fix [Task]: 2.6使用环境变量STEEDOS_CFS_UPLOAD_DENY_EXT控制, 哪些格式的文件禁止上传. #6725

#6725
steedos · Apr 15, 2024 · e1cefd7 · e1cefd7
1 parent 4d435bc
commit e1cefd7
Show file tree

Hide file tree

Showing 3 changed files with 35 additions and 7 deletions.
diff --git a/services/service-files/main/default/routes/api_v4_instances_s3.router.js b/services/service-files/main/default/routes/api_v4_instances_s3.router.js
@@ -1,14 +1,15 @@
 /*
  * @Author: [email protected]
  * @Date: 2022-06-08 09:38:56
- * @LastEditors: sunhaolin@hotoa.com
- * @LastEditTime: 2022-08-03 11:33:16
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2024-04-15 18:18:09
  * @Description: 
  */
 const express = require("express");
 const router = express.Router();
 const core = require('@steedos/core');
 const formidable = require('formidable');
+const _ = require('lodash')
 const {
     getCollection,
     File,
@@ -64,6 +65,17 @@ router.post('/api/v4/instances/s3/', core.requireAuthentication, async function
 
                 const collection = await getCollection(DB_COLLECTION_NAME);
 
+                const deny_ext = _.split(process.env.STEEDOS_CFS_UPLOAD_DENY_EXT, ',');
+
+                const fileName = formatFileName(originalFilename, upload_from);
+
+                const name_split = fileName.split('.');
+                const extention = name_split.pop();
+
+                if(_.includes(deny_ext, extention)){
+                    throw new Error(`禁止上传「${extention}」附件`)
+                }
+
                 const newFile = new File({ name: formatFileName(originalFilename, upload_from), size, mimetype, fsCollectionName: FS_COLLECTION_NAME });
 
                 let parentId = '';

diff --git a/services/service-files/main/default/routes/s3.router.js b/services/service-files/main/default/routes/s3.router.js
@@ -1,15 +1,16 @@
 /*
  * @Author: [email protected]
  * @Date: 2022-06-10 09:38:53
- * @LastEditors: sunhaolin@hotoa.com
- * @LastEditTime: 2023-06-12 16:47:12
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2024-04-15 18:18:33
  * @Description: 
  */
 
 const express = require("express");
 const router = express.Router();
 const core = require('@steedos/core');
 const formidable = require('formidable');
+const _ = require('lodash')
 const {
     getCollection,
     File,
@@ -65,10 +66,15 @@ router.post('/s3/', core.requireAuthentication, async function (req, res) {
                 const newFile = new File({ name: formatFileName(originalFilename, upload_from), size, mimetype, fsCollectionName: FS_COLLECTION_NAME });
 
                 const filename = newFile.name;
-
+
+                const deny_ext = _.split(process.env.STEEDOS_CFS_UPLOAD_DENY_EXT, ',');
                 const name_split = filename.split('.');
                 const extention = name_split.pop();
 
+                if(_.includes(deny_ext, extention)){
+                    throw new Error(`禁止上传「${extention}」附件`)
+                }
+
                 const metadata = {
                     owner,
                     owner_name,

diff --git a/services/service-files/main/default/routes/s3_collection.router.js b/services/service-files/main/default/routes/s3_collection.router.js
@@ -1,15 +1,16 @@
 /*
  * @Author: [email protected]
  * @Date: 2022-06-10 09:38:53
- * @LastEditors: sunhaolin@hotoa.com
- * @LastEditTime: 2022-08-03 11:33:20
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2024-04-15 17:42:25
  * @Description: 
  */
 
 const express = require("express");
 const router = express.Router();
 const core = require('@steedos/core');
 const formidable = require('formidable');
+const _ = require('lodash')
 const {
     getCollection,
     File,
@@ -47,6 +48,15 @@ router.post('/s3/:collection/', core.requireAuthentication, async function (req,
                     size
                 } = files.file;
 
+                const deny_ext = _.split(process.env.STEEDOS_CFS_UPLOAD_DENY_EXT, ',');
+
+                const name_split = originalFilename.split('.');
+                const extention = name_split.pop();
+
+                if(_.includes(deny_ext, extention)){
+                    throw new Error(`禁止上传「${extention}」附件`)
+                }
+
                 const collection = await getCollection(DB_COLLECTION_NAME);
 
                 const newFile = new File({ name: originalFilename, size, mimetype, fsCollectionName: FS_COLLECTION_NAME });