增加了文件上传校验,非规则文件不会成功上传

app.py

@@ -155,11 +155,24 @@ def upload_file():
     if request.method == 'POST':
         try:
             f = request.files['file']
+            # print(f)
             # print(request.files)
             filename = secure_filename(f.filename)
-            savePath = f'js/{filename}'
+            print(f'推荐安全文件命名:{filename}')
+            # savePath = f'js/{filename}'
+            savePath = f'js/{f.filename}'
+            # print(savePath)
             if os.path.exists(savePath):
                 return jsonify(error.failed(f'上传失败,文件已存在,请先查看删除再试'))
+            with open('js/模板.js', encoding='utf-8') as f2:
+                before = f2.read()
+            upcode = f.stream.read().decode('utf-8')
+            check_to_run = before + upcode
+            # print(check_to_run)
+            try:
+                js2py.eval_js(check_to_run)
+            except:
+                return jsonify(error.failed('文件上传失败,检测到上传的文件不是drpy框架支持的源代码'))
             # print(savePath)
             f.save(savePath)
             return jsonify(error.success('文件上传成功'))

templates/admin.html

@@ -82,12 +82,17 @@
             console.log(file_data);
             if(!file_data){
                 alert('文件必选');
-                return
+                return false
+            }
+            var name = file_data.name;
+            if(!name.endsWith('.js')){
+                alert('仅支持上传js文件');
+                return false
             }
             var form_data = new FormData();
             // 把所有表单信息
             form_data.append("id", "001");
-            form_data.append("name", file_data.name);
+            form_data.append("name", name);
             form_data.append("file", file_data);
             $.ajax({
                 type: "POST",
@@ -117,7 +122,8 @@
 <h2 class="title">欢迎使用py_dr管理员界面</h2><h4><a href="/index">返回首页</a></h4>
 <p>你可以在此页面在线上传规则文件到js目录或者删除js目录的文件</p>
  <form action = "/upload" method = "POST" enctype = "multipart/form-data">
-     <input type = "file" name = "file" class="btn" accept=".js"  onchange="getFileSize(this)"/>
+<!--     <input type = "file" name = "file" class="btn" accept=".js"  onchange="getFileSize(this)"/>-->
+     <input type = "file" name = "file" class="btn" onchange="getFileSize(this)"/>
 <!--     <input type = "submit" value="上传" class="btn"/>-->
      <input type="button" id="upload" value="上传" class="btn"/>
 </form>