update

physical-module-system/physical-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java

@@ -24,6 +24,8 @@ import org.springframework.web.servlet.ModelAndView;
 
 import java.io.*;
 import java.net.URLDecoder;
+import java.util.ArrayList;
+import java.util.List;
 
 /**
  * <p>
@@ -85,6 +87,42 @@ public class CommonController {
         response.sendRedirect(objectUrl);
     }
 
+    @PostMapping("/batchUpload")
+    public Result<?> uploadFiles(@RequestParam("files") MultipartFile[] files, MultipartHttpServletRequest request) {
+        Result<List<OssFile>> result = new Result<>();
+        String savePath = "";
+        String bizPath = request.getParameter("biz");
+
+        //LOWCOD-2580 sys/common/upload接口存在任意文件上传漏洞
+        if (oConvertUtils.isNotEmpty(bizPath)) {
+            if (bizPath.contains(SymbolConstant.SPOT_SINGLE_SLASH) || bizPath.contains(SymbolConstant.SPOT_DOUBLE_BACKSLASH)) {
+                throw new JeecgBootException("上传目录bizPath，格式非法！");
+            }
+        }
+        List<OssFile> ossFileList = new ArrayList<>();
+        for (MultipartFile file : files) {
+            try {
+                savePath = CommonUtils.upload(file, bizPath, uploadType);
+                OssFile ossFile = new OssFile();
+                ossFile.setFileName(file.getOriginalFilename());
+                ossFile.setUrl(savePath);
+                ossFileService.save(ossFile);
+                ossFileList.add(ossFile);
+            } catch (Exception e) {
+                return result;
+            }
+        }
+        result.setResult(ossFileList);
+        if (oConvertUtils.isNotEmpty(ossFileList)) {
+            result.setMessage("上传成功！");
+            result.setSuccess(true);
+        } else {
+            result.setMessage("上传失败！");
+            result.setSuccess(false);
+        }
+        return result;
+    }
+
     /**
      * 文件上传统一方法
      *