修复漏洞，重构初始化功能，优化媒体库 (#1024)

* 媒体库增加 普通上传、压缩上传按钮，方便媒体库直接上传图片

* 增加数据类型切换后的的校验，避免使用错误的查询条件和字典条件。

* refactor: 重构初始化逻辑

* 媒体库功能丰富

* 修复注入漏洞和路径穿越

* 修复自动化接口获取数据库表失败后未能终止的bug

* 微调媒体库样式

Co-authored-by: bypanghu <bypanghu@163.com>
Co-authored-by: tesun <36953434+tesun@users.noreply.github.com>
Co-authored-by: pnck <hio131@gmail.com>
Co-authored-by: task <121913992@qq.com>

server/source/system/user.go

@@ -1,35 +1,79 @@
 package system
 
 import (
+	"context"
 	"github.com/flipped-aurora/gin-vue-admin/server/global"
-	"github.com/flipped-aurora/gin-vue-admin/server/model/system"
+	sysModel "github.com/flipped-aurora/gin-vue-admin/server/model/system"
+	"github.com/flipped-aurora/gin-vue-admin/server/service/system"
 	"github.com/pkg/errors"
 	uuid "github.com/satori/go.uuid"
 	"gorm.io/gorm"
 )
 
-var User = new(user)
+const initOrderUser = initOrderAuthority + 1
 
-type user struct{}
+type initUser struct{}
 
-func (u *user) TableName() string {
-	return "sys_users"
+// auto run
+func init() {
+	system.RegisterInit(initOrderUser, &initUser{})
 }
 
-func (u *user) Initialize() error {
-	entities := []system.SysUser{
+func (i *initUser) MigrateTable(ctx context.Context) (context.Context, error) {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return ctx, system.ErrMissingDBContext
+	}
+	return ctx, db.AutoMigrate(&sysModel.SysUser{})
+}
+
+func (i *initUser) TableCreated(ctx context.Context) bool {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return false
+	}
+	return db.Migrator().HasTable(&sysModel.SysUser{})
+}
+
+func (i initUser) InitializerName() string {
+	return sysModel.SysUser{}.TableName()
+}
+
+func (i *initUser) InitializeData(ctx context.Context) (next context.Context, err error) {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
+		return ctx, system.ErrMissingDBContext
+	}
+	entities := []sysModel.SysUser{
 		{UUID: uuid.NewV4(), Username: "admin", Password: "e10adc3949ba59abbe56e057f20f883e", NickName: "超级管理员", HeaderImg: "https://qmplusimg.henrongyi.top/gva_header.jpg", AuthorityId: "888", Phone: "17611111111", Email: "333333333@qq.com"},
 		{UUID: uuid.NewV4(), Username: "a303176530", Password: "3ec063004a6f31642261936a379fde3d", NickName: "QMPlusUser", HeaderImg: "https:///qmplusimg.henrongyi.top/1572075907logo.png", AuthorityId: "9528", Phone: "17611111111", Email: "333333333@qq.com"},
 	}
-	if err := global.GVA_DB.Create(&entities).Error; err != nil {
-		return errors.Wrap(err, u.TableName()+"表数据初始化失败!")
+	if err = global.GVA_DB.Create(&entities).Error; err != nil {
+		return ctx, errors.Wrap(err, sysModel.SysUser{}.TableName()+"表数据初始化失败!")
 	}
-	return nil
+	next = context.WithValue(ctx, i.InitializerName(), entities)
+	authorityEntities, ok := ctx.Value(initAuthority{}.InitializerName()).([]sysModel.SysAuthority)
+	if !ok {
+		return next, errors.Wrap(system.ErrMissingDependentContext, "创建 [用户-权限] 关联失败, 未找到权限表初始化数据")
+	}
+	if err = db.Model(&entities[0]).Association("Authorities").Replace(authorityEntities); err != nil {
+		return next, err
+	}
+	if err = db.Model(&entities[1]).Association("Authorities").Replace(authorityEntities[:1]); err != nil {
+		return next, err
+	}
+	return next, err
 }
 
-func (u *user) CheckDataExist() bool {
-	if errors.Is(global.GVA_DB.Where("username = ?", "a303176530").First(&system.SysUser{}).Error, gorm.ErrRecordNotFound) { // 判断是否存在数据
+func (i *initUser) DataInserted(ctx context.Context) bool {
+	db, ok := ctx.Value("db").(*gorm.DB)
+	if !ok {
 		return false
 	}
-	return true
+	var record sysModel.SysUser
+	if errors.Is(db.Where("username = ?", "a303176530").
+		Preload("Authorities").First(&record).Error, gorm.ErrRecordNotFound) { // 判断是否存在数据
+		return false
+	}
+	return len(record.Authorities) > 0 && record.Authorities[0].AuthorityId == "888"
 }