update

Dockerfile

@@ -16,7 +16,10 @@ RUN --mount=type=cache,target=/root/.m2 mvn package -DskipTests=true clean insta
 
 
 #FROM bellsoft/liberica-openjdk-debian:17
-FROM registry.cn-shanghai.aliyuncs.com/physical/liberica-openjdk-debian:17
+#FROM registry.cn-shanghai.aliyuncs.com/physical/liberica-openjdk-debian:17
+
+#FROM bellsoft/liberica-openjdk-alpine:17
+FROM registry.cn-shanghai.aliyuncs.com/physical/liberica-openjdk-alpine:17
 
 RUN ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
 WORKDIR /app

physical-launcher/src/main/resources/application-dev.yml

@@ -166,8 +166,8 @@ spring:
           slow-sql-millis: 5000
       datasource:
         master:
-          url: jdbc:mysql://127.0.0.1:3306/physical-boot?characterEncoding=UTF-8&useUnicode=true&useSSL=false&tinyInt1isBit=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Shanghai
+#          url: jdbc:mysql://127.0.0.1:3306/physical-boot?characterEncoding=UTF-8&useUnicode=true&useSSL=false&tinyInt1isBit=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Shanghai
-#          url: jdbc:mysql://192.168.50.100:23306/physical-boot?characterEncoding=UTF-8&useUnicode=true&useSSL=false&tinyInt1isBit=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Shanghai
+          url: jdbc:mysql://47.102.126.67:23306/physical-boot?characterEncoding=UTF-8&useUnicode=true&useSSL=false&tinyInt1isBit=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Shanghai
           username: root
           password: 123456
           driver-class-name: com.mysql.cj.jdbc.Driver
@@ -230,7 +230,7 @@ jeecg:
     #webapp文件路径
     webapp: /opt/webapp
   shiro:
-    excludeUrls: /library/documentLibrary/home,/database/experimentDoc/**,/sys/common/upload,/sys/common/download,/sys/user/**,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**
+    excludeUrls: /library/documentLibrary/home,/database/experimentDoc/**,/sys/common/upload,/sys/common/batchUpload,/sys/common/download,/sys/user/**,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**
   #阿里云oss存储和大鱼短信秘钥配置
   oss:
     accessKey: ??
@@ -239,8 +239,8 @@ jeecg:
     bucketName: jeecgdev
   # minio文件上传
   minio:
-    minio_url: http://192.168.50.100:29000
+    minio_url: http://47.102.126.67:29000
-    minio_public_url: http://58.215.212.230:8005/oss/
+    minio_public_url: http://47.102.126.67/oss/
     minio_name: root
     minio_pass: 12345678
     bucketName: physical
@@ -276,9 +276,9 @@ knife4j:
   #开启生产环境屏蔽
   production: false
   basic:
-    enable: false
+    enable: true
-    username: jeecg
+    username: admin
-    password: jeecg1314
+    password: admin!@#123
 #第三方登录
 justauth:
   enabled: false

physical-launcher/src/main/resources/application-prod.yml

@@ -50,8 +50,8 @@ spring:
     clean-disabled: true
   servlet:
     multipart:
-      max-file-size: 10MB
+      max-file-size: 200MB
-      max-request-size: 10MB
+      max-request-size: 200MB
   mail:
     host: smtp.163.com
     username: jeecgos@163.com
@@ -231,7 +231,7 @@ jeecg:
     #webapp文件路径
     webapp: /opt/jeecg-boot/webapp
   shiro:
-    excludeUrls: /sys/common/upload,/sys/common/download,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**,/api/getUserInfo,/api/sys/common/**,/sys/common/**
+    excludeUrls: /sys/common/upload,/sys/common/batchUpload,/sys/common/download,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**,/api/getUserInfo,/api/sys/common/**,/sys/common/**
   #阿里云oss存储和大鱼短信秘钥配置
   oss:
     accessKey: ??

physical-launcher/src/main/resources/application-release.yml

@@ -50,8 +50,8 @@ spring:
     clean-disabled: true
   servlet:
     multipart:
-      max-file-size: 10MB
+      max-file-size: 200MB
-      max-request-size: 10MB
+      max-request-size: 200MB
   mail:
     host: smtp.163.com
     username: jeecgos@163.com
@@ -231,7 +231,7 @@ jeecg:
     #webapp文件路径
     webapp: /opt/jeecg-boot/webapp
   shiro:
-    excludeUrls: /sys/common/upload,/sys/common/download,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**,/api/getUserInfo,/api/sys/common/**,/sys/common/**
+    excludeUrls: /sys/common/upload,/sys/common/batchUpload,/sys/common/download,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**,/api/getUserInfo,/api/sys/common/**,/sys/common/**
   #阿里云oss存储和大鱼短信秘钥配置
   oss:
     accessKey: ??

physical-launcher/src/main/resources/application-test.yml

@@ -50,8 +50,8 @@ spring:
     clean-disabled: true
   servlet:
     multipart:
-      max-file-size: 10MB
+      max-file-size: 200MB
-      max-request-size: 10MB
+      max-request-size: 200MB
   mail:
     host: smtp.163.com
     username: jeecgos@163.com
@@ -231,7 +231,7 @@ jeecg:
     #webapp文件路径
     webapp: /opt/jeecg-boot/webapp
   shiro:
-    excludeUrls: /sys/common/upload,/sys/common/download,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**,/api/getUserInfo,/api/sys/common/**,/sys/common/**
+    excludeUrls: /sys/common/upload,/sys/common/batchUpload,/sys/common/download,/test/jeecgDemo/demo3,/test/jeecgDemo/redisDemo/**,/bigscreen/category/**,/bigscreen/visual/**,/bigscreen/map/**,/jmreport/bigscreen2/**,/api/getUserInfo,/api/sys/common/**,/sys/common/**
   #阿里云oss存储和大鱼短信秘钥配置
   oss:
     accessKey: ??

physical-module-system/physical-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java

@@ -24,6 +24,8 @@ import org.springframework.web.servlet.ModelAndView;
 
 import java.io.*;
 import java.net.URLDecoder;
+import java.util.ArrayList;
+import java.util.List;
 
 /**
  * <p>
@@ -85,6 +87,42 @@ public class CommonController {
         response.sendRedirect(objectUrl);
     }
 
+    @PostMapping("/batchUpload")
+    public Result<?> uploadFiles(@RequestParam("files") MultipartFile[] files, MultipartHttpServletRequest request) {
+        Result<List<OssFile>> result = new Result<>();
+        String savePath = "";
+        String bizPath = request.getParameter("biz");
+
+        //LOWCOD-2580 sys/common/upload接口存在任意文件上传漏洞
+        if (oConvertUtils.isNotEmpty(bizPath)) {
+            if (bizPath.contains(SymbolConstant.SPOT_SINGLE_SLASH) || bizPath.contains(SymbolConstant.SPOT_DOUBLE_BACKSLASH)) {
+                throw new JeecgBootException("上传目录bizPath，格式非法！");
+            }
+        }
+        List<OssFile> ossFileList = new ArrayList<>();
+        for (MultipartFile file : files) {
+            try {
+                savePath = CommonUtils.upload(file, bizPath, uploadType);
+                OssFile ossFile = new OssFile();
+                ossFile.setFileName(file.getOriginalFilename());
+                ossFile.setUrl(savePath);
+                ossFileService.save(ossFile);
+                ossFileList.add(ossFile);
+            } catch (Exception e) {
+                return result;
+            }
+        }
+        result.setResult(ossFileList);
+        if (oConvertUtils.isNotEmpty(ossFileList)) {
+            result.setMessage("上传成功！");
+            result.setSuccess(true);
+        } else {
+            result.setMessage("上传失败！");
+            result.setSuccess(false);
+        }
+        return result;
+    }
+
     /**
      * 文件上传统一方法
      *