open-source/file-online-preview
1
0
Fork 0
mirror of https://gitee.com/kekingcn/file-online-preview.git synced 2026-09-13 16:34:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: secure demo file deletion

Browse Source
This commit is contained in:
kl
2026-08-14 11:12:50 +08:00
parent 9c3fd82076
commit f852bf844b
6 changed files with 148 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
server/src/main/java/cn/keking/config/ConfigConstants.java
View File

@@ -31,7 +31,7 @@ public class ConfigConstants {
// ==================================================
public static final String DEFAULT_VALUE = "default";
public static final String DEFAULT_SHOW_AES_KEY = "1234567890123456";
public static final String DEFAULT_PASSWORD = "123456";
public static final String DEFAULT_PASSWORD = "false";
public static final String DEFAULT_SIZE = "500MB";
public static final String DEFAULT_ENABLE_REFRECSHSCHEDULE = "5";
public static final String DEFAULT_IS_JAVASCRIPT = "false";
@@ -664,7 +664,7 @@ public class ConfigConstants {
public void setSize(String size) { setSizeValue(size); }
public static void setSizeValue(String size) { ConfigConstants.size = size; }
@Value("${delete.password:123456}")
@Value("${delete.password:false}")
public void setPassword(String password) { setPasswordValue(password); }
public static void setPasswordValue(String password) { ConfigConstants.password = password; }

20
server/src/main/java/cn/keking/web/controller/FileController.java
View File

@@ -11,6 +11,7 @@ import cn.keking.utils.WebUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.util.ObjectUtils;
import org.springframework.util.StringUtils;
import org.springframework.util.StreamUtils;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
@@ -33,6 +34,8 @@ import java.nio.file.InvalidPathException;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.attribute.BasicFileAttributes;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.*;
import static cn.keking.utils.CaptchaUtil.CAPTCHA_CODE;
@@ -218,7 +221,7 @@ public class FileController {
}
}
@GetMapping("/deleteFile")
@PostMapping("/deleteFile")
public ReturnResponse<Object> deleteFile(HttpServletRequest request, String fileName, String password) {
ReturnResponse<Object> checkResult = this.deleteFileCheck(request, fileName, password);
if (checkResult.isFailure()) {
@@ -775,11 +778,22 @@ public class FileController {
return ReturnResponse.failure("密码 or 验证码为空，删除失败！");
}
String expectedPassword = ConfigConstants.getDeleteCaptcha() ?
boolean captchaEnabled = ConfigConstants.getDeleteCaptcha();
String expectedPassword = captchaEnabled ?
WebUtils.getSessionAttr(request, CAPTCHA_CODE) :
ConfigConstants.getPassword();
if (!password.equalsIgnoreCase(expectedPassword)) {
if (!captchaEnabled && (!StringUtils.hasText(expectedPassword)
|| "false".equalsIgnoreCase(expectedPassword))) {
return ReturnResponse.failure("文件删除接口已禁用，请先配置 delete.password");
}
if (!StringUtils.hasText(expectedPassword)) {
return ReturnResponse.failure("验证码已失效，请刷新后重试！");
}
if (!MessageDigest.isEqual(password.getBytes(StandardCharsets.UTF_8),
expectedPassword.getBytes(StandardCharsets.UTF_8))) {
logger.error("删除文件【{}】失败，密码错误！", fileName);
return ReturnResponse.failure("删除文件失败，密码错误！");
}