20023-08-10

SGGL/FineUIPro.Web/AttachFile/fileupload.ashx.cs

@@ -26,7 +26,7 @@ namespace FineUIPro.Web.AttachFile
             string owner = context.Request.Form["owner"];
             string sessionName = owner.Split('|')[0];
             string attachPath = owner.Split('|')[1] + "/" + DateTime.Now.ToString("yyyy-MM");
-            string initFullPath = BLL.Funs.RootPath + attachPath ;
+            string initFullPath = BLL.Funs.RootPath + attachPath;
             if (!Directory.Exists(initFullPath))
             {
                 Directory.CreateDirectory(initFullPath);
@@ -42,16 +42,27 @@ namespace FineUIPro.Web.AttachFile
                 ResponseError(context);
                 return;
             }
+            // 定义允许上传的文件类型列表
+            List<string> allowExtensions = BLL.DropListService.allowExtensions;
 
             HttpPostedFile postedFile = context.Request.Files[0];
             // 文件名完整路径
             string fileName = postedFile.FileName;
             // 文件名保存的服务器路径
             string savedFileName = GetSavedFileName(fileName);
-            postedFile.SaveAs(context.Server.MapPath("~/" + attachPath+ "/" + savedFileName));
+            postedFile.SaveAs(context.Server.MapPath("~/" + attachPath + "/" + savedFileName));
 
             string shortFileName = GetFileName(fileName);
             string fileType = GetFileType(fileName);
+            if (!allowExtensions.Contains("." + fileType))
+            {
+                // 出错了
+                context.Response.StatusCode = 415;
+                context.Response.Write("不支持的文件类型");
+                // ResponseError(context);
+
+                return;
+            }
             int fileSize = postedFile.ContentLength;
 
             JObject fileObj = new JObject();