2023-09-26

SGGL/WebAPI/Controllers/FileUploadController.cs

@@ -1,5 +1,6 @@
 using BLL;
 using System;
+using System.Collections.Generic;
 using System.Configuration;
 using System.Drawing;
 using System.IO;
@@ -27,6 +28,8 @@ namespace WebAPI.Controllers
             {
                 typeName = "WebApi";
             }
+            // 定义允许上传的文件类型列表
+            List<string> allowExtensions = BLL.DropListService.allowExtensions;
             string reUrl = string.Empty;
             if (files != null && files.Count > 0)
             {
@@ -36,12 +39,17 @@ namespace WebAPI.Controllers
                 {
                     Directory.CreateDirectory(localRoot);
                 }
+                
                 foreach (string key in files.AllKeys)
                 {
                     string rootUrl = string.Empty;
                     string fileName = string.Empty;
                     string extensionstr = string.Empty;
                     HttpPostedFile file = files[key];//file.ContentLength文件长度
+                    if (!allowExtensions.Contains(Path.GetExtension(file.FileName)))
+                    {
+                        return BadRequest($"Invalid file extension: {file.FileName}");
+                    }
                     if (!string.IsNullOrEmpty(file.FileName))
                     {
                         extensionstr = Path.GetExtension(file.FileName).ToLower();