From c1db17dd771f202647ec56898f6b09cf00947a26 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: 星期二, 26 五月 2020 11:54:46 +0800
Subject: [PATCH] 限制外链地址必须以http(s)://开头

---
 ruoyi/src/main/java/com/ruoyi/common/constant/Constants.java                      |   10 ++++++++++
 ruoyi/src/main/java/com/ruoyi/project/system/service/impl/SysMenuServiceImpl.java |    2 +-
 ruoyi/src/main/java/com/ruoyi/project/system/controller/SysMenuController.java    |   12 ++++++++++++
 ruoyi/src/main/java/com/ruoyi/common/constant/UserConstants.java                  |    8 +++++++-
 4 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/ruoyi/src/main/java/com/ruoyi/common/constant/Constants.java b/ruoyi/src/main/java/com/ruoyi/common/constant/Constants.java
index 63ea9ed..768bc24 100644
--- a/ruoyi/src/main/java/com/ruoyi/common/constant/Constants.java
+++ b/ruoyi/src/main/java/com/ruoyi/common/constant/Constants.java
@@ -20,6 +20,16 @@
     public static final String GBK = "GBK";
 
     /**
+     * http璇锋眰
+     */
+    public static final String HTTP = "http://";
+
+    /**
+     * https璇锋眰
+     */
+    public static final String HTTPS = "https://";
+
+    /**
      * 閫氱敤鎴愬姛鏍囪瘑
      */
     public static final String SUCCESS = "0";
diff --git a/ruoyi/src/main/java/com/ruoyi/common/constant/UserConstants.java b/ruoyi/src/main/java/com/ruoyi/common/constant/UserConstants.java
index 03f12e7..df6992a 100644
--- a/ruoyi/src/main/java/com/ruoyi/common/constant/UserConstants.java
+++ b/ruoyi/src/main/java/com/ruoyi/common/constant/UserConstants.java
@@ -26,7 +26,7 @@
 
     /** 閮ㄩ棬姝e父鐘舵�� */
     public static final String DEPT_NORMAL = "0";
-    
+
     /** 閮ㄩ棬鍋滅敤鐘舵�� */
     public static final String DEPT_DISABLE = "1";
 
@@ -36,6 +36,12 @@
     /** 鏄惁涓虹郴缁熼粯璁わ紙鏄級 */
     public static final String YES = "Y";
 
+    /** 鏄惁鑿滃崟澶栭摼锛堟槸锛� */
+    public static final String YES_FRAME = "0";
+
+    /** 鏄惁鑿滃崟澶栭摼锛堝惁锛� */
+    public static final String NO_FRAME = "1";
+
     /** 鏍¢獙杩斿洖缁撴灉鐮� */
     public final static String UNIQUE = "0";
     public final static String NOT_UNIQUE = "1";
diff --git a/ruoyi/src/main/java/com/ruoyi/project/system/controller/SysMenuController.java b/ruoyi/src/main/java/com/ruoyi/project/system/controller/SysMenuController.java
index 35ca406..a958f62 100644
--- a/ruoyi/src/main/java/com/ruoyi/project/system/controller/SysMenuController.java
+++ b/ruoyi/src/main/java/com/ruoyi/project/system/controller/SysMenuController.java
@@ -12,9 +12,11 @@
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
+import com.ruoyi.common.constant.Constants;
 import com.ruoyi.common.constant.UserConstants;
 import com.ruoyi.common.utils.SecurityUtils;
 import com.ruoyi.common.utils.ServletUtils;
+import com.ruoyi.common.utils.StringUtils;
 import com.ruoyi.framework.aspectj.lang.annotation.Log;
 import com.ruoyi.framework.aspectj.lang.enums.BusinessType;
 import com.ruoyi.framework.security.LoginUser;
@@ -100,6 +102,11 @@
         {
             return AjaxResult.error("鏂板鑿滃崟'" + menu.getMenuName() + "'澶辫触锛岃彍鍗曞悕绉板凡瀛樺湪");
         }
+        else if (UserConstants.YES_FRAME.equals(menu.getIsFrame())
+                && !StringUtils.startsWithAny(menu.getPath(), Constants.HTTP, Constants.HTTPS))
+        {
+            return AjaxResult.error("鏂板鑿滃崟'" + menu.getMenuName() + "'澶辫触锛屽湴鍧�蹇呴』浠ttp(s)://寮�澶�");
+        }
         menu.setCreateBy(SecurityUtils.getUsername());
         return toAjax(menuService.insertMenu(menu));
     }
@@ -116,6 +123,11 @@
         {
             return AjaxResult.error("淇敼鑿滃崟'" + menu.getMenuName() + "'澶辫触锛岃彍鍗曞悕绉板凡瀛樺湪");
         }
+        else if (UserConstants.YES_FRAME.equals(menu.getIsFrame())
+                && !StringUtils.startsWithAny(menu.getPath(), Constants.HTTP, Constants.HTTPS))
+        {
+            return AjaxResult.error("鏂板鑿滃崟'" + menu.getMenuName() + "'澶辫触锛屽湴鍧�蹇呴』浠ttp(s)://寮�澶�");
+        }
         menu.setUpdateBy(SecurityUtils.getUsername());
         return toAjax(menuService.updateMenu(menu));
     }
diff --git a/ruoyi/src/main/java/com/ruoyi/project/system/service/impl/SysMenuServiceImpl.java b/ruoyi/src/main/java/com/ruoyi/project/system/service/impl/SysMenuServiceImpl.java
index 31eb70b..d5aff8e 100644
--- a/ruoyi/src/main/java/com/ruoyi/project/system/service/impl/SysMenuServiceImpl.java
+++ b/ruoyi/src/main/java/com/ruoyi/project/system/service/impl/SysMenuServiceImpl.java
@@ -298,7 +298,7 @@
     {
         String routerPath = menu.getPath();
         // 闈炲閾惧苟涓旀槸涓�绾х洰褰�
-        if (0 == menu.getParentId() && "1".equals(menu.getIsFrame()))
+        if (0 == menu.getParentId() && UserConstants.NO_FRAME.equals(menu.getIsFrame()))
         {
             routerPath = "/" + menu.getPath();
         }

--
Gitblit v1.9.3