商品详情转义

mp-admin/src/main/java/com/qs/mp/web/controller/api/admin/GoodsMgrController.java

@@ -30,6 +30,7 @@ import com.qs.mp.common.core.page.TableDataInfo;
 import com.qs.mp.common.enums.ChannelRoleEnum;
 import com.qs.mp.common.enums.CouponStatusEnum;
 import com.qs.mp.common.enums.ErrorCodeEnum;
+import com.qs.mp.common.enums.GoodsStatusEnum;
 import com.qs.mp.common.utils.html.EscapeUtil;
 import com.qs.mp.system.domain.SysUser;
 import com.qs.mp.system.service.ISysUserService;
@@ -41,6 +42,7 @@ import ma.glasnost.orika.MapperFacade;
 
 import java.math.BigDecimal;
 import java.net.URI;
+import java.net.URLDecoder;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
@@ -161,8 +163,9 @@ public class GoodsMgrController extends BaseApiController {
 		if(titleCount > 0) {
 			return AjaxResult.error("商品名称" + goods.getTitle() + "已存在！");
 		}
-		String description = EscapeUtil.unescape(goodsParam.getDescription());
+		String description = URLDecoder.decode(goodsParam.getDescription());
 		goods.setDescription(description);
+		goods.setStatus(GoodsStatusEnum.PUT_INIT);
 		// 多SKU
 		List<GoodsSku> skuList = goodsParam.getSkuList();
 		if(goods.getMultiSku() == 1) { // 
@@ -251,9 +254,9 @@ public class GoodsMgrController extends BaseApiController {
 	@PostMapping("/status")
 	public AjaxResult goodsStatus(@RequestBody Goods goods) {
 		String goodsId = (null != goods && StringUtils.isNotBlank(goods.getGoodsId()))?goods.getGoodsId():"";
-		String status = (null != goods && StringUtils.isNotBlank(goods.getStatus()))?goods.getStatus():"";
+		GoodsStatusEnum status = (null != goods && null != goods.getStatus())?goods.getStatus():null;
 		if (StringUtils.isBlank(goodsId)
-				|| StringUtils.isBlank(status)) {
+				|| null == status) {
 			return error(ErrorCodeEnum.ERROR_CODE_1001);
 		}
 		try {

mp-common/src/main/java/com/qs/mp/common/utils/html/EscapeUtil.java

@@ -144,7 +144,7 @@ public class EscapeUtil
 
     public static void main(String[] args)
     {
-        String html = "<script>中文alert(1);</script>";
+        String html = "<script>alert(1);</script>";
         // String html = "<scr<script>ipt>alert(\"XSS\")</scr<script>ipt>";
         // String html = "<123";
         // String html = "123>";

mp-service/src/main/java/com/qs/mp/admin/domain/Goods.java

@@ -7,6 +7,8 @@ import com.baomidou.mybatisplus.annotation.TableField;
 import com.baomidou.mybatisplus.annotation.TableId;
 import com.baomidou.mybatisplus.annotation.TableLogic;
 import com.baomidou.mybatisplus.annotation.TableName;
+import com.qs.mp.common.enums.GoodsStatusEnum;
+
 import java.io.Serializable;
 import java.util.Date;
 import lombok.Data;
@@ -106,7 +108,7 @@ public class Goods implements Serializable {
    */
   @TableField("status")
   @JSONField(serialzeFeatures = SerializerFeature.WriteEnumUsingToString)
-  private String status;
+  private GoodsStatusEnum status;
 
   /**
    * 逻辑删除标识