!577 发布 5.2.2 正式版 安全性提升 Merge pull request !577 from 疯狂的狮子Li/dev

疯狂的狮子Li

2024-08-26 098d3347a0df808908aab8c554cd7c4febc5e6d9

 ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/ActModelServiceImpl.java

@@ -10,10 +10,10 @@
import com.alibaba.excel.util.StringUtils;
import jakarta.servlet.http.HttpServletResponse;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.apache.batik.transcoder.TranscoderInput;
import org.apache.batik.transcoder.TranscoderOutput;
import org.apache.batik.transcoder.image.PNGTranscoder;
import org.apache.commons.io.IOUtils;
import org.dromara.common.core.exception.ServiceException;
import org.dromara.common.mybatis.core.page.PageQuery;
import org.dromara.common.mybatis.core.page.TableDataInfo;
@@ -34,8 +34,12 @@
import org.flowable.bpmn.model.Process;
import org.flowable.bpmn.model.UserTask;
import org.flowable.engine.RepositoryService;
import org.flowable.engine.repository.*;
import org.flowable.engine.repository.Deployment;
import org.flowable.engine.repository.Model;
import org.flowable.engine.repository.ModelQuery;
import org.flowable.engine.repository.ProcessDefinition;
import org.flowable.validation.ValidationError;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@@ -46,7 +50,6 @@
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.stream.Collectors;
@@ -58,13 +61,15 @@
 *
 * @author may
 */
@Slf4j
@RequiredArgsConstructor
@Service
public class ActModelServiceImpl implements IActModelService {

    private final RepositoryService repositoryService;
    private final IWfNodeConfigService iWfNodeConfigService;
    private final IWfDefinitionConfigService iWfDefinitionConfigService;
    @Autowired(required = false)
    private RepositoryService repositoryService;
    private final IWfNodeConfigService wfNodeConfigService;
    private final IWfDefinitionConfigService wfDefinitionConfigService;

    /**
     * 分页查询模型
@@ -130,7 +135,7 @@
            repositoryService.addModelEditorSource(model.getId(), StrUtil.utf8Bytes(xml));
            return true;
        } catch (Exception e) {
            e.printStackTrace();
            log.error(e.getMessage(), e);
            throw new ServiceException(e.getMessage());
        }
    }
@@ -156,6 +161,7 @@
                modelVo.setDescription(model.getMetaInfo());
                return modelVo;
            } catch (Exception e) {
                log.error(e.getMessage(), e);
                throw new ServiceException(e.getMessage());
            }
        }
@@ -180,6 +186,7 @@
            model.setMetaInfo(modelBo.getDescription());
            repositoryService.saveModel(model);
        } catch (Exception e) {
            log.error(e.getMessage(), e);
            throw new ServiceException(e.getMessage());
        }
        return true;
@@ -229,7 +236,7 @@
            repositoryService.addModelEditorSourceExtra(model.getId(), result);
            return true;
        } catch (Exception e) {
            e.printStackTrace();
            log.error(e.getMessage(), e);
            throw new ServiceException(e.getMessage());
        }
    }
@@ -249,7 +256,7 @@
            if (ArrayUtil.isEmpty(xmlBytes)) {
                throw new ServiceException("模型数据为空，请先设计流程定义模型，再进行部署！");
            }
            if (JSONUtil.isTypeJSON(IOUtils.toString(xmlBytes, StandardCharsets.UTF_8.toString()))) {
            if (JSONUtil.isTypeJSON(new String(xmlBytes, StandardCharsets.UTF_8))) {
                byte[] bytes = ModelUtils.bpmnJsonToXmlBytes(xmlBytes);
                if (ArrayUtil.isEmpty(bytes)) {
                    throw new ServiceException("模型不能为空，请至少设计一条主线流程！");
@@ -290,16 +297,16 @@
            repositoryService.setProcessDefinitionCategory(definition.getId(), model.getCategory());
            //更新流程定义配置
            if (processDefinition != null) {
                WfDefinitionConfigVo definitionVo = iWfDefinitionConfigService.getByDefId(processDefinition.getId());
                WfDefinitionConfigVo definitionVo = wfDefinitionConfigService.getByDefId(processDefinition.getId());
                if (definitionVo != null) {
                    iWfDefinitionConfigService.deleteByDefIds(Collections.singletonList(processDefinition.getId()));
                    wfDefinitionConfigService.deleteByDefIds(Collections.singletonList(processDefinition.getId()));
                    WfDefinitionConfigBo wfFormDefinition = new WfDefinitionConfigBo();
                    wfFormDefinition.setDefinitionId(definition.getId());
                    wfFormDefinition.setProcessKey(definition.getKey());
                    wfFormDefinition.setTableName(definitionVo.getTableName());
                    wfFormDefinition.setVersion(definition.getVersion());
                    wfFormDefinition.setRemark(definitionVo.getRemark());
                    iWfDefinitionConfigService.saveOrUpdate(wfFormDefinition);
                    wfDefinitionConfigService.saveOrUpdate(wfFormDefinition);
                }
            }
            //更新流程节点配置表单
@@ -320,11 +327,11 @@
                }
            }
            if (CollUtil.isNotEmpty(wfNodeConfigList)) {
                iWfNodeConfigService.saveOrUpdate(wfNodeConfigList);
                wfNodeConfigService.saveOrUpdate(wfNodeConfigList);
            }
            return true;
        } catch (Exception e) {
            e.printStackTrace();
            log.error(e.getMessage(), e);
            throw new ServiceException(e.getMessage());
        }
    }
@@ -337,9 +344,7 @@
     */
    @Override
    public void exportZip(List<String> modelIds, HttpServletResponse response) {
        ZipOutputStream zos = null;
        try {
            zos = ZipUtil.getZipOutputStream(response.getOutputStream(), StandardCharsets.UTF_8);
        try (ZipOutputStream zos = ZipUtil.getZipOutputStream(response.getOutputStream(), StandardCharsets.UTF_8)) {
            // 压缩包文件名
            String zipName = "模型不存在";
            // 查询模型基本信息
@@ -347,7 +352,7 @@
                Model model = repositoryService.getModel(modelId);
                byte[] xmlBytes = repositoryService.getModelEditorSource(modelId);
                if (ObjectUtil.isNotNull(model)) {
                    if (JSONUtil.isTypeJSON(IOUtils.toString(xmlBytes, StandardCharsets.UTF_8.toString())) && ArrayUtil.isEmpty(ModelUtils.bpmnJsonToXmlBytes(xmlBytes))) {
                    if (JSONUtil.isTypeJSON(new String(xmlBytes, StandardCharsets.UTF_8)) && ArrayUtil.isEmpty(ModelUtils.bpmnJsonToXmlBytes(xmlBytes))) {
                        zipName = "模型不能为空，请至少设计一条主线流程！";
                        zos.putNextEntry(new ZipEntry(zipName + ".txt"));
                        zos.write(zipName.getBytes(StandardCharsets.UTF_8));
@@ -367,19 +372,11 @@
            }
            response.setHeader("Content-Disposition",
                "attachment; filename=" + URLEncoder.encode(zipName, StandardCharsets.UTF_8) + ".zip");
            response.addHeader("Access-Control-Expose-Headers", "Content-Disposition");
            // 刷出响应流
            response.flushBuffer();
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            if (zos != null) {
                try {
                    zos.closeEntry();
                    zos.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            log.error(e.getMessage(), e);
        }
    }

@@ -426,6 +423,7 @@
                }
            }
        } catch (Exception e) {
            log.error(e.getMessage(), e);
            throw new ServiceException(e.getMessage());
        }
        return true;