bwadmin/pear-admin-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

增加xss过滤

Browse Source
This commit is contained in:
mkg
2021-06-03 14:38:48 +08:00
parent 10035cc158
commit a1fbf5a0ae
9 changed files with 100 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/views/admin/dept.py
+1 -1
View File
@@ -41,7 +41,7 @@ def tree():
@admin_dept.route('/save', methods=['POST'])
@authorize("admin:dept:edit", log=True)
@authorize("admin:dept:add", log=True)
def save():
req = request.json
dept_curd.save_dept(req)
applications/views/admin/dict.py
+9 -8
View File
@@ -2,6 +2,7 @@ from flask import Blueprint, render_template, request, jsonify
from applications.models.admin_dict import DictType, DictData
from applications.service.admin import dict_curd
from applications.service.common.response import table_api, success_api, fail_api
from applications.service.common.validate import xss_escape
from applications.service.route_auth import authorize
admin_dict = Blueprint('adminDict', __name__, url_prefix='/admin/dict')
@@ -19,7 +20,7 @@ def main():
def dictType_data():
page = request.args.get('page', type=int)
limit = request.args.get('limit', type=int)
type_name = request.args.get('typeName', type=str)
type_name = xss_escape(request.args.get('typeName', type=str))
data, count = dict_curd.get_dict_type(page=page, limit=limit, type_name=type_name)
return table_api(data=data,count=count)
@@ -44,7 +45,7 @@ def dictType_save():
@admin_dict.route('/dictType/edit', methods=['GET', 'POST'])
@authorize("admin:dict:edit", log=True)
def dictType_edit():
id = request.args.get('dictTypeId', type=str)
id = request.args.get('dictTypeId', type=int)
dict_type = DictType.query.filter_by(id=id).first()
return render_template('admin/dict/edit.html', dict_type=dict_type)
@@ -99,7 +100,7 @@ def dictType_delete(id):
def dictCode_data():
page = request.args.get('page', type=int)
limit = request.args.get('limit', type=int)
type_code = request.args.get('typeCode', type=str)
type_code = xss_escape(request.args.get('typeCode', type=str))
data, count = dict_curd.get_dict_data(page=page, limit=limit, type_code=type_code)
return table_api(data=data,count=count)
@@ -117,7 +118,7 @@ def dictData_add():
@authorize("admin:dict:add", log=True)
def dictData_save():
req_json = request.json
res = save_dict_data(req_json=req_json)
res = dict_curd.save_dict_data(req_json=req_json)
if res == None:
return jsonify(success=False, msg="增加失败")
return jsonify(success=True, msg="增加成功")
@@ -137,7 +138,7 @@ def dictData_edit():
@authorize("admin:dict:edit", log=True)
def dictData_update():
req_json = request.json
update_dict_data(req_json)
dict_curd.update_dict_data(req_json)
return success_api(msg="更新成功")
@@ -147,7 +148,7 @@ def dictData_update():
def dictData_enable():
id = request.json.get('dataId')
if id:
res = enable_dict_data_status(id)
res = dict_curd.enable_dict_data_status(id)
if not res:
return fail_api(msg="出错啦")
return success_api(msg="启动成功")
@@ -160,7 +161,7 @@ def dictData_enable():
def dictData_disenable():
id = request.json.get('dataId')
if id:
res = disable_dict_data_status(id)
res = dict_curd.isable_dict_data_status(id)
if not res:
return fail_api(msg="出错啦")
return success_api(msg="禁用成功")
@@ -171,7 +172,7 @@ def dictData_disenable():
@admin_dict.route('dictData/remove/<int:id>', methods=['DELETE'])
@authorize("admin:dict:remove", log=True)
def dictData_delete(id):
res = delete_data_by_id(id)
res = dict_curd.delete_data_by_id(id)
if not res:
return fail_api(msg="删除失败")
return success_api(msg="删除成功")
applications/views/admin/role.py
+4 -3
View File
@@ -2,6 +2,7 @@ from flask import Blueprint, render_template, request, jsonify
from flask_login import login_required
from applications.service.admin import role_curd
from applications.service.common.response import table_api, success_api, fail_api
from applications.service.common.validate import xss_escape
from applications.service.route_auth import authorize
admin_role = Blueprint('adminRole', __name__, url_prefix='/admin/role')
@@ -20,8 +21,8 @@ def main():
def table():
page = request.args.get('page', type=int)
limit = request.args.get('limit', type=int)
roleName = request.args.get('roleName', type=str)
roleCode = request.args.get('roleCode', type=str)
roleName = xss_escape(request.args.get('roleName', type=str))
roleCode = xss_escape(request.args.get('roleCode', type=str))
filters = {}
if roleName:
filters["name"] = ('%' + roleName + '%')
@@ -102,7 +103,7 @@ def update():
@authorize("admin:role:edit", log=True)
def enable():
id = request.json.get('roleId')
print(id)
# print(id)
if id:
res = role_curd.enable_status(id)
if not res:
applications/views/admin/user.py
+11 -10
View File
@@ -4,6 +4,7 @@ from applications.models.admin_user import User
from applications.models.admin_role import Role
from applications.service.admin import user_curd
from applications.service.common.response import table_api, fail_api, success_api
from applications.service.common.validate import xss_escape
from applications.service.route_auth import authorize
admin_user = Blueprint('adminUser', __name__, url_prefix='/admin/user')
@@ -22,8 +23,8 @@ def main():
def data():
page = request.args.get('page', type=int)
limit = request.args.get('limit', type=int)
realName = request.args.get('realName', type=str)
username = request.args.get('username', type=str)
realName = xss_escape(request.args.get('realName', type=str))
username = xss_escape(request.args.get('username', type=str))
deptId = request.args.get('deptId', type=int)
filters = {}
if realName:
@@ -47,9 +48,9 @@ def add():
def save():
req_json = request.json
a = req_json.get("roleIds")
username = req_json.get('username')
realName = req_json.get('realName')
password = req_json.get('password')
username = xss_escape(req_json.get('username'))
realName = xss_escape(req_json.get('realName'))
password = xss_escape(req_json.get('password'))
role_ids = a.split(',')
if not username or not realName or not password:
@@ -91,11 +92,11 @@ def edit(id):
@authorize("admin:user:edit", log=True)
def update():
req_json = request.json
a = req_json.get("roleIds")
id = req_json.get("userId")
username = req_json.get('username')
realName = req_json.get('realName')
deptId = req_json.get('deptId')
a = xss_escape(req_json.get("roleIds"))
id = xss_escape(req_json.get("userId"))
username = xss_escape(req_json.get('username'))
realName = xss_escape(req_json.get('realName'))
deptId = xss_escape(req_json.get('deptId'))
role_ids = a.split(',')
user_curd.update_user(id, username, realName,deptId)
user_curd.update_user_role(id, role_ids)