test/MeterSphere
1
0
Fork 0
mirror of https://gitee.com/fit2cloud-feizhiyun/MeterSphere.git synced 2024-12-02 20:19:16 +08:00
Code Issues Actions 18 Packages Projects Releases Wiki Activity

refactor(接口测试): 验证非同项目下的文件不允许下载

Browse Source
This commit is contained in:
fit2-zhao 2024-05-09 16:55:02 +08:00 committed by Craftsman
parent 89f184b5a6
commit 4f97fd5428
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
backend/services/api-test/src/main/java/io/metersphere/api/controller/ApiTestController.java
View File

@ -14,10 +14,12 @@ import io.metersphere.sdk.dto.api.task.TaskRequestDTO;
import io.metersphere.system.domain.TestResourcePool;
import io.metersphere.system.dto.ProtocolDTO;
import io.metersphere.system.security.CheckOwner;
import io.metersphere.system.utils.SessionUtils;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.annotation.Resource;
import jakarta.servlet.http.HttpServletResponse;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.validation.annotation.Validated;
@ -143,6 +145,10 @@ public class ApiTestController {
PermissionConstants.PROJECT_API_REPORT_READ,
}, logical = Logical.OR)
public void download(@RequestBody TextNode path, HttpServletResponse response) throws Exception {
// 不属于当前项目的文件不允许下载
if (!StringUtils.contains(path.asText(), SessionUtils.getCurrentProjectId())) {
return;
}
apiTestService.download(path.asText(), response);
}
}