Files
FastapiAdmin/backend/app/api/v1/module_system/notice/schema.py
T
zhangtao 301572d200 feat(security): 增加XSS防护和文件上传安全校验
添加bleach和dompurify库用于HTML内容过滤
实现文件上传路径校验和类型检测
增强定时任务函数格式验证
修复文件下载路径穿越漏洞
2026-02-18 23:05:51 +08:00

101 lines
3.5 KiB
Python

from fastapi import Query
from pydantic import (
BaseModel,
ConfigDict,
Field,
field_validator,
model_validator,
)
from app.common.enums import QueueEnum
from app.core.base_schema import BaseSchema, UserBySchema
from app.core.validator import DateTimeStr
from app.utils.xss_util import sanitize_html
class NoticeCreateSchema(BaseModel):
"""公告通知创建模型"""
notice_title: str = Field(..., max_length=50, description="公告标题")
notice_type: str = Field(..., description="公告类型(1通知 2公告)")
notice_content: str = Field(..., description="公告内容")
status: str = Field(default="0", description="是否启用(0:启用 1:禁用)")
description: str | None = Field(default=None, max_length=255, description="描述")
@field_validator("notice_type")
@classmethod
def _validate_notice_type(cls, value: str):
if value not in {"1", "2"}:
raise ValueError("公告类型仅支持 '1'(通知) 或 '2'(公告)")
return value
@field_validator("notice_content")
@classmethod
def _sanitize_notice_content(cls, value: str) -> str:
return sanitize_html(value)
@model_validator(mode="after")
def _validate_after(self):
if not self.notice_title.strip():
raise ValueError("公告标题不能为空")
if not self.notice_content.strip():
raise ValueError("公告内容不能为空")
return self
class NoticeUpdateSchema(NoticeCreateSchema):
"""公告通知更新模型"""
class NoticeOutSchema(NoticeCreateSchema, BaseSchema, UserBySchema):
"""公告通知响应模型"""
model_config = ConfigDict(from_attributes=True)
class NoticeQueryParam:
"""公告通知查询参数"""
def __init__(
self,
notice_title: str | None = Query(None, description="公告标题"),
notice_type: str | None = Query(None, description="公告类型"),
description: str | None = Query(None, description="描述"),
status: str | None = Query(None, description="是否启用"),
created_time: list[DateTimeStr] | None = Query(
None,
description="创建时间范围",
examples=["2025-01-01 00:00:00", "2025-12-31 23:59:59"],
),
updated_time: list[DateTimeStr] | None = Query(
None,
description="更新时间范围",
examples=["2025-01-01 00:00:00", "2025-12-31 23:59:59"],
),
created_id: int | None = Query(None, description="创建人"),
updated_id: int | None = Query(None, description="更新人"),
) -> None:
# 模糊查询字段
self.notice_title = (QueueEnum.like.value, notice_title)
# 精确查询字段
self.notice_type = notice_type
# 模糊查询字段
if description:
self.description = (QueueEnum.like.value, description)
# 精确查询字段
if status:
self.status = (QueueEnum.eq.value, status)
# 时间范围查询
if created_time and len(created_time) == 2:
self.created_time = (QueueEnum.between.value, (created_time[0], created_time[1]))
if updated_time and len(updated_time) == 2:
self.updated_time = (QueueEnum.between.value, (updated_time[0], updated_time[1]))
# 关联查询字段
if created_id:
self.created_id = (QueueEnum.eq.value, created_id)
if updated_id:
self.updated_id = (QueueEnum.eq.value, updated_id)