From f93a36c094ad66420855d9c80d3a1ba88b092134 Mon Sep 17 00:00:00 2001
From: mkg <1650473152@qq.com>
Date: Mon, 7 Jun 2021 22:57:21 +0800
Subject: [PATCH] =?UTF-8?q?=E5=8A=A0=E5=85=A5marshmallow=E6=95=B0=E6=8D=AE?=
=?UTF-8?q?=E9=AA=8C=E8=AF=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
applications/models/__init__.py | 44 ++++++++++++++++++++++++-
applications/models/admin_dept.py | 8 ++---
applications/service/admin/dept_curd.py | 1 +
applications/service/common/validate.py | 16 ++++++++-
applications/views/admin/dept.py | 8 ++++-
templates/admin/dept/edit.html | 4 +--
6 files changed, 72 insertions(+), 9 deletions(-)
diff --git a/applications/models/__init__.py b/applications/models/__init__.py
index 18dc171..da71425 100644
--- a/applications/models/__init__.py
+++ b/applications/models/__init__.py
@@ -1,5 +1,47 @@
from flask_sqlalchemy import SQLAlchemy
from flask_marshmallow import Marshmallow
+from marshmallow import fields
+from marshmallow.validate import (
+ URL, Email, Range, Length, Equal, Regexp,
+ Predicate, NoneOf, OneOf, ContainsOnly
+)
+URL.default_message = '无效的链接'
+Email.default_message = '无效的邮箱地址'
+Range.message_min = '不能小于{min}'
+Range.message_max = '不能小于{max}'
+Range.message_all = '不能超过{min}和{max}这个范围'
+Length.message_min = '长度不得小于{min}位'
+Length.message_max = '长度不得大于{max}位'
+Length.message_all = '长度不能超过{min}和{max}这个范围'
+Length.message_equal = '长度必须等于{equal}位'
+Equal.default_message = '必须等于{other}'
+Regexp.default_message = '非法输入'
+Predicate.default_message = '非法输入'
+NoneOf.default_message = '非法输入'
+OneOf.default_message = '无效的选择'
+ContainsOnly.default_message = '一个或多个无效的选择'
+
+fields.Field.default_error_messages = {
+ "required": "缺少必要数据",
+ "null": "数据不能为空",
+ "validator_failed": "非法数据",
+}
+
+fields.Str.default_error_messages = {
+ 'invalid': "不是合法文本"
+}
+
+fields.Int.default_error_messages = {
+ "invalid": "不是合法整数"
+}
+
+fields.Number.default_error_messages = {
+ "invalid": "不是合法数字"
+}
+
+fields.Boolean.default_error_messages = {
+ "invalid": "不是合法布尔值"
+}
db = SQLAlchemy()
-ma = Marshmallow()
\ No newline at end of file
+ma = Marshmallow()
diff --git a/applications/models/admin_dept.py b/applications/models/admin_dept.py
index c0929a3..072d103 100644
--- a/applications/models/admin_dept.py
+++ b/applications/models/admin_dept.py
@@ -1,6 +1,6 @@
import datetime
from applications.models import db, ma
-from marshmallow import fields
+from marshmallow import fields,validate
class Dept(db.Model):
@@ -25,7 +25,7 @@ class DeptSchema(ma.Schema): # 序列化类
deptName = fields.Str(attribute="dept_name")
leader = fields.Str()
phone = fields.Str()
- email = fields.Str()
+ email = fields.Str(validate=validate.Email())
address = fields.Str()
- status = fields.Str()
- sort = fields.Str()
+ status = fields.Str(validate=validate.OneOf(["0", "1"]))
+ sort = fields.Integer()
diff --git a/applications/service/admin/dept_curd.py b/applications/service/admin/dept_curd.py
index be1af64..2e01342 100644
--- a/applications/service/admin/dept_curd.py
+++ b/applications/service/admin/dept_curd.py
@@ -13,6 +13,7 @@ def get_dept_dict():
def save_dept(req):
+
address = xss_escape(req.get("address"))
deptName = xss_escape(req.get("deptName"))
email = xss_escape(req.get("email"))
diff --git a/applications/service/common/validate.py b/applications/service/common/validate.py
index d4315b8..2921f8c 100644
--- a/applications/service/common/validate.py
+++ b/applications/service/common/validate.py
@@ -1,6 +1,20 @@
# xss过滤
+from flask import abort, make_response, jsonify
+
+
def xss_escape(s: str):
if s is None:
return None
else:
- return s.replace("&", "&").replace(">", ">").replace("<", "<").replace("'", "'").replace('"', """)
+ return s.replace("&", "&").replace(">", ">").replace("<", "<").replace("'", "'").replace('"',
+ """)
+
+
+def check_data(schema, data):
+ errors = schema.validate(data)
+ for k, v in errors.items():
+ for i in v:
+ # print("{}{}".format(k, i))
+ msg = "{}{}".format(k, i)
+ if errors:
+ abort(make_response(jsonify(result=False, msg=msg), 200))
diff --git a/applications/views/admin/dept.py b/applications/views/admin/dept.py
index 94d7d19..822e1ef 100644
--- a/applications/views/admin/dept.py
+++ b/applications/views/admin/dept.py
@@ -1,6 +1,9 @@
from flask import Blueprint, render_template, request, jsonify
+from marshmallow import INCLUDE
+from applications.models.admin_dept import DeptSchema
from applications.service.admin import dept_curd as dept_curd
from applications.service.common.response import success_api, fail_api
+from applications.service.common.validate import check_data
from applications.service.route_auth import authorize
admin_dept = Blueprint('adminDept', __name__, url_prefix='/admin/dept')
@@ -44,6 +47,7 @@ def tree():
@authorize("admin:dept:add", log=True)
def save():
req = request.json
+ check_data(DeptSchema(unknown=INCLUDE), req)
dept_curd.save_dept(req)
return success_api(msg="成功")
@@ -85,7 +89,9 @@ def disenable():
@admin_dept.route('/update', methods=['PUT'])
@authorize("admin:dept:edit", log=True)
def update():
- res = dept_curd.update_dept(request.json)
+ req = request.json
+ check_data(DeptSchema(unknown=INCLUDE), req)
+ res = dept_curd.update_dept(req)
if not res:
return fail_api(msg="更新失败")
return success_api(msg="更新成功")
diff --git a/templates/admin/dept/edit.html b/templates/admin/dept/edit.html
index 6d56b5c..c9e023a 100644
--- a/templates/admin/dept/edit.html
+++ b/templates/admin/dept/edit.html
@@ -48,9 +48,9 @@
-
+
-