加入marshmallow数据验证

applications/models/__init__.py

@@ -1,5 +1,47 @@
 from flask_sqlalchemy import SQLAlchemy
 from flask_marshmallow import Marshmallow
+from marshmallow import fields
+from marshmallow.validate import (
+    URL, Email, Range, Length, Equal, Regexp,
+    Predicate, NoneOf, OneOf, ContainsOnly
+)
 
+URL.default_message = '无效的链接'
+Email.default_message = '无效的邮箱地址'
+Range.message_min = '不能小于{min}'
+Range.message_max = '不能小于{max}'
+Range.message_all = '不能超过{min}和{max}这个范围'
+Length.message_min = '长度不得小于{min}位'
+Length.message_max = '长度不得大于{max}位'
+Length.message_all = '长度不能超过{min}和{max}这个范围'
+Length.message_equal = '长度必须等于{equal}位'
+Equal.default_message = '必须等于{other}'
+Regexp.default_message = '非法输入'
+Predicate.default_message = '非法输入'
+NoneOf.default_message = '非法输入'
+OneOf.default_message = '无效的选择'
+ContainsOnly.default_message = '一个或多个无效的选择'
+
+fields.Field.default_error_messages = {
+    "required": "缺少必要数据",
+    "null": "数据不能为空",
+    "validator_failed": "非法数据",
+}
+
+fields.Str.default_error_messages = {
+    'invalid': "不是合法文本"
+}
+
+fields.Int.default_error_messages = {
+    "invalid": "不是合法整数"
+}
+
+fields.Number.default_error_messages = {
+    "invalid": "不是合法数字"
+}
+
+fields.Boolean.default_error_messages = {
+    "invalid": "不是合法布尔值"
+}
 db = SQLAlchemy()
-ma = Marshmallow()
+ma = Marshmallow()

applications/models/admin_dept.py

@@ -1,6 +1,6 @@
 import datetime
 from applications.models import db, ma
-from marshmallow import fields
+from marshmallow import fields,validate
 
 
 class Dept(db.Model):
@@ -25,7 +25,7 @@ class DeptSchema(ma.Schema):  # 序列化类
     deptName = fields.Str(attribute="dept_name")
     leader = fields.Str()
     phone = fields.Str()
-    email = fields.Str()
+    email = fields.Str(validate=validate.Email())
     address = fields.Str()
-    status = fields.Str()
+    status = fields.Str(validate=validate.OneOf(["0", "1"]))
-    sort = fields.Str()
+    sort = fields.Integer()

applications/service/admin/dept_curd.py

@@ -13,6 +13,7 @@ def get_dept_dict():
 
 def save_dept(req):
 
+
     address = xss_escape(req.get("address"))
     deptName = xss_escape(req.get("deptName"))
     email = xss_escape(req.get("email"))

applications/service/common/validate.py

@@ -1,6 +1,20 @@
 # xss过滤
+from flask import abort, make_response, jsonify
+
+
 def xss_escape(s: str):
     if s is None:
         return None
     else:
-        return s.replace("&", "&amp;").replace(">", "&gt;").replace("<", "&lt;").replace("'", "&#39;").replace('"', "&#34;")
+        return s.replace("&", "&amp;").replace(">", "&gt;").replace("<", "&lt;").replace("'", "&#39;").replace('"',
+                                                                                                               "&#34;")
+
+
+def check_data(schema, data):
+    errors = schema.validate(data)
+    for k, v in errors.items():
+        for i in v:
+            # print("{}{}".format(k, i))
+            msg = "{}{}".format(k, i)
+    if errors:
+        abort(make_response(jsonify(result=False, msg=msg), 200))

applications/views/admin/dept.py

@@ -1,6 +1,9 @@
 from flask import Blueprint, render_template, request, jsonify
+from marshmallow import INCLUDE
+from applications.models.admin_dept import DeptSchema
 from applications.service.admin import dept_curd as dept_curd
 from applications.service.common.response import success_api, fail_api
+from applications.service.common.validate import check_data
 from applications.service.route_auth import authorize
 
 admin_dept = Blueprint('adminDept', __name__, url_prefix='/admin/dept')
@@ -44,6 +47,7 @@ def tree():
 @authorize("admin:dept:add", log=True)
 def save():
     req = request.json
+    check_data(DeptSchema(unknown=INCLUDE), req)
     dept_curd.save_dept(req)
     return success_api(msg="成功")
 
@@ -85,7 +89,9 @@ def disenable():
 @admin_dept.route('/update', methods=['PUT'])
 @authorize("admin:dept:edit", log=True)
 def update():
-    res = dept_curd.update_dept(request.json)
+    req = request.json
+    check_data(DeptSchema(unknown=INCLUDE), req)
+    res = dept_curd.update_dept(req)
     if not res:
         return fail_api(msg="更新失败")
     return success_api(msg="更新成功")

templates/admin/dept/edit.html

@@ -48,9 +48,9 @@
                     <label class="layui-form-label">状态</label>
                     <div class="layui-input-block">
 
-                        <input type="radio" name="status"{% if dept.status == 1 %}checked{% endif %} value="0" title="开启">
+                        <input type="radio" name="status"{% if dept.status == 1 %}checked{% endif %} value="1" title="开启">
 
-                        <input type="radio" name="status" {% if dept.status == 0 %}checked{% endif %} value="1" title="关闭"
+                        <input type="radio" name="status" {% if dept.status == 0 %}checked{% endif %} value="0" title="关闭"
                               >
                     </div>
                 </div>