解决漏洞xss攻击问题

package.json

@@ -64,6 +64,7 @@
         "vue": "2.6.12",
         "vue-count-to": "1.0.13",
         "vue-cropper": "0.5.5",
+        "vue-dompurify-html": "^2.6.0",
         "vue-easy-print": "0.0.8",
         "vue-json-excel": "^0.3.0",
         "vue-meta": "2.4.0",

src/main.js

@@ -11,26 +11,35 @@ import App from './App'
 import store from './store'
 import router from './router'
 import directive from './directive' // directive
+import VueDOMPurifyHTML from 'vue-dompurify-html'
 import plugins from './plugins' // plugins
 import { download, downloadJson } from '@/utils/request'
 
 import './assets/icons' // icon
 import './permission' // permission control
-import { getDicts } from "@/api/system/dict/data";
+import { getDicts } from '@/api/system/dict/data'
-import { getConfigKey } from "@/api/system/config";
+import { getConfigKey } from '@/api/system/config'
-import { parseTime, resetForm, addDateRange, selectDictLabel, selectDictLabels, handleTree, indexContinuation } from "@/utils/ruoyi";
+import {
+    parseTime,
+    resetForm,
+    addDateRange,
+    selectDictLabel,
+    selectDictLabels,
+    handleTree,
+    indexContinuation,
+} from '@/utils/ruoyi'
 // 分页组件
-import Pagination from "@/components/Pagination";
+import Pagination from '@/components/Pagination'
 // 自定义表格工具组件
-import RightToolbar from "@/components/RightToolbar"
+import RightToolbar from '@/components/RightToolbar'
 // 富文本组件
-import Editor from "@/components/Editor"
+import Editor from '@/components/Editor'
 // 文件上传组件
-import FileUpload from "@/components/FileUpload"
+import FileUpload from '@/components/FileUpload'
 // 图片上传组件
-import ImageUpload from "@/components/ImageUpload"
+import ImageUpload from '@/components/ImageUpload'
 // 图片预览组件
-import ImagePreview from "@/components/ImagePreview"
+import ImagePreview from '@/components/ImagePreview'
 // 字典标签组件
 import DictTag from '@/components/DictTag'
 // 头部标签组件
@@ -41,7 +50,6 @@ import DictData from '@/components/DictData'
 import JsonExcel from 'vue-json-excel'
 Vue.prototype.$eventBus = new Vue()
 
-
 import global_ from '@/utils/globalUrl'
 
 // 全局方法挂载
@@ -71,6 +79,7 @@ Vue.component('downloadExcel', JsonExcel)
 Vue.use(directive)
 Vue.use(plugins)
 Vue.use(VueMeta)
+Vue.use(VueDOMPurifyHTML)
 DictData.install()
 
 /**
@@ -83,7 +92,7 @@ DictData.install()
  */
 
 Vue.use(Element, {
-  size: Cookies.get('size') || 'medium' // set element-ui default size
+    size: Cookies.get('size') || 'medium', // set element-ui default size
 })
 
 Vue.config.productionTip = false
@@ -92,5 +101,5 @@ new Vue({
     el: '#app',
     router,
     store,
-  render: h => h(App)
+    render: (h) => h(App),
 })

src/views/qrCode/qrCode.vue

@@ -155,7 +155,7 @@
     </div>
 </template>
 
-  <script>
+<script>
 import chapter from '../../utils/chapter'
 import { getMachineByQrCode } from '@/api/base/base'
 export default {
@@ -201,14 +201,14 @@ export default {
                 qrCode: this.qrCode,
             }
             getMachineByQrCode(param).then((response) => {
-                console.log(response)
+                console.log(response, '返回结果-----')
                 this.queryParams = response.data
             })
         },
     },
 }
 </script>
-  <style lang="scss" scoped>
+<style lang="scss" scoped>
 .item-box {
     display: flex;
     width: 100%;

src/views/system/notice/index.vue

@@ -126,7 +126,7 @@
                     <!--    :options="dict.type.sys_notice_type" -->
                     <!--    :value="scope.row.noticeContent" -->
                     <!--    /> -->
-                    <div v-html="row.noticeContent"></div>
+                    <div v-dompurify-html="row.noticeContent"></div>
                 </template>
             </el-table-column>
             <el-table-column
@@ -276,15 +276,15 @@
 </template>
 
 <script>
-    import {
+import {
     listNotice,
     getNotice,
     delNotice,
     addNotice,
     updateNotice,
-    } from '@/api/system/notice'
+} from '@/api/system/notice'
 
-    export default {
+export default {
     name: 'Notice',
     dicts: ['sys_notice_status', 'sys_notice_type'],
     data() {
@@ -421,9 +421,7 @@
         handleDelete(row) {
             const noticeIds = row.noticeId || this.ids
             this.$modal
-                    .confirm(
+                .confirm('是否确认删除所选择的数据项？')
-                        '是否确认删除所选择的数据项？',
-                    )
                 .then(function () {
                     return delNotice(noticeIds)
                 })
@@ -435,18 +433,18 @@
         },
         handleEditorChange(value) {
             let parser = new DOMParser()
-                let doc = parser.parseFromString(value, "text/html")
+            let doc = parser.parseFromString(value, 'text/html')
-                let text = doc.body.textContent || ""
+            let text = doc.body.textContent || ''
             // 当text.length 超过200 时候,提示用户并且截取前200个字符
             if (text.length > 200) {
                 this.$message({
                     message: '公告内容不能超过200个字符!',
-                        type: 'warning'
+                    type: 'warning',
                 })
                 this.form.noticeContent = text.substring(0, 200)
                 return
             }
         },
     },
-    }
+}
 </script>

src/views/warehouseManage/tagBind/bind/index.vue

@@ -92,7 +92,6 @@
                         icon="el-icon-plus"
                         size="mini"
                         @click="handleBind"
-                        :disabled="single"
                         v-hasPermi="['tagBind:bind:bind']"
                         >绑定</el-button
                     >
@@ -123,7 +122,6 @@
                             plain
                             icon="el-icon-plus"
                             size="mini"
-                            :disabled="multiple"
                             @click="labelUpload"
                             v-hasPermi="['tagBind:bind:unload']"
                             >标签下载</el-button
@@ -182,12 +180,7 @@
                 :data="labelList"
                 @selection-change="handleSelectionChange"
             >
-                <el-table-column
+                <el-table-column type="selection" width="55" align="center" />
-                    type="selection"
-                    width="55"
-                    align="center"
-                    :selectable="(row, index) => row.status != '1'"
-                />
                 <el-table-column
                     align="center"
                     label="序号"
@@ -694,6 +687,16 @@ export default {
         },
         /** 绑定按钮操作 */
         handleBind() {
+            if (this.checkboxModel.length < 1) {
+                this.$modal.msgError('请勾选需要下载的数据！')
+                return
+            } else {
+                const isBind = this.checkboxModel.every((e) => e.status != 1)
+                if (!isBind) {
+                    this.$modal.msgError('只能选择未绑定机具的标签！')
+                    return
+                }
+            }
             this.reset()
             this.open = true
             this.title = '绑定'
@@ -852,6 +855,11 @@ export default {
         },
         //标签下载
         async labelUpload() {
+            if (this.checkboxModel.length < 1) {
+                this.$modal.msgError('请勾选需要下载的数据！')
+                return
+            }
+
             console.log('checkboxModel', this.checkboxModel)
             const msg = this.$modal.loading('批量生成中，请稍候...')
             try {