文件下载

// DownloadController.java
package com.feixiang.web;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.InputStreamResource;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;

import javax.servlet.http.HttpSession;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

@Controller
@RequestMapping("/downloads")
public class DownloadController {

    @Autowired
    private AuditLogService auditLogService;

    @Autowired
    private UserService userService;

    private static final String REPORT_DIR = "src/main/resources/reports/";

    /**
     * 下载考勤报表
     * URL: GET /downloads/reports/{filename}
     */
    @GetMapping("/reports/{filename:.+}")
    public ResponseEntity<InputStreamResource> downloadReport(
            @PathVariable String filename,
            HttpSession session) throws IOException {

        // 1. 权限校验：检查用户是否登录且属于 HR 部门
        User currentUser = (User) session.getAttribute("currentUser");
        if (currentUser == null) {
            return ResponseEntity.status(401).build();  // 未登录
        }
        if (!"HR".equals(currentUser.getDept())) {
            return ResponseEntity.status(403).build();  // 无权限
        }

        // 2. 构造文件路径（注意：实际项目中应使用配置的路径，避免目录遍历攻击）
        File file = new File(REPORT_DIR + filename);
        if (!file.exists()) {
            return ResponseEntity.notFound().build();  // 文件不存在
        }

        // 3. 记录审计日志
        auditLogService.record(currentUser.getId(), "DOWNLOAD_REPORT", filename);

        // 4. 读取文件流
        InputStreamResource resource = new InputStreamResource(new FileInputStream(file));

        // 5. 处理中文文件名乱码
        String encodedFilename = encodeFilename(filename);

        // 6. 构建响应头
        HttpHeaders headers = new HttpHeaders();
        headers.add(HttpHeaders.CONTENT_DISPOSITION, 
                "attachment; filename=\"" + encodedFilename + "\"");
        headers.add(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, must-revalidate");
        headers.add(HttpHeaders.PRAGMA, "no-cache");
        headers.add(HttpHeaders.EXPIRES, "0");

        // 7. 返回 ResponseEntity
        return ResponseEntity.ok()
                .headers(headers)
                .contentLength(file.length())
                .contentType(MediaType.APPLICATION_OCTET_STREAM)
                .body(resource);
    }

    /**
     * 中文文件名编码处理
     * 兼容 IE、Chrome、Firefox、Safari
     */
    private String encodeFilename(String filename) throws UnsupportedEncodingException {
        // 现代浏览器（Chrome、Firefox、Edge）使用 UTF-8 编码
        return URLEncoder.encode(filename, StandardCharsets.UTF_8.toString())
                .replace("+", "%20");  // 空格编码修正
    }
}

@GetMapping("/download")
public String download(String filename) {
    // ❌ 错误：直接返回真实文件路径，暴露服务器目录结构
    return "redirect:/uploads/" + filename;
}

// 校验文件名，禁止路径穿越字符
if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
    throw new IllegalArgumentException("非法文件名");
}

headers.add("Content-Disposition", "attachment; filename=\"2024年3月报表.xlsx\"");
// ❌ 未编码的中文文件名在 IE 中会乱码

private String encodeFilename(String filename, String userAgent) throws UnsupportedEncodingException {
    if (userAgent.contains("MSIE") || userAgent.contains("Trident")) {
        // IE 浏览器使用 UTF-8 URL 编码
        return URLEncoder.encode(filename, "UTF-8").replace("+", "%20");
    } else {
        // 现代浏览器使用 RFC 5987 编码
        return new String(filename.getBytes("UTF-8"), "ISO-8859-1");
    }
}

import org.springframework.http.ContentDisposition;

ContentDisposition disposition = ContentDisposition.attachment()
        .filename("2024年3月报表.xlsx", StandardCharsets.UTF_8)
        .build();
headers.setContentDisposition(disposition);

// 强制下载
ContentDisposition.attachment().filename("report.pdf").build();

// 浏览器内预览
ContentDisposition.inline().filename("report.pdf").build();