KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.图片导出报错，本地upload情况下，ImageBasePath未设置

Browse Source 
2.重复check接口，sql注入检查
3.导入excel校验示例代码
4.文档地址写错了
This commit is contained in:
zhangdaiscott
2021-02-01 20:37:56 +08:00
parent c1ea85fe01
commit 53d410896a
4 changed files with 49 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jeecg-boot/jeecg-boot-base/jeecg-boot-base-core/pom.xml
+1 -1
View File
@@ -196,7 +196,7 @@
</dependency> </dependency>
<!-- 代码生成器 --> <!-- 代码生成器 -->
<!-- 如下载失败，请参考此文档 http://doc.jeecg.com/1273965 --> <!-- 如下载失败，请参考此文档 http://doc.jeecg.com/2043876 -->
<dependency> <dependency>
<groupId>org.jeecgframework.boot</groupId> <groupId>org.jeecgframework.boot</groupId>
<artifactId>codegenerate</artifactId> <artifactId>codegenerate</artifactId>
jeecg-boot/jeecg-boot-base/jeecg-boot-base-core/src/main/java/org/jeecg/common/system/base/controller/JeecgController.java
+8 -1
View File
@@ -15,6 +15,7 @@ import org.jeecgframework.poi.excel.entity.ExportParams;
import org.jeecgframework.poi.excel.entity.ImportParams; import org.jeecgframework.poi.excel.entity.ImportParams;
import org.jeecgframework.poi.excel.view.JeecgEntityExcelView; import org.jeecgframework.poi.excel.view.JeecgEntityExcelView;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.multipart.MultipartFile; import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.multipart.MultipartHttpServletRequest; import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.ModelAndView;
@@ -38,6 +39,8 @@ public class JeecgController<T, S extends IService<T>> {
@Autowired @Autowired
S service; S service;
@Value("${jeecg.path.upload}")
private String upLoadPath;
/** /**
* 导出excel * 导出excel
* *
@@ -65,7 +68,11 @@ public class JeecgController<T, S extends IService<T>> {
ModelAndView mv = new ModelAndView(new JeecgEntityExcelView()); ModelAndView mv = new ModelAndView(new JeecgEntityExcelView());
mv.addObject(NormalExcelConstants.FILE_NAME, title); //此处设置的filename无效 ,前端会重更新设置一下 mv.addObject(NormalExcelConstants.FILE_NAME, title); //此处设置的filename无效 ,前端会重更新设置一下
mv.addObject(NormalExcelConstants.CLASS, clazz); mv.addObject(NormalExcelConstants.CLASS, clazz);
mv.addObject(NormalExcelConstants.PARAMS, new ExportParams(title + "报表", "导出人:" + sysUser.getRealname(), title)); //update-begin--Author:liusq Date:20210126 for：图片导出报错，ImageBasePath未设置--------------------
ExportParams exportParams=new ExportParams(title + "报表", "导出人:" + sysUser.getRealname(), title);
exportParams.setImageBasePath(upLoadPath);
//update-end--Author:liusq Date:20210126 for：图片导出报错，ImageBasePath未设置----------------------
mv.addObject(NormalExcelConstants.PARAMS,exportParams);
mv.addObject(NormalExcelConstants.DATA_LIST, exportList); mv.addObject(NormalExcelConstants.DATA_LIST, exportList);
return mv; return mv;
} }
jeecg-boot/jeecg-boot-module-system/src/main/java/org/jeecg/modules/system/controller/DuplicateCheckController.java
+10 -6
View File
@@ -1,9 +1,11 @@
package org.jeecg.modules.system.controller; package org.jeecg.modules.system.controller;
import javax.servlet.http.HttpServletRequest; import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang.StringUtils; import org.apache.commons.lang.StringUtils;
import org.jeecg.common.api.vo.Result; import org.jeecg.common.api.vo.Result;
import org.jeecg.common.util.SqlInjectionUtil;
import org.jeecg.modules.system.mapper.SysDictMapper; import org.jeecg.modules.system.mapper.SysDictMapper;
import org.jeecg.modules.system.model.DuplicateCheckVo; import org.jeecg.modules.system.model.DuplicateCheckVo;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
@@ -11,9 +13,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import io.swagger.annotations.Api; import javax.servlet.http.HttpServletRequest;
import io.swagger.annotations.ApiOperation;
import lombok.extern.slf4j.Slf4j;
/** /**
* @Title: DuplicateCheckAction * @Title: DuplicateCheckAction
@@ -29,7 +29,7 @@ import lombok.extern.slf4j.Slf4j;
public class DuplicateCheckController { public class DuplicateCheckController {
@Autowired @Autowired
SysDictMapper sysDictMapper; SysDictMapper sysDictMapper;
/** /**
* 校验数据是否在系统中是否存在 * 校验数据是否在系统中是否存在
@@ -42,6 +42,10 @@ public class DuplicateCheckController {
Long num = null; Long num = null;
log.info("----duplicate check------："+ duplicateCheckVo.toString()); log.info("----duplicate check------："+ duplicateCheckVo.toString());
//关联表字典（举例：sys_user,realname,id）
//SQL注入校验（只限制非法串改数据库）
final String[] sqlInjCheck = {duplicateCheckVo.getTableName(),duplicateCheckVo.getFieldName()};
SqlInjectionUtil.filterContent(sqlInjCheck);
if (StringUtils.isNotBlank(duplicateCheckVo.getDataId())) { if (StringUtils.isNotBlank(duplicateCheckVo.getDataId())) {
// [2].编辑页面校验 // [2].编辑页面校验
num = sysDictMapper.duplicateCheckCountSql(duplicateCheckVo); num = sysDictMapper.duplicateCheckCountSql(duplicateCheckVo);
jeecg-boot/jeecg-boot-module-system/src/main/java/org/jeecg/modules/system/controller/SysDictController.java
+30 -29
View File
@@ -26,11 +26,11 @@ import org.jeecg.modules.system.model.TreeSelectModel;
import org.jeecg.modules.system.service.ISysDictItemService; import org.jeecg.modules.system.service.ISysDictItemService;
import org.jeecg.modules.system.service.ISysDictService; import org.jeecg.modules.system.service.ISysDictService;
import org.jeecg.modules.system.vo.SysDictPage; import org.jeecg.modules.system.vo.SysDictPage;
import org.jeecgframework.poi.excel.ExcelImportCheckUtil;
import org.jeecgframework.poi.excel.ExcelImportUtil; import org.jeecgframework.poi.excel.ExcelImportUtil;
import org.jeecgframework.poi.excel.def.NormalExcelConstants; import org.jeecgframework.poi.excel.def.NormalExcelConstants;
import org.jeecgframework.poi.excel.entity.ExportParams; import org.jeecgframework.poi.excel.entity.ExportParams;
import org.jeecgframework.poi.excel.entity.ImportParams; import org.jeecgframework.poi.excel.entity.ImportParams;
import org.jeecgframework.poi.excel.entity.result.ExcelImportResult;
import org.jeecgframework.poi.excel.view.JeecgEntityExcelView; import org.jeecgframework.poi.excel.view.JeecgEntityExcelView;
import org.springframework.beans.BeanUtils; import org.springframework.beans.BeanUtils;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
@@ -66,8 +66,8 @@ public class SysDictController {
public RedisTemplate<String, Object> redisTemplate; public RedisTemplate<String, Object> redisTemplate;
@RequestMapping(value = "/list", method = RequestMethod.GET) @RequestMapping(value = "/list", method = RequestMethod.GET)
public Result<IPage<SysDict>> queryPageList(SysDict sysDict,@RequestParam(name="pageNo", defaultValue="1") Integer pageNo, public Result<IPage<SysDict>> queryPageList(SysDict sysDict, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@RequestParam(name="pageSize", defaultValue="10") Integer pageSize,HttpServletRequest req) { @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
Result<IPage<SysDict>> result = new Result<IPage<SysDict>>(); Result<IPage<SysDict>> result = new Result<IPage<SysDict>>();
QueryWrapper<SysDict> queryWrapper = QueryGenerator.initQueryWrapper(sysDict, req.getParameterMap()); QueryWrapper<SysDict> queryWrapper = QueryGenerator.initQueryWrapper(sysDict, req.getParameterMap());
Page<SysDict> page = new Page<SysDict>(pageNo, pageSize); Page<SysDict> page = new Page<SysDict>(pageNo, pageSize);
@@ -91,8 +91,8 @@ public class SysDictController {
*/ */
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
@RequestMapping(value = "/treeList", method = RequestMethod.GET) @RequestMapping(value = "/treeList", method = RequestMethod.GET)
public Result<List<SysDictTree>> treeList(SysDict sysDict,@RequestParam(name="pageNo", defaultValue="1") Integer pageNo, public Result<List<SysDictTree>> treeList(SysDict sysDict, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@RequestParam(name="pageSize", defaultValue="10") Integer pageSize,HttpServletRequest req) { @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
Result<List<SysDictTree>> result = new Result<>(); Result<List<SysDictTree>> result = new Result<>();
LambdaQueryWrapper<SysDict> query = new LambdaQueryWrapper<>(); LambdaQueryWrapper<SysDict> query = new LambdaQueryWrapper<>();
// 构造查询条件 // 构造查询条件
@@ -118,7 +118,7 @@ public class SysDictController {
* @return * @return
*/ */
@RequestMapping(value = "/getDictItems/{dictCode}", method = RequestMethod.GET) @RequestMapping(value = "/getDictItems/{dictCode}", method = RequestMethod.GET)
public Result<List<DictModel>> getDictItems(@PathVariable String dictCode, @RequestParam(value = "sign",required = false) String sign,HttpServletRequest request) { public Result<List<DictModel>> getDictItems(@PathVariable String dictCode, @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) {
log.info(" dictCode : "+ dictCode); log.info(" dictCode : "+ dictCode);
Result<List<DictModel>> result = new Result<List<DictModel>>(); Result<List<DictModel>> result = new Result<List<DictModel>>();
List<DictModel> ls = null; List<DictModel> ls = null;
@@ -203,9 +203,9 @@ public class SysDictController {
*/ */
@RequestMapping(value = "/loadDict/{dictCode}", method = RequestMethod.GET) @RequestMapping(value = "/loadDict/{dictCode}", method = RequestMethod.GET)
public Result<List<DictModel>> loadDict(@PathVariable String dictCode, public Result<List<DictModel>> loadDict(@PathVariable String dictCode,
@RequestParam(name="keyword") String keyword, @RequestParam(name="keyword") String keyword,
@RequestParam(value = "sign",required = false) String sign, @RequestParam(value = "sign",required = false) String sign,
@RequestParam(value = "pageSize", required = false) Integer pageSize) { @RequestParam(value = "pageSize", required = false) Integer pageSize) {
log.info(" 加载字典表数据,加载关键字: "+ keyword); log.info(" 加载字典表数据,加载关键字: "+ keyword);
Result<List<DictModel>> result = new Result<List<DictModel>>(); Result<List<DictModel>> result = new Result<List<DictModel>>();
List<DictModel> ls = null; List<DictModel> ls = null;
@@ -240,7 +240,7 @@ public class SysDictController {
* 根据字典code加载字典text 返回 * 根据字典code加载字典text 返回
*/ */
@RequestMapping(value = "/loadDictItem/{dictCode}", method = RequestMethod.GET) @RequestMapping(value = "/loadDictItem/{dictCode}", method = RequestMethod.GET)
public Result<List<String>> loadDictItem(@PathVariable String dictCode,@RequestParam(name="key") String keys, @RequestParam(value = "sign",required = false) String sign,HttpServletRequest request) { public Result<List<String>> loadDictItem(@PathVariable String dictCode, @RequestParam(name="key") String keys, @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) {
Result<List<String>> result = new Result<>(); Result<List<String>> result = new Result<>();
try { try {
if(dictCode.indexOf(",")!=-1) { if(dictCode.indexOf(",")!=-1) {
@@ -271,13 +271,13 @@ public class SysDictController {
*/ */
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
@RequestMapping(value = "/loadTreeData", method = RequestMethod.GET) @RequestMapping(value = "/loadTreeData", method = RequestMethod.GET)
public Result<List<TreeSelectModel>> loadTreeData(@RequestParam(name="pid") String pid,@RequestParam(name="pidField") String pidField, public Result<List<TreeSelectModel>> loadTreeData(@RequestParam(name="pid") String pid, @RequestParam(name="pidField") String pidField,
@RequestParam(name="tableName") String tbname, @RequestParam(name="tableName") String tbname,
@RequestParam(name="text") String text, @RequestParam(name="text") String text,
@RequestParam(name="code") String code, @RequestParam(name="code") String code,
@RequestParam(name="hasChildField") String hasChildField, @RequestParam(name="hasChildField") String hasChildField,
@RequestParam(name="condition") String condition, @RequestParam(name="condition") String condition,
@RequestParam(value = "sign",required = false) String sign,HttpServletRequest request) { @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) {
Result<List<TreeSelectModel>> result = new Result<List<TreeSelectModel>>(); Result<List<TreeSelectModel>> result = new Result<List<TreeSelectModel>>();
Map<String, String> query = null; Map<String, String> query = null;
if(oConvertUtils.isNotEmpty(condition)) { if(oConvertUtils.isNotEmpty(condition)) {
@@ -293,17 +293,18 @@ public class SysDictController {
} }
/** /**
* 【APP接口】根据字典配置查询表字典数据 * 【APP接口】根据字典配置查询表字典数据（目前暂未找到调用的地方）
* @param query * @param query
* @param pageNo * @param pageNo
* @param pageSize * @param pageSize
* @return * @return
*/ */
@Deprecated
@GetMapping("/queryTableData") @GetMapping("/queryTableData")
public Result<List<DictModel>> queryTableData(DictQuery query, public Result<List<DictModel>> queryTableData(DictQuery query,
@RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo, @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize, @RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
@RequestParam(value = "sign",required = false) String sign,HttpServletRequest request){ @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request){
Result<List<DictModel>> res = new Result<List<DictModel>>(); Result<List<DictModel>> res = new Result<List<DictModel>>();
// SQL注入漏洞 sign签名校验 // SQL注入漏洞 sign签名校验
String dictCode = query.getTable()+","+query.getText()+","+query.getCode(); String dictCode = query.getTable()+","+query.getText()+","+query.getCode();
@@ -319,7 +320,7 @@ public class SysDictController {
* @param sysDict * @param sysDict
* @return * @return
*/ */
//@RequiresRoles({"admin"}) @RequiresRoles({"admin"})
@RequestMapping(value = "/add", method = RequestMethod.POST) @RequestMapping(value = "/add", method = RequestMethod.POST)
public Result<SysDict> add(@RequestBody SysDict sysDict) { public Result<SysDict> add(@RequestBody SysDict sysDict) {
Result<SysDict> result = new Result<SysDict>(); Result<SysDict> result = new Result<SysDict>();
@@ -340,7 +341,7 @@ public class SysDictController {
* @param sysDict * @param sysDict
* @return * @return
*/ */
//@RequiresRoles({"admin"}) @RequiresRoles({"admin"})
@RequestMapping(value = "/edit", method = RequestMethod.PUT) @RequestMapping(value = "/edit", method = RequestMethod.PUT)
public Result<SysDict> edit(@RequestBody SysDict sysDict) { public Result<SysDict> edit(@RequestBody SysDict sysDict) {
Result<SysDict> result = new Result<SysDict>(); Result<SysDict> result = new Result<SysDict>();
@@ -362,7 +363,7 @@ public class SysDictController {
* @param id * @param id
* @return * @return
*/ */
//@RequiresRoles({"admin"}) @RequiresRoles({"admin"})
@RequestMapping(value = "/delete", method = RequestMethod.DELETE) @RequestMapping(value = "/delete", method = RequestMethod.DELETE)
@CacheEvict(value=CacheConstant.SYS_DICT_CACHE, allEntries=true) @CacheEvict(value=CacheConstant.SYS_DICT_CACHE, allEntries=true)
public Result<SysDict> delete(@RequestParam(name="id",required=true) String id) { public Result<SysDict> delete(@RequestParam(name="id",required=true) String id) {
@@ -381,7 +382,7 @@ public class SysDictController {
* @param ids * @param ids
* @return * @return
*/ */
//@RequiresRoles({"admin"}) @RequiresRoles({"admin"})
@RequestMapping(value = "/deleteBatch", method = RequestMethod.DELETE) @RequestMapping(value = "/deleteBatch", method = RequestMethod.DELETE)
@CacheEvict(value= CacheConstant.SYS_DICT_CACHE, allEntries=true) @CacheEvict(value= CacheConstant.SYS_DICT_CACHE, allEntries=true)
public Result<SysDict> deleteBatch(@RequestParam(name="ids",required=true) String ids) { public Result<SysDict> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
@@ -424,7 +425,7 @@ public class SysDictController {
* @param request * @param request
*/ */
@RequestMapping(value = "/exportXls") @RequestMapping(value = "/exportXls")
public ModelAndView exportXls(SysDict sysDict,HttpServletRequest request) { public ModelAndView exportXls(SysDict sysDict, HttpServletRequest request) {
// Step.1 组装查询条件 // Step.1 组装查询条件
QueryWrapper<SysDict> queryWrapper = QueryGenerator.initQueryWrapper(sysDict, request.getParameterMap()); QueryWrapper<SysDict> queryWrapper = QueryGenerator.initQueryWrapper(sysDict, request.getParameterMap());
//Step.2 AutoPoi 导出Excel //Step.2 AutoPoi 导出Excel
@@ -460,7 +461,7 @@ public class SysDictController {
* @param * @param
* @return * @return
*/ */
//@RequiresRoles({"admin"}) @RequiresRoles({"admin"})
@RequestMapping(value = "/importExcel", method = RequestMethod.POST) @RequestMapping(value = "/importExcel", method = RequestMethod.POST)
public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) { public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request; MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
@@ -473,8 +474,8 @@ public class SysDictController {
params.setNeedSave(true); params.setNeedSave(true);
try { try {
//导入Excel格式校验，看匹配的字段文本概率 //导入Excel格式校验，看匹配的字段文本概率
ExcelImportResult t = ExcelImportUtil.importExcelVerify(file.getInputStream(), SysDictPage.class, params); Boolean t = ExcelImportCheckUtil.check(file.getInputStream(), SysDictPage.class, params);
if(t.isVerfiyFail()){ if(!t){
throw new RuntimeException("导入Excel校验失败 ！"); throw new RuntimeException("导入Excel校验失败 ！");
} }
List<SysDictPage> list = ExcelImportUtil.importExcel(file.getInputStream(), SysDictPage.class, params); List<SysDictPage> list = ExcelImportUtil.importExcel(file.getInputStream(), SysDictPage.class, params);