bwadmin/pear-admin-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

增加xss过滤

Browse Source
This commit is contained in:
mkg
2021-06-03 14:38:48 +08:00
parent 10035cc158
commit a1fbf5a0ae
9 changed files with 100 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/service/admin/dept_curd.py
+17 -16
View File
@@ -2,6 +2,7 @@ from applications.models import db
from applications.models.admin_dept import Dept, DeptSchema
from applications.models.admin_user import User
from applications.service.common.curd import model_to_dicts
from applications.service.common.validate import xss_escape
def get_dept_dict():
@@ -11,14 +12,15 @@ def get_dept_dict():
def save_dept(req):
address = req.get("address")
deptName = req.get("deptName")
email = req.get("email")
leader = req.get("leader")
parentId = req.get("parentId")
phone = req.get("phone")
sort = req.get("sort")
status = req.get("status")
address = xss_escape(req.get("address"))
deptName = xss_escape(req.get("deptName"))
email = xss_escape(req.get("email"))
leader = xss_escape(req.get("leader"))
parentId = xss_escape(req.get("parentId"))
phone = xss_escape(req.get("phone"))
sort = xss_escape(req.get("sort"))
status = xss_escape(req.get("status"))
dept = Dept(
parent_id=parentId,
dept_name=deptName,
@@ -61,15 +63,14 @@ def disable_status(id):
def update_dept(json):
id = json.get("deptId"),
print(json.get("leader"))
data = {
"dept_name": json.get("deptName"),
"sort": json.get("sort"),
"leader": json.get("leader"),
"phone": json.get("phone"),
"email": json.get("email"),
"status": json.get("status"),
"address": json.get("address")
"dept_name": xss_escape(json.get("deptName")),
"sort": xss_escape(json.get("sort")),
"leader": xss_escape(json.get("leader")),
"phone": xss_escape(json.get("phone")),
"email": xss_escape(json.get("email")),
"status": xss_escape(json.get("status")),
"address": xss_escape(json.get("address"))
}
d = Dept.query.filter_by(id=id).update(data)
if not d:
applications/service/admin/dict_curd.py
+20 -20
View File
@@ -5,7 +5,7 @@
from applications.models import db
from applications.models.admin_dict import DictType, DictData, DictTypeSchema, DictDataSchema
from applications.service.common.curd import model_to_dicts
from applications.service.common.validate import xss_escape
# 通过type_code获取字典dict
# 例：get_dict('user_sex')
@@ -47,10 +47,10 @@ def get_dict_data(page, limit, type_code):
# 增加dicttype
def save_dict_type(req_json):
description = req_json.get("description")
enable = req_json.get("enable")
type_code = req_json.get("typeCode")
type_name = req_json.get("typeName")
description = xss_escape(req_json.get("description"))
enable = xss_escape(req_json.get("enable"))
type_code = xss_escape(req_json.get("typeCode"))
type_name = xss_escape(req_json.get("typeName"))
d = DictType(type_name=type_name, type_code=type_code, enable=enable, description=description)
db.session.add(d)
db.session.commit()
@@ -59,11 +59,11 @@ def save_dict_type(req_json):
# 编辑字典类型
def update_dict_type(req_json):
id = req_json.get("id")
description = req_json.get("description")
enable = req_json.get("enable")
type_code = req_json.get("typeCode")
type_name = req_json.get("typeName")
id = xss_escape(req_json.get("id"))
description = xss_escape(req_json.get("description"))
enable = xss_escape(req_json.get("enable"))
type_code = xss_escape(req_json.get("typeCode"))
type_name = xss_escape(req_json.get("typeName"))
DictType.query.filter_by(id=id).update({
"description": description,
"enable": enable,
@@ -103,11 +103,11 @@ def delete_type_by_id(id):
# 增加dictdata
def save_dict_data(req_json):
data_label = req_json.get("dataLabel")
data_value = req_json.get("dataValue")
enable = req_json.get("enable")
remark = req_json.get("remark")
type_code = req_json.get("typeCode")
data_label = xss_escape(req_json.get("dataLabel"))
data_value = xss_escape(req_json.get("dataValue"))
enable = xss_escape(req_json.get("enable"))
remark = xss_escape(req_json.get("remark"))
type_code = xss_escape(req_json.get("typeCode"))
d = DictData(data_label=data_label, data_value=data_value, enable=enable, remark=remark, type_code=type_code)
db.session.add(d)
db.session.commit()
@@ -118,11 +118,11 @@ def save_dict_data(req_json):
def update_dict_data(req_json):
id = req_json.get("dataId")
DictData.query.filter_by(id=id).update({
"data_label": req_json.get("dataLabel"),
"data_value": req_json.get("dataValue"),
"enable": req_json.get("enable"),
"remark": req_json.get("remark"),
"type_code": req_json.get("typeCode")
"data_label": xss_escape(req_json.get("dataLabel")),
"data_value": xss_escape(req_json.get("dataValue")),
"enable": xss_escape(req_json.get("enable")),
"remark": xss_escape(req_json.get("remark")),
"type_code": xss_escape(req_json.get("typeCode"))
})
db.session.commit()
return
applications/service/admin/power_curd.py
+19 -18
View File
@@ -2,6 +2,7 @@ from applications.models import db
from applications.models.admin_power import Power, PowerSchema2
from applications.models.admin_role import Role
from applications.service.common.curd import model_to_dicts
from applications.service.common.validate import xss_escape
def get_power_dict():
@@ -19,14 +20,14 @@ def select_parent():
# 增加权限
def save_power(req):
icon = req.get("icon")
openType = req.get("openType")
parentId = req.get("parentId")
powerCode = req.get("powerCode")
powerName = req.get("powerName")
powerType = req.get("powerType")
powerUrl = req.get("powerUrl")
sort = req.get("sort")
icon = xss_escape(req.get("icon"))
openType = xss_escape(req.get("openType"))
parentId = xss_escape(req.get("parentId"))
powerCode = xss_escape(req.get("powerCode"))
powerName = xss_escape(req.get("powerName"))
powerType = xss_escape(req.get("powerType"))
powerUrl = xss_escape(req.get("powerUrl"))
sort = xss_escape(req.get("sort"))
power = Power(
icon=icon,
open_type=openType,
@@ -53,19 +54,19 @@ def get_power_by_id(id):
def update_power(req_json):
id = req_json.get("powerId")
data = {
"icon": req_json.get("icon"),
"open_type": req_json.get("openType"),
"parent_id": req_json.get("parentId"),
"code": req_json.get("powerCode"),
"name": req_json.get("powerName"),
"type": req_json.get("powerType"),
"url": req_json.get("powerUrl"),
"sort": req_json.get("sort")
"icon": xss_escape(req_json.get("icon")),
"open_type": xss_escape(req_json.get("openType")),
"parent_id": xss_escape(req_json.get("parentId")),
"code": xss_escape(req_json.get("powerCode")),
"name": xss_escape(req_json.get("powerName")),
"type": xss_escape(req_json.get("powerType")),
"url": xss_escape(req_json.get("powerUrl")),
"sort": xss_escape(req_json.get("sort"))
}
print(data)
# print(data)
power = Power.query.filter_by(id=id).update(data)
db.session.commit()
print(power)
# print(power)
return power
applications/service/admin/role_curd.py
+13 -13
View File
@@ -6,6 +6,7 @@ from applications.models.admin_user import User
# 获取角色对象
from applications.service.common.curd import model_to_dicts
from applications.service.common.validate import xss_escape
def get_role_data(page, limit, filters):
@@ -25,11 +26,11 @@ def get_role_data_dict(page, limit, filters):
# 增加角色
def add_role(req):
details = req.get("details")
enable = req.get("enable")
roleCode = req.get("roleCode")
roleName = req.get("roleName")
sort = req.get("sort")
details = xss_escape(req.get("details"))
enable = xss_escape(req.get("enable"))
roleCode = xss_escape(req.get("roleCode"))
roleName = xss_escape(req.get("roleName"))
sort = xss_escape(req.get("sort"))
role = Role(
details=details,
enable=enable,
@@ -51,13 +52,12 @@ def get_role_by_id(id):
def update_role(req_json):
id = req_json.get("roleId")
data = {
"code": req_json.get("roleCode"),
"name": req_json.get("roleName"),
"sort": req_json.get("sort"),
"enable": req_json.get("enable"),
"details": req_json.get("details")
"code": xss_escape(req_json.get("roleCode")),
"name": xss_escape(req_json.get("roleName")),
"sort": xss_escape(req_json.get("sort")),
"enable": xss_escape(req_json.get("enable")),
"details": xss_escape(req_json.get("details"))
}
print(data)
role = Role.query.filter_by(id=id).update(data)
db.session.commit()
return role
@@ -87,8 +87,8 @@ def update_role_power(id, power_list):
power_id_list = []
for p in role.power:
power_id_list.append(p.id)
print(p.id)
print(power_id_list)
# print(p.id)
# print(power_id_list)
powers = Power.query.filter(Power.id.in_(power_id_list)).all()
for p in powers:
role.power.remove(p)
applications/service/common/validate.py
+6
View File
@@ -0,0 +1,6 @@
# xss过滤
def xss_escape(s: str):
if s is None:
return None
else:
return s.replace("&", "&amp;").replace(">", "&gt;").replace("<", "&lt;").replace("'", "&#39;").replace('"', "&#34;")