XSS漏洞

+module.exports = function(app) {
+    // 存储装修模板
+    app.post("/shop/sellerDecoratorRest/saveDecoratorTemplate", "sellerDecorator_saveDecoratorTemplate");
+
+    // 更新装修模板
+    app.post("/shop/sellerDecoratorRest/updateDecoratorTemplate", "sellerDecorator_updateDecoratorTemplate");
+
+    //店铺装修保存
+    app.post("/shop/sellerDecoratorRest/saveShopsDecorator","sellerDecorator_saveShopsDecorator");
+}
+

+module.exports = {
+    namespace: "sellerDecorator",
+    apis: {
+        saveDecoratorTemplate: {
+            title: "存储店铺装修模板",
+            url: "/sellerShopsDecoratorRest/saveDecoratorTemplate",
+            params: [
+                {name: "shopId", type: "Number"},
+                {name: "platform", type: "Number"},
+                {name: 'platformType', type: 'Number'},
+                {name: "appType", type: "Number"},
+                {name: "templateName", type: "String"},
+                {name: "templateType", type: "String"},
+                {name: "modules", type: "String"},
+                {name: "flag", type: "Number"}
+            ]
+        },
+
+        updateDecoratorTemplate: {
+            title: "更新店铺模板",
+            url: "/sellerShopsDecoratorRest/updateDecoratorTemplate",
+            params: [
+                {name: "templateId", type: "Number"},
+                {name: "shopId", type: "Number"},
+                {name: "platform", type: "Number"},
+                {name: 'platformType', type: 'Number'},
+                {name: "appType", type: "Number"},
+                {name: "templateName", type: "String"},
+                {name: "modules", type: "String"}
+            ]
+        }
+    }
+}
\ No newline at end of file

@@ -375,7 +375,7 @@ function findTopHotProducts_APP(){
 function saveDecoration(submitStatus){
     console.log(jsonMain);
     common.util.__ajax({
-        url:'/shop/ShopsDecoratorRest/saveShopsDecorator',
+        url:'/shop/sellerDecoratorRest/saveShopsDecorator',
         data: {
             "submitStatus": submitStatus,
             "shopsId": jsonMain.shopsId,

@@ -1871,7 +1871,7 @@ var saveTemplate = function(flag, name, cb) {
     }
 
     common.util.__ajax({
-            url: '/shop/ModularDecoratorRest/saveDecoratorTemplate',
+            url: '/shop/sellerDecoratorRest/saveDecoratorTemplate',
             data: {
                 shopId: Bll.shopId,
                 platform: +t.active ? 0 : 1,
@@ -1974,7 +1974,7 @@ $(document).on('click', '#updateBtn', function() {
     });
 
     common.util.__ajax({
-        url: "/shop/ModularDecoratorRest/updateDecoratorTemplate",
+        url: "/shop/sellerDecoratorRest/updateDecoratorTemplate",
         data: {
             templateId: templateId,
             shopId: Bll.shopId,