我有一個應用程序，我希望用戶能夠上傳和下載自己的文件。我實現了上傳和下載，但是我擔心下載操作的XSS漏洞。我只能使用GET方法實現實際下載的文件，但我想保護它（通常我使用POST +防偽令牌）。我該怎么做？這是我的控制器操作： public ActionResult DownloadFile(int clientFileId) { var clientId = GetClientId(clientFileId); var client = _unitOfWork.Clients.GetById(clientId); if (client == null) return HttpNotFound(); var file = _unitOfWork.ClientFiles.GetById(clientFileId); if (file == null) return HttpNotFound(); var practiceId = _unitOfWork.Users.GetPracticeIdForUser(User.Identity.GetUserId()); if (!AuthorizationHelper.CheckBelongsToPractice(_unitOfWork.Clients, typeof(Client), practiceId, client.Id, nameof(Client.Id), nameof(Client.PracticeId))) { return new HttpUnauthorizedResult(); } var fileInfo = new FileInfo(file.FilePath); var fileName = fileInfo.Name; if (!fileInfo.Exists) return HttpNotFound(); var path = Path.Combine(Server.MapPath("~/ClientFiles/" + clientId + "/"), fileName); var contentType = MimeMapping.GetMimeMapping(path); try { var contentDisposition = new System.Net.Mime.ContentDisposition { FileName = fileName, Inline = false, }; Response.AppendHeader("Content-Disposition", contentDisposition.ToString()); return File(path, contentType, fileName); } catch (Exception ex) { new ExceptionlessLogger(ex).Log(); return new HttpStatusCodeResult(500); } }
1 回答
炎炎設計
TA貢獻1808條經驗 獲得超4個贊
我在這里找到了答案：https://codepen.io/chrisdpratt/pen/RKxJNo
$('#client-files-table').on('click', '.js-download', function () {
var link = $(this);
$.ajax({
url: '/clients/clientfiles/downloadfile?clientFileId=' + link.attr('data-clientfile-id'),
method: 'POST',
data: {
__RequestVerificationToken: getToken()
},
xhrFields: {
responseType: 'blob'
},
success: function (data, status, xhr) {
var a = document.createElement('a');
var url = window.URL.createObjectURL(data);
a.href = url;
var header = xhr.getResponseHeader('Content-Disposition');
var filename = getFileNameByContentDisposition(header);
a.download = filename;
a.click();
window.URL.revokeObjectURL(url);
loadPartials();
},
error: function () {
toastr.error('Unable to download.');
}
});
});
- 1 回答
- 0 關注
- 96 瀏覽
添加回答
舉報
0/150
提交
取消