【修改】各类bug修复

jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java

@@ -4,6 +4,7 @@ import cn.hutool.crypto.SecureUtil;
 import lombok.extern.slf4j.Slf4j;
 import com.jero.common.exception.JeroBootException;
 import javax.servlet.http.HttpServletRequest;
+import java.util.regex.Pattern;
 
 /**
  * sql注入处理工具类
@@ -51,6 +52,8 @@ public class SqlInjectionUtil {
 		}
 		// 统一转为小写
 		value = value.toLowerCase();
+		value = value.replaceAll("/\\*.*\\*/","");
+
 		String[] xssArr = xssStr.split("\\|");
 		for (int i = 0; i < xssArr.length; i++) {
 			if (value.indexOf(xssArr[i]) > -1) {
@@ -59,6 +62,9 @@ public class SqlInjectionUtil {
 				throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
 			}
 		}
+		if(Pattern.matches("show\\s+tables", value)){
+			throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
+		}
 		return;
 	}
 
@@ -76,6 +82,8 @@ public class SqlInjectionUtil {
 			}
 			// 统一转为小写
 			value = value.toLowerCase();
+			value = value.replaceAll("/\\*.*\\*/","");
+
 			for (int i = 0; i < xssArr.length; i++) {
 				if (value.indexOf(xssArr[i]) > -1) {
 					log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
@@ -83,6 +91,9 @@ public class SqlInjectionUtil {
 					throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
 				}
 			}
+			if(Pattern.matches("show\\s+tables", value)){
+				throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
+			}
 		}
 		return;
 	}
@@ -101,6 +112,8 @@ public class SqlInjectionUtil {
 		}
 		// 统一转为小写
 		value = value.toLowerCase();
+		value = value.replaceAll("/\\*.*\\*/","");
+
 		for (int i = 0; i < xssArr.length; i++) {
 			if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
 				log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
@@ -108,6 +121,9 @@ public class SqlInjectionUtil {
 				throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
 			}
 		}
+		if(Pattern.matches("show\\s+tables", value)){
+			throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
+		}
 		return;
 	}
 
@@ -126,6 +142,8 @@ public class SqlInjectionUtil {
 		}
 		// 统一转为小写
 		value = value.toLowerCase();
+		value = value.replaceAll("/\\*.*\\*/","");
+
 		for (int i = 0; i < xssArr.length; i++) {
 			if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
 				log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
@@ -133,6 +151,9 @@ public class SqlInjectionUtil {
 				throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
 			}
 		}
+		if(Pattern.matches("show\\s+tables", value)){
+			throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
+		}
 		return;
 	}
 

jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroConfig.java

@@ -58,7 +58,7 @@ public class ShiroConfig {
      * 2、当设置多个过滤器时，全部验证通过，才视为通过
      * 3、部分过滤器可指定参数，如perms，roles
      */
-    @Bean("shiroFilter")
+    @Bean("shiroFilterFactoryBean")
     public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
         CustomShiroFilterFactoryBean shiroFilterFactoryBean = new CustomShiroFilterFactoryBean();
         shiroFilterFactoryBean.setSecurityManager(securityManager);

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java

@@ -83,6 +83,12 @@ public class CommonController {
         Result<OSSFile> result = new Result<>();
         String savePath = "";
         String bizPath = request.getParameter("biz");
+
+        //sys/common/upload接口存在任意文件上传漏洞
+        if (oConvertUtils.isNotEmpty(bizPath) && (bizPath.contains("../") || bizPath.contains("..\\"))) {
+            throw new JeroBootException("上传目录bizPath，格式非法！");
+        }
+
         MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
         // 获取上传文件对象
         MultipartFile file = multipartRequest.getFile("file");

jero-boot/pom.xml

@@ -36,7 +36,7 @@
 		<commons.version>2.6</commons.version>
 		<aliyun-java-sdk-dysmsapi.version>2.1.0</aliyun-java-sdk-dysmsapi.version>
 		<aliyun.oss.version>3.11.2</aliyun.oss.version>
-		<shiro.version>1.7.1</shiro.version>
+		<shiro.version>1.8.0</shiro.version>
 		<java-jwt.version>3.11.0</java-jwt.version>
 		<shiro-redis.version>3.1.0</shiro-redis.version>
 		<autopoi-web.version>1.3.6</autopoi-web.version>
@@ -44,6 +44,7 @@
 		<justauth-spring-boot-starter.version>1.3.4</justauth-spring-boot-starter.version>
 		<dom4j.version>1.6.1</dom4j.version>
 		<qiniu-java-sdk.version>7.4.0</qiniu-java-sdk.version>
+		<log4j2.version>2.15.0</log4j2.version>
 	</properties>
 
 	<modules>

jero-web/package.json

@@ -11,7 +11,6 @@
   },
   "dependencies": {
     "@antv/data-set": "^0.11.4",
-    "@tinymce/tinymce-vue": "^2.1.0",
     "@toast-ui/editor": "^2.1.2",
     "ant-design-vue": "^1.7.2",
     "china-area-data": "^5.0.1",
@@ -29,7 +28,8 @@
     "lodash.pick": "^4.4.0",
     "md5": "^2.2.1",
     "nprogress": "^0.2.0",
-    "tinymce": "^5.3.2",
+    "@tinymce/tinymce-vue": "2.1.0",
+    "tinymce": "5.4.1",
     "viser-vue": "^2.4.8",
     "vue": "^2.6.10",
     "vue-area-linkage": "^5.1.0",

jero-web/src/components/jero/JEasyCron/EasyCron.vue

@@ -144,8 +144,12 @@ export default {
       const v = this.cronValue_c
       if (this.hideYear || this.hideSecond) return v
       const vs = v.split(' ')
+      if (vs.length >= 6) {
+        // 将 Quartz 星期 的规则转换为 CronParser 的规则
+        vs[5] = this.convertQuartzWeekToCParser(vs[5])
+      }
       return vs.slice(0, vs.length - 1).join(' ')
-    }
+    },
   },
   watch: {
     cronValue(newVal, oldVal) {

jero-web/src/components/jero/JEasyCron/tabs/const.js

@@ -1,11 +1,11 @@
 export const WEEK_MAP_EN = {
-  'SUN': '0',
+  'SUN': '1',
-  'MON': '1',
+  'MON': '2',
-  'TUE': '2',
+  'TUE': '3',
-  'WED': '3',
+  'WED': '4',
-  'THU': '4',
+  'THU': '5',
-  'FRI': '5',
+  'FRI': '6',
-  'SAT': '6'
+  'SAT': '7'
 }
 
 export const replaceWeekName = (c) => {
@@ -14,7 +14,7 @@ export const replaceWeekName = (c) => {
     Object.keys(WEEK_MAP_EN).forEach(k => {
       c = c.replace(new RegExp(k, 'g'), WEEK_MAP_EN[k])
     })
-    c = c.replace(new RegExp('7', 'g'), '0')
+    // c = c.replace(new RegExp('7', 'g'), '0')
   }
   // console.info('after: ' + c)
   return c

jero-web/src/components/jero/JEasyCron/tabs/week.vue

@@ -51,14 +51,14 @@ import mixin from './mixin'
 import { replaceWeekName, WEEK_MAP_EN } from './const.js'
 
 const WEEK_MAP = {
-  '周一': 1,
+  '周一': 2,
-  '周二': 2,
+  '周二': 3,
-  '周三': 3,
+  '周三': 4,
-  '周四': 4,
+  '周四': 5,
-  '周五': 5,
+  '周五': 6,
-  '周六': 6,
+  '周六': 7,
   // 按照国人习惯，将周日放到每周的最后一天
-  '周日': 7,
+  '周日': 1,
 }
 
 export default {

jero-web/src/components/jerobiz/JSelectBizComponent/JSelectBizComponentModal.vue

@@ -62,8 +62,9 @@
   import { getAction } from '@/api/manage'
   import Ellipsis from '@/components/Ellipsis'
   import { JeroListMixin } from '@/mixins/JeroListMixin'
-  import { cloneObject, pushIfNotExist } from '@/utils/util'
+  import { pushIfNotExist } from '@/utils/util'
   import JSelectBizQueryItem from './JSelectBizQueryItem'
+  import {cloneDeep} from 'lodash'
 
   export default {
     name: 'JSelectBizComponentModal',
@@ -177,11 +178,22 @@
     computed: {
       // 表头
       innerColumns() {
-        let columns = cloneObject(this.columns)
+        let columns = cloneDeep(this.columns)
         columns.forEach(column => {
           // 给所有的列加上过长裁剪
           if (this.ellipsisLength !== -1) {
-            column.customRender = (text) => this.renderEllipsis(text)
+            let myCustomRender = column.customRender
+            column.customRender = (text, record, index) => {
+              let value = text
+              if (typeof myCustomRender === 'function') {
+                // noinspection JSVoidFunctionReturnValueUsed
+                value = myCustomRender(text, record, index)
+              }
+              if (typeof value === 'string') {
+                return this.renderEllipsis(value)
+              }
+              return value
+            }
           }
         })
         return columns
@@ -192,7 +204,7 @@
         deep: true,
         immediate: true,
         handler(val) {
-          this.innerValue = cloneObject(val)
+          this.innerValue = cloneDeep(val)
           this.selectedRowKeys = []
           this.valueWatchHandler(val)
           this.queryOptionsByValue(val)

jero-web/src/components/jerobiz/modal/JSelectUserByDepModal.vue

@@ -21,8 +21,8 @@
             :dropdownStyle="{maxHeight:'200px',overflow:'auto'}"
             :treeData="departTree"
             :expandAction="false"
-            :expandedKeys.sync="expandedKeys"
             @select="onDepSelect"
+            :load-data="onLoadDepartment"
           />
         </a-card>
       </a-col>
@@ -63,7 +63,7 @@
 
 <script>
   import {filterObj} from '@/utils/util'
-  import {queryDepartTreeList, getUserList, queryUserByDepId} from '@/api/api'
+  import {queryDepartTreeList, getUserList, queryUserByDepId, queryDepartTreeSync} from '@/api/api'
   import { getAction } from '@/api/manage'
 
   export default {
@@ -300,14 +300,35 @@
         })
       },
       queryDepartTree() {
-        queryDepartTreeList().then((res) => {
+        //update-begin-author:taoyan date:20211202 for: 异步加载部门树 https://github.com/jeecgboot/jeecg-boot/issues/3196
+        this.expandedKeys = []
+        this.departTree = []
+        queryDepartTreeSync().then((res) => {
           if (res.success) {
-            this.departTree = res.result;
+            for (let i = 0; i < res.result.length; i++) {
-            // 默认展开父节点
+              let temp = res.result[i]
-            this.expandedKeys = this.departTree.map(item => item.id)
+              this.departTree.push(temp)
+            }
           }
         })
       },
+      onLoadDepartment(treeNode){
+        return new Promise(resolve => {
+          queryDepartTreeSync({pid:treeNode.dataRef.id}).then((res) =>  {
+            if (res.success) {
+              //判断chidlren是否为空，并修改isLeaf属性值
+              if(res.result.length == 0){
+                treeNode.dataRef['isLeaf']=true
+                return;
+              }else{
+                treeNode.dataRef['children']= res.result;
+              }
+            }
+          })
+          resolve();
+        });
+      },
+      //update-end-author:taoyan date:20211202 for: 异步加载部门树 https://github.com/jeecgboot/jeecg-boot/issues/3196
       modalFormOk() {
         this.loadData();
       }

jero-web/src/components/page/GlobalHeader.vue

@@ -150,10 +150,10 @@
             this.topMenuStyle.headerIndexRight = {}
             this.topMenuStyle.headerIndexLeft = {}
           } else {
-            let rightWidth = '360px'
+            let rightWidth = '400px'
             this.topMenuStyle.topNavHeader = { 'min-width': '165px' }
             this.topMenuStyle.topSmenuStyle = { 'width': 'calc(100% - 165px)' }
-            this.topMenuStyle.headerIndexRight = { 'min-width': rightWidth }
+            this.topMenuStyle.headerIndexRight = { 'min-width': rightWidth, 'white-space': 'nowrap' }
             this.topMenuStyle.headerIndexLeft = { 'width': `calc(100% - ${rightWidth})` }
           }
         }

jero-web/src/mixins/JeroListMixin.js

@@ -146,6 +146,9 @@ export const JeroListMixin = {
     },
     searchQuery() {
       this.loadData(1);
+      // 点击查询清空列表选中行
+      this.selectedRowKeys = []
+      this.selectionRows = []
     },
     superQuery() {
       this.$refs.superQueryModal.show();