|
|
@@ -120,6 +120,114 @@ public class CommonController {
|
|
|
return result;
|
|
|
}
|
|
|
|
|
|
+ /**
|
|
|
+ * 文件上传统一方法(修改版 固定上传至template文件夹，用于导出模板设置)
|
|
|
+ * @param request
|
|
|
+ * @param response
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ @PostMapping(value = "/upload2")
|
|
|
+ public Result<?> upload2(HttpServletRequest request, HttpServletResponse response) throws Exception {
|
|
|
+ Result<?> result = new Result<>();
|
|
|
+ String savePath = "";
|
|
|
+ String bizPath = request.getParameter("biz");
|
|
|
+
|
|
|
+ //LOWCOD-2580 sys/common/upload接口存在任意文件上传漏洞
|
|
|
+ if (oConvertUtils.isNotEmpty(bizPath)) {
|
|
|
+ if(bizPath.contains(SymbolConstant.SPOT_SINGLE_SLASH) || bizPath.contains(SymbolConstant.SPOT_DOUBLE_BACKSLASH)){
|
|
|
+ throw new JeecgBootException("上传目录bizPath，格式非法！");
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
|
|
|
+ // 获取上传文件对象
|
|
|
+ MultipartFile file = multipartRequest.getFile("file");
|
|
|
+ if(oConvertUtils.isEmpty(bizPath)){
|
|
|
+ if(CommonConstant.UPLOAD_TYPE_OSS.equals(uploadType)){
|
|
|
+ //未指定目录，则用阿里云默认目录 upload
|
|
|
+ bizPath = "upload";
|
|
|
+ //result.setMessage("使用阿里云文件上传时，必须添加目录！");
|
|
|
+ //result.setSuccess(false);
|
|
|
+ //return result;
|
|
|
+ }else{
|
|
|
+ bizPath = "";
|
|
|
+ }
|
|
|
+ }
|
|
|
+ if(CommonConstant.UPLOAD_TYPE_LOCAL.equals(uploadType)){
|
|
|
+ //update-begin-author:liusq date:20221102 for: 过滤上传文件类型
|
|
|
+ SsrfFileTypeFilter.checkUploadFileType(file);
|
|
|
+ //update-end-author:liusq date:20221102 for: 过滤上传文件类型
|
|
|
+ //update-begin-author:lvdandan date:20200928 for:修改JEditor编辑器本地上传
|
|
|
+ savePath = this.uploadLocal2(file,bizPath);
|
|
|
+ //update-begin-author:lvdandan date:20200928 for:修改JEditor编辑器本地上传
|
|
|
+ /** 富文本编辑器及markdown本地上传时，采用返回链接方式
|
|
|
+ //针对jeditor编辑器如何使 lcaol模式，采用 base64格式存储
|
|
|
+ String jeditor = request.getParameter("jeditor");
|
|
|
+ if(oConvertUtils.isNotEmpty(jeditor)){
|
|
|
+ result.setMessage(CommonConstant.UPLOAD_TYPE_LOCAL);
|
|
|
+ result.setSuccess(true);
|
|
|
+ return result;
|
|
|
+ }else{
|
|
|
+ savePath = this.uploadLocal(file,bizPath);
|
|
|
+ }
|
|
|
+ */
|
|
|
+ }else{
|
|
|
+ //update-begin-author:taoyan date:20200814 for:文件上传改造
|
|
|
+ savePath = CommonUtils.upload(file, bizPath, uploadType);
|
|
|
+ //update-end-author:taoyan date:20200814 for:文件上传改造
|
|
|
+ }
|
|
|
+ if(oConvertUtils.isNotEmpty(savePath)){
|
|
|
+ result.setMessage(savePath);
|
|
|
+ result.setSuccess(true);
|
|
|
+ }else {
|
|
|
+ result.setMessage("上传失败！");
|
|
|
+ result.setSuccess(false);
|
|
|
+ }
|
|
|
+ return result;
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * 本地文件上传
|
|
|
+ * @param mf 文件
|
|
|
+ * @param bizPath 自定义路径
|
|
|
+ * @return
|
|
|
+ */
|
|
|
+ private String uploadLocal2(MultipartFile mf,String bizPath){
|
|
|
+ try {
|
|
|
+ String ctxPath = uploadpath+"/template";
|
|
|
+ String fileName = null;
|
|
|
+ File file = new File(ctxPath + File.separator + bizPath + File.separator );
|
|
|
+ if (!file.exists()) {
|
|
|
+ // 创建文件根目录
|
|
|
+ file.mkdirs();
|
|
|
+ }
|
|
|
+ // 获取文件名
|
|
|
+ String orgName = mf.getOriginalFilename();
|
|
|
+ orgName = CommonUtils.getFileName(orgName);
|
|
|
+ if(orgName.indexOf(SymbolConstant.SPOT)!=-1){
|
|
|
+ fileName = orgName.substring(0, orgName.lastIndexOf(".")) + "_" + System.currentTimeMillis() + orgName.substring(orgName.lastIndexOf("."));
|
|
|
+ }else{
|
|
|
+ fileName = orgName+ "_" + System.currentTimeMillis();
|
|
|
+ }
|
|
|
+ String savePath = file.getPath() + File.separator + fileName;
|
|
|
+ File savefile = new File(savePath);
|
|
|
+ FileCopyUtils.copy(mf.getBytes(), savefile);
|
|
|
+ String dbpath = null;
|
|
|
+ if(oConvertUtils.isNotEmpty(bizPath)){
|
|
|
+ dbpath = bizPath + File.separator + fileName;
|
|
|
+ }else{
|
|
|
+ dbpath = fileName;
|
|
|
+ }
|
|
|
+ if (dbpath.contains(SymbolConstant.DOUBLE_BACKSLASH)) {
|
|
|
+ dbpath = dbpath.replace(SymbolConstant.DOUBLE_BACKSLASH, SymbolConstant.SINGLE_SLASH);
|
|
|
+ }
|
|
|
+ return dbpath;
|
|
|
+ } catch (IOException e) {
|
|
|
+ log.error(e.getMessage(), e);
|
|
|
+ }
|
|
|
+ return "";
|
|
|
+ }
|
|
|
+
|
|
|
/**
|
|
|
* 本地文件上传
|
|
|
* @param mf 文件
|
