修复漏洞，重构初始化功能，优化媒体库 (#1024)

* 媒体库增加 普通上传、压缩上传按钮，方便媒体库直接上传图片

* 增加数据类型切换后的的校验，避免使用错误的查询条件和字典条件。

* refactor: 重构初始化逻辑

* 媒体库功能丰富

* 修复注入漏洞和路径穿越

* 修复自动化接口获取数据库表失败后未能终止的bug

* 微调媒体库样式

Co-authored-by: bypanghu <bypanghu@163.com>
Co-authored-by: tesun <36953434+tesun@users.noreply.github.com>
Co-authored-by: pnck <hio131@gmail.com>
Co-authored-by: task <121913992@qq.com>

server/source/system/authority.go

@@ -1,34 +1,86 @@
 package system
 
 import (
-	"github.com/flipped-aurora/gin-vue-admin/server/global"
-	"github.com/flipped-aurora/gin-vue-admin/server/model/system"
+	"context"
+	sysModel "github.com/flipped-aurora/gin-vue-admin/server/model/system"
+	"github.com/flipped-aurora/gin-vue-admin/server/service/system"
 	"github.com/pkg/errors"
 	"gorm.io/gorm"
 )
 
-var Authority = new(authority)
+const initOrderAuthority = initOrderCasbin + 1
 
-type authority struct{}
+type initAuthority struct{}
 
-func (a *authority) TableName() string {
-	return "sys_authorities"
+// auto run
+func init() {
+	system.RegisterInit(initOrderAuthority, &initAuthority{})
 }
 
-func (a *authority) Initialize() error {
-	entities := []system.SysAuthority{
+func (i *initAuthority) MigrateTable(ctx context.Context) (context.Context, error) {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return ctx, system.ErrMissingDBContext
+	}
+	return ctx, db.AutoMigrate(&sysModel.SysAuthority{})
+}
+
+func (i *initAuthority) TableCreated(ctx context.Context) bool {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return false
+	}
+	return db.Migrator().HasTable(&sysModel.SysAuthority{})
+}
+
+func (i initAuthority) InitializerName() string {
+	return sysModel.SysAuthority{}.TableName()
+}
+
+func (i *initAuthority) InitializeData(ctx context.Context) (context.Context, error) {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return ctx, system.ErrMissingDBContext
+	}
+	entities := []sysModel.SysAuthority{
 		{AuthorityId: "888", AuthorityName: "普通用户", ParentId: "0", DefaultRouter: "dashboard"},
 		{AuthorityId: "9528", AuthorityName: "测试角色", ParentId: "0", DefaultRouter: "dashboard"},
 		{AuthorityId: "8881", AuthorityName: "普通用户子角色", ParentId: "888", DefaultRouter: "dashboard"},
 	}
-	if err := global.GVA_DB.Create(&entities).Error; err != nil {
-		return errors.Wrapf(err, "%s表数据初始化失败!", a.TableName())
+
+	if err := db.Create(&entities).Error; err != nil {
+		return ctx, errors.Wrapf(err, "%s表数据初始化失败!", sysModel.SysAuthority{}.TableName())
 	}
-	return nil
+	// data authority
+	if err := db.Model(&entities[0]).Association("DataAuthorityId").Replace(
+		[]*sysModel.SysAuthority{
+			{AuthorityId: "888"},
+			{AuthorityId: "9528"},
+			{AuthorityId: "8881"},
+		}); err != nil {
+		return ctx, errors.Wrapf(err, "%s表数据初始化失败!",
+			db.Model(&entities[0]).Association("DataAuthorityId").Relationship.JoinTable.Name)
+	}
+	if err := db.Model(&entities[1]).Association("DataAuthorityId").Replace(
+		[]*sysModel.SysAuthority{
+			{AuthorityId: "9528"},
+			{AuthorityId: "8881"},
+		}); err != nil {
+		return ctx, errors.Wrapf(err, "%s表数据初始化失败!",
+			db.Model(&entities[1]).Association("DataAuthorityId").Relationship.JoinTable.Name)
+	}
+
+	next := context.WithValue(ctx, i.InitializerName(), entities)
+	return next, nil
 }
 
-func (a *authority) CheckDataExist() bool {
-	if errors.Is(global.GVA_DB.Where("authority_id = ?", "8881").First(&system.SysAuthority{}).Error, gorm.ErrRecordNotFound) { // 判断是否存在数据
+func (i *initAuthority) DataInserted(ctx context.Context) bool {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return false
+	}
+	if errors.Is(db.Where("authority_id = ?", "8881").
+		First(&sysModel.SysAuthority{}).Error, gorm.ErrRecordNotFound) { // 判断是否存在数据
 		return false
 	}
 	return true