|
|
|
@ -193,7 +193,7 @@ public class QueryGenerator {
|
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
// 排序逻辑 处理
|
|
|
|
|
doMultiFieldsOrder(queryWrapper, parameterMap, fieldColumnMap.keySet()); |
|
|
|
|
doMultiFieldsOrder(queryWrapper, parameterMap, fieldColumnMap); |
|
|
|
|
|
|
|
|
|
//高级查询
|
|
|
|
|
doSuperQuery(queryWrapper, parameterMap, fieldColumnMap); |
|
|
|
@ -229,7 +229,8 @@ public class QueryGenerator {
|
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
private static void doMultiFieldsOrder(QueryWrapper<?> queryWrapper,Map<String, String[]> parameterMap, Set<String> allFields) { |
|
|
|
|
private static void doMultiFieldsOrder(QueryWrapper<?> queryWrapper,Map<String, String[]> parameterMap, Map<String,String> fieldColumnMap) { |
|
|
|
|
Set<String> allFields = fieldColumnMap.keySet(); |
|
|
|
|
String column=null,order=null; |
|
|
|
|
if(parameterMap!=null&& parameterMap.containsKey(ORDER_COLUMN)) { |
|
|
|
|
column = parameterMap.get(ORDER_COLUMN)[0]; |
|
|
|
@ -252,6 +253,19 @@ public class QueryGenerator {
|
|
|
|
|
} |
|
|
|
|
//update-end-author:taoyan date:2022-5-16 for: issues/3676 获取系统用户列表时,使用SQL注入生效
|
|
|
|
|
|
|
|
|
|
//update-begin-author:scott date:2022-10-10 for:【jeecg-boot/issues/I5FJU6】doMultiFieldsOrder() 多字段排序方法存在问题
|
|
|
|
|
//多字段排序方法没有读取 MybatisPlus 注解 @TableField 里 value 的值
|
|
|
|
|
if (column.contains(",")) { |
|
|
|
|
List<String> columnList = Arrays.asList(column.split(",")); |
|
|
|
|
String columnStrNew = columnList.stream().map(c -> fieldColumnMap.get(c)).collect(Collectors.joining(",")); |
|
|
|
|
if (oConvertUtils.isNotEmpty(columnStrNew)) { |
|
|
|
|
column = columnStrNew; |
|
|
|
|
} |
|
|
|
|
}else{ |
|
|
|
|
column = fieldColumnMap.get(column); |
|
|
|
|
} |
|
|
|
|
//update-end-author:scott date:2022-10-10 for:【jeecg-boot/issues/I5FJU6】doMultiFieldsOrder() 多字段排序方法存在问题
|
|
|
|
|
|
|
|
|
|
//SQL注入check
|
|
|
|
|
SqlInjectionUtil.filterContent(column); |
|
|
|
|
|
|
|
|
|