From b49cdbbc9516352d1f4511e4223fa9d089b057b9 Mon Sep 17 00:00:00 2001 From: RuoYi <yzz_ivy@163.com> Date: 星期四, 27 一月 2022 12:12:30 +0800 Subject: [PATCH] 用户访问控制时校验数据权限,防止越权 --- src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) diff --git a/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java b/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java index 52854bf..a350ef2 100644 --- a/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java +++ b/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java @@ -86,6 +86,8 @@ { private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class); + public static final String[] FORMULA_STR = { "=", "-", "+", "@" }; + /** * Excel sheet鏈�澶ц鏁帮紝榛樿65536 */ @@ -431,7 +433,7 @@ * @return 缁撴灉 * @throws IOException */ - public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)throws IOException + public void exportExcel(HttpServletResponse response, List<T> list, String sheetName) { exportExcel(response, list, sheetName, StringUtils.EMPTY); } @@ -446,12 +448,12 @@ * @return 缁撴灉 * @throws IOException */ - public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) throws IOException + public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) { response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); response.setCharacterEncoding("utf-8"); this.init(list, sheetName, title, Type.EXPORT); - exportExcel(response.getOutputStream()); + exportExcel(response); } /** @@ -484,7 +486,7 @@ * @param sheetName 宸ヤ綔琛ㄧ殑鍚嶇О * @return 缁撴灉 */ - public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException + public void importTemplateExcel(HttpServletResponse response, String sheetName) { importTemplateExcel(response, sheetName, StringUtils.EMPTY); } @@ -496,12 +498,12 @@ * @param title 鏍囬 * @return 缁撴灉 */ - public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) throws IOException + public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) { response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); response.setCharacterEncoding("utf-8"); this.init(null, sheetName, title, Type.IMPORT); - exportExcel(response.getOutputStream()); + exportExcel(response); } /** @@ -509,12 +511,12 @@ * * @return 缁撴灉 */ - public void exportExcel(OutputStream out) + public void exportExcel(HttpServletResponse response) { try { writeSheet(); - wb.write(out); + wb.write(response.getOutputStream()); } catch (Exception e) { @@ -523,7 +525,6 @@ finally { IOUtils.closeQuietly(wb); - IOUtils.closeQuietly(out); } } @@ -711,7 +712,13 @@ { if (ColumnType.STRING == attr.cellType()) { - cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix()); + String cellValue = Convert.toStr(value); + // 瀵逛簬浠讳綍浠ヨ〃杈惧紡瑙﹀彂瀛楃 =-+@寮�澶寸殑鍗曞厓鏍硷紝鐩存帴浣跨敤tab瀛楃浣滀负鍓嶇紑锛岄槻姝SV娉ㄥ叆銆� + if (StringUtils.containsAny(cellValue, FORMULA_STR)) + { + cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" }); + } + cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix()); } else if (ColumnType.NUMERIC == attr.cellType()) { -- Gitblit v1.9.3