修改安全漏洞

Pu Zhibing

11 小时以前 f8ca27209594d67dd766c8a58d7842364147d6bf

 management/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/util/UploadUtil.java

@@ -77,7 +77,11 @@
            MultipartFile file = (MultipartFile) multipartRequest.getFile("myfile");
            QianYunTongConfig qianYunTongConfig1 = qianYunTongConfig.getQianYunTongConfig();
            if (file.getSize() != 0) {
                String pictureName = UUID.randomUUID().toString() + "." + ToolUtil.getFileSuffix(file.getOriginalFilename());
                String fileSuffix = ToolUtil.getFileSuffix(file.getOriginalFilename());
                if(!fileSuffix.contains("png") && !fileSuffix.contains("jpg")){
                    throw new RuntimeException("请上传png/jpg的图片文件");
                }
                String pictureName = UUID.randomUUID().toString() + "." + fileSuffix;
                String bucketName = qianYunTongConfig1.getBucketName();
                Bucket grjyTest = NCOSSUtil.getBucketInfo(bucketName);
                if (null == grjyTest) {
@@ -117,7 +121,11 @@
    @ResponseBody
    public String image(@RequestPart("file") MultipartFile picture, HttpServletRequest request) {
        try {
            String pictureName = UUID.randomUUID().toString() + "." + ToolUtil.getFileSuffix(picture.getOriginalFilename());
            String fileSuffix = ToolUtil.getFileSuffix(picture.getOriginalFilename());
            if(!fileSuffix.contains("png") && !fileSuffix.contains("jpg")){
                return "请上传png/jpg的图片文件";
            }
            String pictureName = UUID.randomUUID().toString() + "." + fileSuffix;
            QianYunTongConfig qianYunTongConfig1 = qianYunTongConfig.getQianYunTongConfig();
            String bucketName = qianYunTongConfig1.getBucketName();
            System.err.println("bucketName："+bucketName);
@@ -183,8 +191,12 @@
    public String imageUp(@RequestPart("upfile") MultipartFile picture, HttpServletRequest request) {
        String callback = request.getParameter("callback");
        try {
            String fileSuffix = ToolUtil.getFileSuffix(picture.getOriginalFilename());
            if(!fileSuffix.contains("png") && !fileSuffix.contains("jpg")){
                throw new RuntimeException("请上传png/jpg的图片文件");
            }
            // 上传文件目录
            String pictureName = UUID.randomUUID().toString() + "." + ToolUtil.getFileSuffix(picture.getOriginalFilename());
            String pictureName = UUID.randomUUID().toString() + "." + fileSuffix;
            QianYunTongConfig qianYunTongConfig1 = qianYunTongConfig.getQianYunTongConfig();
            String bucketName = qianYunTongConfig1.getBucketName();
            Bucket grjyTest = NCOSSUtil.getBucketInfo(bucketName);