2023-08-04

SGGL/WebAPI/Controllers/FileUploadController.cs

@@ -1,5 +1,6 @@
 using BLL;
 using System;
+using System.Collections.Generic;
 using System.Configuration;
 using System.Drawing;
 using System.IO;
@@ -30,6 +31,9 @@ namespace WebAPI.Controllers
             {
                 typeName = "WebApi";
             }
+            // 定义允许上传的文件类型列表
+            List<string> allowExtensions = BLL.DropListService.allowExtensions;
+
             string reUrl = string.Empty;
             if (files != null && files.Count > 0)
             {
@@ -45,6 +49,10 @@ namespace WebAPI.Controllers
                     string fileName = string.Empty;
                     string extensionstr = string.Empty;
                     HttpPostedFile file = files[key];//file.ContentLength文件长度
+                    if (!allowExtensions.Contains(Path.GetExtension(file.FileName)))
+                    {
+                        return BadRequest($"Invalid file extension: {file.FileName}");
+                    }
                     if (!string.IsNullOrEmpty(file.FileName))
                     {
                         extensionstr = Path.GetExtension(file.FileName).ToLower();
@@ -139,6 +147,42 @@ namespace WebAPI.Controllers
             return responeData;
         }
         #endregion
+
+        #region 附件上传
+        /// <summary>
+        /// 附件上传
+        /// </summary>
+        /// <returns></returns>
+        public IHttpActionResult PostSmall()
+        {
+            HttpFileCollection files = HttpContext.Current.Request.Files;
+            string typeName = HttpContext.Current.Request["typeName"];
+            if (string.IsNullOrEmpty(typeName))
+            {
+                typeName = "WebApi";
+            }
+            string reUrl = string.Empty;
+            if (files != null && files.Count > 0)
+            {
+                string folderUrl = "FileUpLoad/" + typeName + "/" + DateTime.Now.ToString("yyyy-MM") + "/";
+                string localRoot = ConfigurationManager.AppSettings["localRoot"] + folderUrl; //物理路径
+                if (!Directory.Exists(localRoot))
+                {
+                    Directory.CreateDirectory(localRoot);
+                }
+                foreach (string key in files.AllKeys)
+                {
+                    HttpPostedFile file = files[key];//file.ContentLength文件长度
+                    reUrl = UpLoadImageService.UpLoadImage(file, folderUrl, folderUrl + "Small/", 80, 30);
+                }
+            }
+
+            return Ok(reUrl);
+        }
+        #endregion
+
+        #region 在线编辑回调保存文件
+
         /// <summary>
         /// 在线编辑回调保存文件
         /// </summary>
@@ -190,37 +234,7 @@ namespace WebAPI.Controllers
             return responeData;
         }
 
-        #region 附件上传
-        /// <summary>
-        /// 附件上传
-        /// </summary>
-        /// <returns></returns>
-        public IHttpActionResult PostSmall()
-        {
-            HttpFileCollection files = HttpContext.Current.Request.Files;
-            string typeName = HttpContext.Current.Request["typeName"];
-            if (string.IsNullOrEmpty(typeName))
-            {
-                typeName = "WebApi";
-            }
-            string reUrl = string.Empty;
-            if (files != null && files.Count > 0)
-            {
-                string folderUrl = "FileUpLoad/" + typeName + "/" + DateTime.Now.ToString("yyyy-MM") + "/";
-                string localRoot = ConfigurationManager.AppSettings["localRoot"] + folderUrl; //物理路径
-                if (!Directory.Exists(localRoot))
-                {
-                    Directory.CreateDirectory(localRoot);
-                }
-                foreach (string key in files.AllKeys)
-                {
-                    HttpPostedFile file = files[key];//file.ContentLength文件长度
-                    reUrl = UpLoadImageService.UpLoadImage(file, folderUrl, folderUrl + "Small/", 80, 30);
-                }
-            }
-
-            return Ok(reUrl);
-        }
         #endregion
+
     }
 }

SGGL/WebAPI/Filter/TestPermissionAttribute.cs

@@ -3,6 +3,7 @@ using System.Linq;
 using System.Net.Http;
 using System.Web.Http.Controllers;
 using System.Web.Http.Filters;
+using BLL;
 
 namespace WebAPI.Filter
 {
@@ -38,13 +39,33 @@ namespace WebAPI.Filter
             }
             // base.OnActionExecuting(actionContext);
             if (isOk)
-            {
+            { // 在调用 Action 方法之前执行的代码，可获取请求的接口名称和参数
+                IDictionary<string, object> arguments = actionContext.ActionArguments; // 获取参数
+                foreach (KeyValuePair<string, object> item in arguments)
+                {
+                    if (item.Key == "projectid" || item.Key == "ProjectId" || item.Key == "projectId" || item.Key == "Projectid")
+                    {
+                        var ProjectItems = APIProjectService.geProjectsByUserId(token.FirstOrDefault());
+                        List<string> projects = new List<string>();
+                        if (ProjectItems.Count > 0)
+                        {
+                            projects = ProjectItems.Select(x => x.ProjectId).ToList();
+                        }
+                        if (item.Value != null && !projects.Contains(item.Value.ToString()))
+                        {
+
+                            actionContext.Response = actionContext.Request.CreateResponse(System.Net.HttpStatusCode.OK,
+                                new { code = "0", message = "您没有该项目权限！" }, actionContext.ControllerContext.Configuration.Formatters.JsonFormatter);
+                            return;
+                        }
+                    }
+                }
                 base.OnActionExecuting(actionContext);
             }
             else
             {
                 actionContext.Response = actionContext.Request.CreateResponse(System.Net.HttpStatusCode.OK,
-                       new { code = "0", message = "您没有权限！" }, actionContext.ControllerContext.Configuration.Formatters.JsonFormatter);
+                    new { code = "0", message = "您没有权限！" }, actionContext.ControllerContext.Configuration.Formatters.JsonFormatter);
             }
         }