解决漏洞xss攻击问题

package.json

@@ -64,6 +64,7 @@
         "vue": "2.6.12",
         "vue-count-to": "1.0.13",
         "vue-cropper": "0.5.5",
+        "vue-dompurify-html": "^2.6.0",
         "vue-easy-print": "0.0.8",
         "vue-json-excel": "^0.3.0",
         "vue-meta": "2.4.0",

src/main.js

@@ -11,26 +11,35 @@ import App from './App'
 import store from './store'
 import router from './router'
 import directive from './directive' // directive
+import VueDOMPurifyHTML from 'vue-dompurify-html'
 import plugins from './plugins' // plugins
 import { download, downloadJson } from '@/utils/request'
 
 import './assets/icons' // icon
 import './permission' // permission control
-import { getDicts } from "@/api/system/dict/data";
+import { getDicts } from '@/api/system/dict/data'
-import { getConfigKey } from "@/api/system/config";
+import { getConfigKey } from '@/api/system/config'
-import { parseTime, resetForm, addDateRange, selectDictLabel, selectDictLabels, handleTree, indexContinuation } from "@/utils/ruoyi";
+import {
+    parseTime,
+    resetForm,
+    addDateRange,
+    selectDictLabel,
+    selectDictLabels,
+    handleTree,
+    indexContinuation,
+} from '@/utils/ruoyi'
 // 分页组件
-import Pagination from "@/components/Pagination";
+import Pagination from '@/components/Pagination'
 // 自定义表格工具组件
-import RightToolbar from "@/components/RightToolbar"
+import RightToolbar from '@/components/RightToolbar'
 // 富文本组件
-import Editor from "@/components/Editor"
+import Editor from '@/components/Editor'
 // 文件上传组件
-import FileUpload from "@/components/FileUpload"
+import FileUpload from '@/components/FileUpload'
 // 图片上传组件
-import ImageUpload from "@/components/ImageUpload"
+import ImageUpload from '@/components/ImageUpload'
 // 图片预览组件
-import ImagePreview from "@/components/ImagePreview"
+import ImagePreview from '@/components/ImagePreview'
 // 字典标签组件
 import DictTag from '@/components/DictTag'
 // 头部标签组件
@@ -41,7 +50,6 @@ import DictData from '@/components/DictData'
 import JsonExcel from 'vue-json-excel'
 Vue.prototype.$eventBus = new Vue()
 
-
 import global_ from '@/utils/globalUrl'
 
 // 全局方法挂载
@@ -71,6 +79,7 @@ Vue.component('downloadExcel', JsonExcel)
 Vue.use(directive)
 Vue.use(plugins)
 Vue.use(VueMeta)
+Vue.use(VueDOMPurifyHTML)
 DictData.install()
 
 /**
@@ -83,14 +92,14 @@ DictData.install()
  */
 
 Vue.use(Element, {
-  size: Cookies.get('size') || 'medium' // set element-ui default size
+    size: Cookies.get('size') || 'medium', // set element-ui default size
 })
 
 Vue.config.productionTip = false
 
 new Vue({
-  el: '#app',
+    el: '#app',
-  router,
+    router,
-  store,
+    store,
-  render: h => h(App)
+    render: (h) => h(App),
 })

src/views/qrCode/qrCode.vue

@@ -154,8 +154,8 @@
         </div>
     </div>
 </template>
-  
+
-  <script>
+<script>
 import chapter from '../../utils/chapter'
 import { getMachineByQrCode } from '@/api/base/base'
 export default {
@@ -201,14 +201,14 @@ export default {
                 qrCode: this.qrCode,
             }
             getMachineByQrCode(param).then((response) => {
-                console.log(response)
+                console.log(response, '返回结果-----')
                 this.queryParams = response.data
             })
         },
     },
 }
 </script>
-  <style lang="scss" scoped>
+<style lang="scss" scoped>
 .item-box {
     display: flex;
     width: 100%;
@@ -223,4 +223,4 @@ export default {
     margin: auto;
     position: relative;
 }
-</style>
+</style>

src/views/system/notice/index.vue

@@ -126,7 +126,7 @@
                     <!--    :options="dict.type.sys_notice_type" -->
                     <!--    :value="scope.row.noticeContent" -->
                     <!--    /> -->
-                    <div v-html="row.noticeContent"></div>
+                    <div v-dompurify-html="row.noticeContent"></div>
                 </template>
             </el-table-column>
             <el-table-column
@@ -276,177 +276,175 @@
 </template>
 
 <script>
-    import {
+import {
-        listNotice,
+    listNotice,
-        getNotice,
+    getNotice,
-        delNotice,
+    delNotice,
-        addNotice,
+    addNotice,
-        updateNotice,
+    updateNotice,
-    } from '@/api/system/notice'
+} from '@/api/system/notice'
 
-    export default {
+export default {
-        name: 'Notice',
+    name: 'Notice',
-        dicts: ['sys_notice_status', 'sys_notice_type'],
+    dicts: ['sys_notice_status', 'sys_notice_type'],
-        data() {
+    data() {
-            return {
+        return {
-                // 遮罩层
+            // 遮罩层
-                loading: true,
+            loading: true,
-                // 选中数组
+            // 选中数组
-                ids: [],
+            ids: [],
-                // 非单个禁用
+            // 非单个禁用
-                single: true,
+            single: true,
-                // 非多个禁用
+            // 非多个禁用
-                multiple: true,
+            multiple: true,
-                // 显示搜索条件
+            // 显示搜索条件
-                showSearch: true,
+            showSearch: true,
-                // 总条数
+            // 总条数
-                total: 0,
+            total: 0,
-                // 公告表格数据
+            // 公告表格数据
-                noticeList: [],
+            noticeList: [],
-                // 弹出层标题
+            // 弹出层标题
-                title: '',
+            title: '',
-                // 是否显示弹出层
+            // 是否显示弹出层
-                open: false,
+            open: false,
-                // 查询参数
+            // 查询参数
-                queryParams: {
+            queryParams: {
-                    pageNum: 1,
+                pageNum: 1,
-                    pageSize: 10,
+                pageSize: 10,
-                    noticeTitle: undefined,
+                noticeTitle: undefined,
-                    // createBy: undefined,
+                // createBy: undefined,
-                    status: undefined,
+                status: undefined,
-                },
+            },
-                // 表单参数
+            // 表单参数
-                form: {},
+            form: {},
-                // 表单校验
+            // 表单校验
-                rules: {
+            rules: {
-                    noticeTitle: [
+                noticeTitle: [
-                        {
+                    {
-                            required: true,
+                        required: true,
-                            message: '公告标题不能为空',
+                        message: '公告标题不能为空',
-                            trigger: 'blur',
+                        trigger: 'blur',
-                        },
+                    },
-                    ],
+                ],
-                    noticeType: [
+                noticeType: [
-                        {
+                    {
-                            required: true,
+                        required: true,
-                            message: '公告类型不能为空',
+                        message: '公告类型不能为空',
-                            trigger: 'change',
+                        trigger: 'change',
-                        },
+                    },
-                    ],
+                ],
-                },
+            },
-            }
+        }
+    },
+    created() {
+        this.getList()
+    },
+    methods: {
+        /** 查询公告列表 */
+        getList() {
+            this.loading = true
+            listNotice(this.queryParams).then((response) => {
+                this.noticeList = response.rows
+                this.total = response.total
+                this.loading = false
+            })
         },
-        created() {
+        // 取消按钮
+        cancel() {
+            this.open = false
+            this.reset()
+        },
+        // 表单重置
+        reset() {
+            this.form = {
+                noticeId: undefined,
+                noticeTitle: undefined,
+                noticeType: undefined,
+                noticeContent: undefined,
+                status: '0',
+            }
+            this.resetForm('form')
+        },
+        /** 搜索按钮操作 */
+        handleQuery() {
+            this.queryParams.pageNum = 1
             this.getList()
         },
-        methods: {
+        /** 重置按钮操作 */
-            /** 查询公告列表 */
+        resetQuery() {
-            getList() {
+            this.resetForm('queryForm')
-                this.loading = true
+            this.handleQuery()
-                listNotice(this.queryParams).then((response) => {
-                    this.noticeList = response.rows
-                    this.total = response.total
-                    this.loading = false
-                })
-            },
-            // 取消按钮
-            cancel() {
-                this.open = false
-                this.reset()
-            },
-            // 表单重置
-            reset() {
-                this.form = {
-                    noticeId: undefined,
-                    noticeTitle: undefined,
-                    noticeType: undefined,
-                    noticeContent: undefined,
-                    status: '0',
-                }
-                this.resetForm('form')
-            },
-            /** 搜索按钮操作 */
-            handleQuery() {
-                this.queryParams.pageNum = 1
-                this.getList()
-            },
-            /** 重置按钮操作 */
-            resetQuery() {
-                this.resetForm('queryForm')
-                this.handleQuery()
-            },
-            // 多选框选中数据
-            handleSelectionChange(selection) {
-                this.ids = selection.map((item) => item.noticeId)
-                this.single = selection.length != 1
-                this.multiple = !selection.length
-            },
-            /** 新增按钮操作 */
-            handleAdd() {
-                this.reset()
-                this.open = true
-                this.title = '添加公告'
-            },
-            /** 修改按钮操作 */
-            handleUpdate(row) {
-                this.reset()
-                const noticeId = row.noticeId || this.ids
-                getNotice(noticeId).then((response) => {
-                    this.form = response.data
-                    this.open = true
-                    this.title = '修改公告'
-                })
-            },
-            /** 提交按钮 */
-            submitForm: function () {
-                this.$refs['form'].validate((valid) => {
-                    if (valid) {
-                        if (this.form.noticeId != undefined) {
-                            updateNotice(this.form).then((response) => {
-                                this.$modal.msgSuccess('修改成功')
-                                this.open = false
-                                this.getList()
-                            })
-                        } else {
-                            addNotice(this.form).then((response) => {
-                                this.$modal.msgSuccess('新增成功')
-                                this.open = false
-                                this.getList()
-                            })
-                        }
-                    }
-                })
-            },
-            /** 删除按钮操作 */
-            handleDelete(row) {
-                const noticeIds = row.noticeId || this.ids
-                this.$modal
-                    .confirm(
-                        '是否确认删除所选择的数据项？',
-                    )
-                    .then(function () {
-                        return delNotice(noticeIds)
-                    })
-                    .then(() => {
-                        this.getList()
-                        this.$modal.msgSuccess('删除成功')
-                    })
-                    .catch(() => {})
-            },
-            handleEditorChange(value) {
-                let parser = new DOMParser()
-                let doc = parser.parseFromString(value, "text/html")
-                let text = doc.body.textContent || ""
-                // 当text.length 超过200 时候,提示用户并且截取前200个字符
-                if (text.length > 200) {
-                    this.$message({
-                        message: '公告内容不能超过200个字符!',
-                        type: 'warning'
-                    })
-                    this.form.noticeContent = text.substring(0, 200)
-                    return
-                }
-            },
         },
-    }
+        // 多选框选中数据
+        handleSelectionChange(selection) {
+            this.ids = selection.map((item) => item.noticeId)
+            this.single = selection.length != 1
+            this.multiple = !selection.length
+        },
+        /** 新增按钮操作 */
+        handleAdd() {
+            this.reset()
+            this.open = true
+            this.title = '添加公告'
+        },
+        /** 修改按钮操作 */
+        handleUpdate(row) {
+            this.reset()
+            const noticeId = row.noticeId || this.ids
+            getNotice(noticeId).then((response) => {
+                this.form = response.data
+                this.open = true
+                this.title = '修改公告'
+            })
+        },
+        /** 提交按钮 */
+        submitForm: function () {
+            this.$refs['form'].validate((valid) => {
+                if (valid) {
+                    if (this.form.noticeId != undefined) {
+                        updateNotice(this.form).then((response) => {
+                            this.$modal.msgSuccess('修改成功')
+                            this.open = false
+                            this.getList()
+                        })
+                    } else {
+                        addNotice(this.form).then((response) => {
+                            this.$modal.msgSuccess('新增成功')
+                            this.open = false
+                            this.getList()
+                        })
+                    }
+                }
+            })
+        },
+        /** 删除按钮操作 */
+        handleDelete(row) {
+            const noticeIds = row.noticeId || this.ids
+            this.$modal
+                .confirm('是否确认删除所选择的数据项？')
+                .then(function () {
+                    return delNotice(noticeIds)
+                })
+                .then(() => {
+                    this.getList()
+                    this.$modal.msgSuccess('删除成功')
+                })
+                .catch(() => {})
+        },
+        handleEditorChange(value) {
+            let parser = new DOMParser()
+            let doc = parser.parseFromString(value, 'text/html')
+            let text = doc.body.textContent || ''
+            // 当text.length 超过200 时候,提示用户并且截取前200个字符
+            if (text.length > 200) {
+                this.$message({
+                    message: '公告内容不能超过200个字符!',
+                    type: 'warning',
+                })
+                this.form.noticeContent = text.substring(0, 200)
+                return
+            }
+        },
+    },
+}
 </script>

src/views/warehouseManage/tagBind/bind/index.vue

@@ -92,7 +92,6 @@
                         icon="el-icon-plus"
                         size="mini"
                         @click="handleBind"
-                        :disabled="single"
                         v-hasPermi="['tagBind:bind:bind']"
                         >绑定</el-button
                     >
@@ -123,7 +122,6 @@
                             plain
                             icon="el-icon-plus"
                             size="mini"
-                            :disabled="multiple"
                             @click="labelUpload"
                             v-hasPermi="['tagBind:bind:unload']"
                             >标签下载</el-button
@@ -182,12 +180,7 @@
                 :data="labelList"
                 @selection-change="handleSelectionChange"
             >
-                <el-table-column
+                <el-table-column type="selection" width="55" align="center" />
-                    type="selection"
-                    width="55"
-                    align="center"
-                    :selectable="(row, index) => row.status != '1'"
-                />
                 <el-table-column
                     align="center"
                     label="序号"
@@ -694,6 +687,16 @@ export default {
         },
         /** 绑定按钮操作 */
         handleBind() {
+            if (this.checkboxModel.length < 1) {
+                this.$modal.msgError('请勾选需要下载的数据！')
+                return
+            } else {
+                const isBind = this.checkboxModel.every((e) => e.status != 1)
+                if (!isBind) {
+                    this.$modal.msgError('只能选择未绑定机具的标签！')
+                    return
+                }
+            }
             this.reset()
             this.open = true
             this.title = '绑定'
@@ -852,6 +855,11 @@ export default {
         },
         //标签下载
         async labelUpload() {
+            if (this.checkboxModel.length < 1) {
+                this.$modal.msgError('请勾选需要下载的数据！')
+                return
+            }
+
             console.log('checkboxModel', this.checkboxModel)
             const msg = this.$modal.loading('批量生成中，请稍候...')
             try {