66
PageSize int `json:"pageSize" form:"pageSize"` // 每页大小
7+
Keyword string `json:"keyword" form:"keyword"` //关键字
78
}
89

910
// GetById Find by id structure

‎server/model/example/exa_file_upload_download.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,7 @@ type ExaFileUploadAndDownload struct {
1111
Tag string `json:"tag" gorm:"comment:文件标签"` // 文件标签
1212
Key string `json:"key" gorm:"comment:编号"` // 编号
1313
}
14+
15+
func (ExaFileUploadAndDownload) TableName() string {
16+
return "exa_file_upload_and_downloads"
17+
}

‎server/model/system/sys_api.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,7 @@ type SysApi struct {
1111
ApiGroup string `json:"apiGroup" gorm:"comment:api组"` // api组
1212
Method string `json:"method" gorm:"default:POST;comment:方法"` // 方法:创建POST(默认)|查看GET|更新PUT|删除DELETE
1313
}
14+
15+
func (SysApi) TableName() string {
16+
return "sys_apis"
17+
}

‎server/model/system/sys_authority.go

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,19 @@ import (
55
)
66

77
type SysAuthority struct {
8-
CreatedAt time.Time // 创建时间
9-
UpdatedAt time.Time // 更新时间
10-
DeletedAt *time.Time `sql:"index"`
11-
AuthorityId string `json:"authorityId" gorm:"not null;unique;primary_key;comment:角色ID;size:90"` // 角色ID
12-
AuthorityName string `json:"authorityName" gorm:"comment:角色名"` // 角色名
13-
ParentId string `json:"parentId" gorm:"comment:父角色ID"` // 父角色ID
14-
DataAuthorityId []SysAuthority `json:"dataAuthorityId" gorm:"many2many:sys_data_authority_id"`
15-
Children []SysAuthority `json:"children" gorm:"-"`
16-
SysBaseMenus []SysBaseMenu `json:"menus" gorm:"many2many:sys_authority_menus;"`
17-
Users []SysUser `json:"-" gorm:"many2many:sys_user_authority;"`
18-
DefaultRouter string `json:"defaultRouter" gorm:"comment:默认菜单;default:dashboard"` // 默认菜单(默认dashboard)
8+
CreatedAt time.Time // 创建时间
9+
UpdatedAt time.Time // 更新时间
10+
DeletedAt *time.Time `sql:"index"`
11+
AuthorityId string `json:"authorityId" gorm:"not null;unique;primary_key;comment:角色ID;size:90"` // 角色ID
12+
AuthorityName string `json:"authorityName" gorm:"comment:角色名"` // 角色名
13+
ParentId string `json:"parentId" gorm:"comment:父角色ID"` // 父角色ID
14+
DataAuthorityId []*SysAuthority `json:"dataAuthorityId" gorm:"many2many:sys_data_authority_id;"`
15+
Children []SysAuthority `json:"children" gorm:"-"`
16+
SysBaseMenus []SysBaseMenu `json:"menus" gorm:"many2many:sys_authority_menus;"`
17+
Users []SysUser `json:"-" gorm:"many2many:sys_user_authority;"`
18+
DefaultRouter string `json:"defaultRouter" gorm:"comment:默认菜单;default:dashboard"` // 默认菜单(默认dashboard)
19+
}
20+
21+
func (SysAuthority) TableName() string {
22+
return "sys_authorities"
1923
}

‎server/model/system/sys_base_menu.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,7 @@ type SysBaseMenuParameter struct {
3535
Key string `json:"key" gorm:"comment:地址栏携带参数的key"` // 地址栏携带参数的key
3636
Value string `json:"value" gorm:"comment:地址栏携带参数的值"` // 地址栏携带参数的值
3737
}
38+
39+
func (SysBaseMenu) TableName() string {
40+
return "sys_base_menus"
41+
}

0 commit comments

Comments
 (0)