KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

【修改】各类bug修复

Browse Source
This commit is contained in:
zer0Black
2022-04-09 11:14:29 +08:00
parent 0529449685
commit 9669685464
12 changed files with 100 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java
+21
View File
@@ -4,6 +4,7 @@ import cn.hutool.crypto.SecureUtil;
import lombok.extern.slf4j.Slf4j;
import com.jero.common.exception.JeroBootException;
import javax.servlet.http.HttpServletRequest;
import java.util.regex.Pattern;
/**
* sql注入处理工具类
@@ -51,6 +52,8 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
String[] xssArr = xssStr.split("\\|");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) {
@@ -59,6 +62,9 @@ public class SqlInjectionUtil {
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
return;
}
@@ -76,6 +82,8 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
@@ -83,6 +91,9 @@ public class SqlInjectionUtil {
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
}
return;
}
@@ -101,6 +112,8 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
@@ -108,6 +121,9 @@ public class SqlInjectionUtil {
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
return;
}
@@ -126,6 +142,8 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
@@ -133,6 +151,9 @@ public class SqlInjectionUtil {
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
}
return;
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroConfig.java
+1 -1
View File
@@ -58,7 +58,7 @@ public class ShiroConfig {
* 2、当设置多个过滤器时，全部验证通过，才视为通过
* 3、部分过滤器可指定参数，如perms，roles
*/
@Bean("shiroFilter")
@Bean("shiroFilterFactoryBean")
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
CustomShiroFilterFactoryBean shiroFilterFactoryBean = new CustomShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java
+6
View File
@@ -83,6 +83,12 @@ public class CommonController {
Result<OSSFile> result = new Result<>();
String savePath = "";
String bizPath = request.getParameter("biz");
//sys/common/upload接口存在任意文件上传漏洞
if (oConvertUtils.isNotEmpty(bizPath) && (bizPath.contains("../") || bizPath.contains("..\\"))) {
throw new JeroBootException("上传目录bizPath，格式非法！");
}
MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
// 获取上传文件对象
MultipartFile file = multipartRequest.getFile("file");
jero-boot/pom.xml
+2 -1
View File
@@ -36,7 +36,7 @@
<commons.version>2.6</commons.version>
<aliyun-java-sdk-dysmsapi.version>2.1.0</aliyun-java-sdk-dysmsapi.version>
<aliyun.oss.version>3.11.2</aliyun.oss.version>
<shiro.version>1.7.1</shiro.version>
<shiro.version>1.8.0</shiro.version>
<java-jwt.version>3.11.0</java-jwt.version>
<shiro-redis.version>3.1.0</shiro-redis.version>
<autopoi-web.version>1.3.6</autopoi-web.version>
@@ -44,6 +44,7 @@
<justauth-spring-boot-starter.version>1.3.4</justauth-spring-boot-starter.version>
<dom4j.version>1.6.1</dom4j.version>
<qiniu-java-sdk.version>7.4.0</qiniu-java-sdk.version>
<log4j2.version>2.15.0</log4j2.version>
</properties>
<modules>
jero-web/package.json
+2 -2
View File
@@ -11,7 +11,6 @@
},
"dependencies": {
"@antv/data-set": "^0.11.4",
"@tinymce/tinymce-vue": "^2.1.0",
"@toast-ui/editor": "^2.1.2",
"ant-design-vue": "^1.7.2",
"china-area-data": "^5.0.1",
@@ -29,7 +28,8 @@
"lodash.pick": "^4.4.0",
"md5": "^2.2.1",
"nprogress": "^0.2.0",
"tinymce": "^5.3.2",
"@tinymce/tinymce-vue": "2.1.0",
"tinymce": "5.4.1",
"viser-vue": "^2.4.8",
"vue": "^2.6.10",
"vue-area-linkage": "^5.1.0",
jero-web/src/components/jero/JEasyCron/EasyCron.vue
+5 -1
View File
@@ -144,8 +144,12 @@ export default {
const v = this.cronValue_c
if (this.hideYear || this.hideSecond) return v
const vs = v.split(' ')
if (vs.length >= 6) {
// 将 Quartz 星期 的规则转换为 CronParser 的规则
vs[5] = this.convertQuartzWeekToCParser(vs[5])
}
return vs.slice(0, vs.length - 1).join(' ')
}
},
},
watch: {
cronValue(newVal, oldVal) {
jero-web/src/components/jero/JEasyCron/tabs/const.js
+8 -8
View File
@@ -1,11 +1,11 @@
export const WEEK_MAP_EN = {
'SUN': '0',
'MON': '1',
'TUE': '2',
'WED': '3',
'THU': '4',
'FRI': '5',
'SAT': '6'
'SUN': '1',
'MON': '2',
'TUE': '3',
'WED': '4',
'THU': '5',
'FRI': '6',
'SAT': '7'
}
export const replaceWeekName = (c) => {
@@ -14,7 +14,7 @@ export const replaceWeekName = (c) => {
Object.keys(WEEK_MAP_EN).forEach(k => {
c = c.replace(new RegExp(k, 'g'), WEEK_MAP_EN[k])
})
c = c.replace(new RegExp('7', 'g'), '0')
// c = c.replace(new RegExp('7', 'g'), '0')
}
// console.info('after: ' + c)
return c
jero-web/src/components/jero/JEasyCron/tabs/week.vue
+7 -7
View File
@@ -51,14 +51,14 @@ import mixin from './mixin'
import { replaceWeekName, WEEK_MAP_EN } from './const.js'
const WEEK_MAP = {
'周一': 1,
'周二': 2,
'周三': 3,
'周四': 4,
'周五': 5,
'周六': 6,
'周一': 2,
'周二': 3,
'周三': 4,
'周四': 5,
'周五': 6,
'周六': 7,
// 按照国人习惯，将周日放到每周的最后一天
'周日': 7,
'周日': 1,
}
export default {
jero-web/src/components/jerobiz/JSelectBizComponent/JSelectBizComponentModal.vue
+16 -4
View File
@@ -62,8 +62,9 @@
import { getAction } from '@/api/manage'
import Ellipsis from '@/components/Ellipsis'
import { JeroListMixin } from '@/mixins/JeroListMixin'
import { cloneObject, pushIfNotExist } from '@/utils/util'
import { pushIfNotExist } from '@/utils/util'
import JSelectBizQueryItem from './JSelectBizQueryItem'
import {cloneDeep} from 'lodash'
export default {
name: 'JSelectBizComponentModal',
@@ -177,11 +178,22 @@
computed: {
// 表头
innerColumns() {
let columns = cloneObject(this.columns)
let columns = cloneDeep(this.columns)
columns.forEach(column => {
// 给所有的列加上过长裁剪
if (this.ellipsisLength !== -1) {
column.customRender = (text) => this.renderEllipsis(text)
let myCustomRender = column.customRender
column.customRender = (text, record, index) => {
let value = text
if (typeof myCustomRender === 'function') {
// noinspection JSVoidFunctionReturnValueUsed
value = myCustomRender(text, record, index)
}
if (typeof value === 'string') {
return this.renderEllipsis(value)
}
return value
}
}
})
return columns
@@ -192,7 +204,7 @@
deep: true,
immediate: true,
handler(val) {
this.innerValue = cloneObject(val)
this.innerValue = cloneDeep(val)
this.selectedRowKeys = []
this.valueWatchHandler(val)
this.queryOptionsByValue(val)
jero-web/src/components/jerobiz/modal/JSelectUserByDepModal.vue
+27 -6
View File
@@ -21,8 +21,8 @@
:dropdownStyle="{maxHeight:'200px',overflow:'auto'}"
:treeData="departTree"
:expandAction="false"
:expandedKeys.sync="expandedKeys"
@select="onDepSelect"
:load-data="onLoadDepartment"
/>
</a-card>
</a-col>
@@ -63,7 +63,7 @@
<script>
import {filterObj} from '@/utils/util'
import {queryDepartTreeList, getUserList, queryUserByDepId} from '@/api/api'
import {queryDepartTreeList, getUserList, queryUserByDepId, queryDepartTreeSync} from '@/api/api'
import { getAction } from '@/api/manage'
export default {
@@ -300,14 +300,35 @@
})
},
queryDepartTree() {
queryDepartTreeList().then((res) => {
//update-begin-author:taoyan date:20211202 for: 异步加载部门树 https://github.com/jeecgboot/jeecg-boot/issues/3196
this.expandedKeys = []
this.departTree = []
queryDepartTreeSync().then((res) => {
if (res.success) {
this.departTree = res.result;
// 默认展开父节点
this.expandedKeys = this.departTree.map(item => item.id)
for (let i = 0; i < res.result.length; i++) {
let temp = res.result[i]
this.departTree.push(temp)
}
}
})
},
onLoadDepartment(treeNode){
return new Promise(resolve => {
queryDepartTreeSync({pid:treeNode.dataRef.id}).then((res) => {
if (res.success) {
//判断chidlren是否为空，并修改isLeaf属性值
if(res.result.length == 0){
treeNode.dataRef['isLeaf']=true
return;
}else{
treeNode.dataRef['children']= res.result;
}
}
})
resolve();
});
},
//update-end-author:taoyan date:20211202 for: 异步加载部门树 https://github.com/jeecgboot/jeecg-boot/issues/3196
modalFormOk() {
this.loadData();
}
jero-web/src/components/page/GlobalHeader.vue
+2 -2
View File
@@ -150,10 +150,10 @@
this.topMenuStyle.headerIndexRight = {}
this.topMenuStyle.headerIndexLeft = {}
} else {
let rightWidth = '360px'
let rightWidth = '400px'
this.topMenuStyle.topNavHeader = { 'min-width': '165px' }
this.topMenuStyle.topSmenuStyle = { 'width': 'calc(100% - 165px)' }
this.topMenuStyle.headerIndexRight = { 'min-width': rightWidth }
this.topMenuStyle.headerIndexRight = { 'min-width': rightWidth, 'white-space': 'nowrap' }
this.topMenuStyle.headerIndexLeft = { 'width': `calc(100% - ${rightWidth})` }
}
}
jero-web/src/mixins/JeroListMixin.js
+3
View File
@@ -146,6 +146,9 @@ export const JeroListMixin = {
},
searchQuery() {
this.loadData(1);
// 点击查询清空列表选中行
this.selectedRowKeys = []
this.selectionRows = []
},
superQuery() {
this.$refs.superQueryModal.show();