|
|
@@ -1,3 +1,4 @@
|
|
|
+using Masuit.Tools.Files.FileDetector;
|
|
|
using OnceMi.AspNetCore.OSS;
|
|
|
|
|
|
namespace Admin.NET.Core.Service;
|
|
|
@@ -209,8 +210,22 @@ public class SysFileService : IDynamicApiController, ITransient
|
|
|
var filePath = Path.Combine(App.WebHostEnvironment.WebRootPath, path);
|
|
|
if (!Directory.Exists(filePath))
|
|
|
Directory.CreateDirectory(filePath);
|
|
|
- using var stream = File.Create(Path.Combine(filePath, finalName));
|
|
|
+
|
|
|
+ var realFile = Path.Combine(filePath, finalName);
|
|
|
+ await using var stream = File.Create(realFile);
|
|
|
await file.CopyToAsync(stream);
|
|
|
+ var detector = stream.DetectFiletype();
|
|
|
+ var realExt = detector.Extension;//真实扩展名
|
|
|
+
|
|
|
+ // 二次校验扩展名
|
|
|
+ if (!string.Equals(realExt, suffix.Replace(".", ""), StringComparison.OrdinalIgnoreCase))
|
|
|
+ {
|
|
|
+ var delFilePath = Path.Combine(App.WebHostEnvironment.WebRootPath, realFile);
|
|
|
+ if (File.Exists(delFilePath))
|
|
|
+ File.Delete(delFilePath);
|
|
|
+ throw Oops.Oh(ErrorCodeEnum.D8001);
|
|
|
+ }
|
|
|
+
|
|
|
//生成外链
|
|
|
newFile.Url = _commonService.GetFileUrl(newFile);
|
|
|
}
|
syxdevcode