增加xss过滤

2021-06-03 14:38:48 +08:00
parent 10035cc158
commit a1fbf5a0ae
9 changed files with 100 additions and 89 deletions
@@ -2,6 +2,7 @@ from applications.models import db
 from applications.models.admin_dept import Dept, DeptSchema
 from applications.models.admin_user import User
 from applications.service.common.curd import model_to_dicts
+from applications.service.common.validate import xss_escape


 def get_dept_dict():
@@ -11,14 +12,15 @@ def get_dept_dict():


 def save_dept(req):
-    address = req.get("address")
-    deptName = req.get("deptName")
-    email = req.get("email")
-    leader = req.get("leader")
-    parentId = req.get("parentId")
-    phone = req.get("phone")
-    sort = req.get("sort")
-    status = req.get("status")
+
+    address = xss_escape(req.get("address"))
+    deptName = xss_escape(req.get("deptName"))
+    email = xss_escape(req.get("email"))
+    leader = xss_escape(req.get("leader"))
+    parentId = xss_escape(req.get("parentId"))
+    phone = xss_escape(req.get("phone"))
+    sort = xss_escape(req.get("sort"))
+    status = xss_escape(req.get("status"))
    dept = Dept(
        parent_id=parentId,
        dept_name=deptName,
@@ -61,15 +63,14 @@ def disable_status(id):

 def update_dept(json):
    id = json.get("deptId"),
-    print(json.get("leader"))
    data = {
-        "dept_name": json.get("deptName"),
-        "sort": json.get("sort"),
-        "leader": json.get("leader"),
-        "phone": json.get("phone"),
-        "email": json.get("email"),
-        "status": json.get("status"),
-        "address": json.get("address")
+        "dept_name": xss_escape(json.get("deptName")),
+        "sort": xss_escape(json.get("sort")),
+        "leader": xss_escape(json.get("leader")),
+        "phone": xss_escape(json.get("phone")),
+        "email": xss_escape(json.get("email")),
+        "status": xss_escape(json.get("status")),
+        "address": xss_escape(json.get("address"))
    }
    d = Dept.query.filter_by(id=id).update(data)
    if not d:
@@ -5,7 +5,7 @@
 from applications.models import db
 from applications.models.admin_dict import DictType, DictData, DictTypeSchema, DictDataSchema
 from applications.service.common.curd import model_to_dicts
-
+from applications.service.common.validate import xss_escape

 # 通过type_code获取字典dict
 # 例：get_dict('user_sex')
@@ -47,10 +47,10 @@ def get_dict_data(page, limit, type_code):

 # 增加dicttype
 def save_dict_type(req_json):
-    description = req_json.get("description")
-    enable = req_json.get("enable")
-    type_code = req_json.get("typeCode")
-    type_name = req_json.get("typeName")
+    description = xss_escape(req_json.get("description"))
+    enable = xss_escape(req_json.get("enable"))
+    type_code = xss_escape(req_json.get("typeCode"))
+    type_name = xss_escape(req_json.get("typeName"))
    d = DictType(type_name=type_name, type_code=type_code, enable=enable, description=description)
    db.session.add(d)
    db.session.commit()
@@ -59,11 +59,11 @@ def save_dict_type(req_json):

 # 编辑字典类型
 def update_dict_type(req_json):
-    id = req_json.get("id")
-    description = req_json.get("description")
-    enable = req_json.get("enable")
-    type_code = req_json.get("typeCode")
-    type_name = req_json.get("typeName")
+    id = xss_escape(req_json.get("id"))
+    description = xss_escape(req_json.get("description"))
+    enable = xss_escape(req_json.get("enable"))
+    type_code = xss_escape(req_json.get("typeCode"))
+    type_name = xss_escape(req_json.get("typeName"))
    DictType.query.filter_by(id=id).update({
        "description": description,
        "enable": enable,
@@ -103,11 +103,11 @@ def delete_type_by_id(id):

 # 增加dictdata
 def save_dict_data(req_json):
-    data_label = req_json.get("dataLabel")
-    data_value = req_json.get("dataValue")
-    enable = req_json.get("enable")
-    remark = req_json.get("remark")
-    type_code = req_json.get("typeCode")
+    data_label = xss_escape(req_json.get("dataLabel"))
+    data_value = xss_escape(req_json.get("dataValue"))
+    enable = xss_escape(req_json.get("enable"))
+    remark = xss_escape(req_json.get("remark"))
+    type_code = xss_escape(req_json.get("typeCode"))
    d = DictData(data_label=data_label, data_value=data_value, enable=enable, remark=remark, type_code=type_code)
    db.session.add(d)
    db.session.commit()
@@ -118,11 +118,11 @@ def save_dict_data(req_json):
 def update_dict_data(req_json):
    id = req_json.get("dataId")
    DictData.query.filter_by(id=id).update({
-        "data_label": req_json.get("dataLabel"),
-        "data_value": req_json.get("dataValue"),
-        "enable": req_json.get("enable"),
-        "remark": req_json.get("remark"),
-        "type_code": req_json.get("typeCode")
+        "data_label": xss_escape(req_json.get("dataLabel")),
+        "data_value": xss_escape(req_json.get("dataValue")),
+        "enable": xss_escape(req_json.get("enable")),
+        "remark": xss_escape(req_json.get("remark")),
+        "type_code": xss_escape(req_json.get("typeCode"))
    })
    db.session.commit()
    return
@@ -2,6 +2,7 @@ from applications.models import db
 from applications.models.admin_power import Power, PowerSchema2
 from applications.models.admin_role import Role
 from applications.service.common.curd import model_to_dicts
+from applications.service.common.validate import xss_escape


 def get_power_dict():
@@ -19,14 +20,14 @@ def select_parent():

 # 增加权限
 def save_power(req):
-    icon = req.get("icon")
-    openType = req.get("openType")
-    parentId = req.get("parentId")
-    powerCode = req.get("powerCode")
-    powerName = req.get("powerName")
-    powerType = req.get("powerType")
-    powerUrl = req.get("powerUrl")
-    sort = req.get("sort")
+    icon = xss_escape(req.get("icon"))
+    openType = xss_escape(req.get("openType"))
+    parentId = xss_escape(req.get("parentId"))
+    powerCode = xss_escape(req.get("powerCode"))
+    powerName = xss_escape(req.get("powerName"))
+    powerType = xss_escape(req.get("powerType"))
+    powerUrl = xss_escape(req.get("powerUrl"))
+    sort = xss_escape(req.get("sort"))
    power = Power(
        icon=icon,
        open_type=openType,
@@ -53,19 +54,19 @@ def get_power_by_id(id):
 def update_power(req_json):
    id = req_json.get("powerId")
    data = {
-        "icon": req_json.get("icon"),
-        "open_type": req_json.get("openType"),
-        "parent_id": req_json.get("parentId"),
-        "code": req_json.get("powerCode"),
-        "name": req_json.get("powerName"),
-        "type": req_json.get("powerType"),
-        "url": req_json.get("powerUrl"),
-        "sort": req_json.get("sort")
+        "icon": xss_escape(req_json.get("icon")),
+        "open_type": xss_escape(req_json.get("openType")),
+        "parent_id": xss_escape(req_json.get("parentId")),
+        "code": xss_escape(req_json.get("powerCode")),
+        "name": xss_escape(req_json.get("powerName")),
+        "type": xss_escape(req_json.get("powerType")),
+        "url": xss_escape(req_json.get("powerUrl")),
+        "sort": xss_escape(req_json.get("sort"))
    }
-    print(data)
+    # print(data)
    power = Power.query.filter_by(id=id).update(data)
    db.session.commit()
-    print(power)
+    # print(power)
    return power


@@ -6,6 +6,7 @@ from applications.models.admin_user import User

 # 获取角色对象
 from applications.service.common.curd import model_to_dicts
+from applications.service.common.validate import xss_escape


 def get_role_data(page, limit, filters):
@@ -25,11 +26,11 @@ def get_role_data_dict(page, limit, filters):

 # 增加角色
 def add_role(req):
-    details = req.get("details")
-    enable = req.get("enable")
-    roleCode = req.get("roleCode")
-    roleName = req.get("roleName")
-    sort = req.get("sort")
+    details = xss_escape(req.get("details"))
+    enable = xss_escape(req.get("enable"))
+    roleCode = xss_escape(req.get("roleCode"))
+    roleName = xss_escape(req.get("roleName"))
+    sort = xss_escape(req.get("sort"))
    role = Role(
        details=details,
        enable=enable,
@@ -51,13 +52,12 @@ def get_role_by_id(id):
 def update_role(req_json):
    id = req_json.get("roleId")
    data = {
-        "code": req_json.get("roleCode"),
-        "name": req_json.get("roleName"),
-        "sort": req_json.get("sort"),
-        "enable": req_json.get("enable"),
-        "details": req_json.get("details")
+        "code": xss_escape(req_json.get("roleCode")),
+        "name": xss_escape(req_json.get("roleName")),
+        "sort": xss_escape(req_json.get("sort")),
+        "enable": xss_escape(req_json.get("enable")),
+        "details": xss_escape(req_json.get("details"))
    }
-    print(data)
    role = Role.query.filter_by(id=id).update(data)
    db.session.commit()
    return role
@@ -87,8 +87,8 @@ def update_role_power(id, power_list):
    power_id_list = []
    for p in role.power:
        power_id_list.append(p.id)
-        print(p.id)
-    print(power_id_list)
+        # print(p.id)
+    # print(power_id_list)
    powers = Power.query.filter(Power.id.in_(power_id_list)).all()
    for p in powers:
        role.power.remove(p)