github
/
jeecg-boot
mirror of https://github.com/jeecgboot/jeecg-boot
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

解决doMultiFieldsOrder() 多字段排序方法存在问题，没有读取 MybatisPlus 注解 @TableField 里 value 的值。

pull/4164/head
zhangdaiscott 2022-10-10 11:18:34 +08:00
parent 3580f50b07
commit 3e146061dd
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
jeecg-boot-base-core/src/main/java/org/jeecg/common/system/query/QueryGenerator.java
View File

@ -193,7 +193,7 @@ public class QueryGenerator {
} }
} }
// 排序逻辑 处理 // 排序逻辑 处理
doMultiFieldsOrder(queryWrapper, parameterMap, fieldColumnMap.keySet()); doMultiFieldsOrder(queryWrapper, parameterMap, fieldColumnMap);
//高级查询 //高级查询
doSuperQuery(queryWrapper, parameterMap, fieldColumnMap); doSuperQuery(queryWrapper, parameterMap, fieldColumnMap);
@ -229,7 +229,8 @@ public class QueryGenerator {
} }
} }
private static void doMultiFieldsOrder(QueryWrapper<?> queryWrapper,Map<String, String[]> parameterMap, Set<String> allFields) { private static void doMultiFieldsOrder(QueryWrapper<?> queryWrapper,Map<String, String[]> parameterMap, Map<String,String> fieldColumnMap) {
Set<String> allFields = fieldColumnMap.keySet();
String column=null,order=null; String column=null,order=null;
if(parameterMap!=null&& parameterMap.containsKey(ORDER_COLUMN)) { if(parameterMap!=null&& parameterMap.containsKey(ORDER_COLUMN)) {
column = parameterMap.get(ORDER_COLUMN)[0]; column = parameterMap.get(ORDER_COLUMN)[0];
@ -252,6 +253,19 @@ public class QueryGenerator {
} }
//update-end-author:taoyan date:2022-5-16 for: issues/3676 获取系统用户列表时，使用SQL注入生效 //update-end-author:taoyan date:2022-5-16 for: issues/3676 获取系统用户列表时，使用SQL注入生效
//update-begin-author:scott date:2022-10-10 for:【jeecg-boot/issues/I5FJU6】doMultiFieldsOrder() 多字段排序方法存在问题
//多字段排序方法没有读取 MybatisPlus 注解 @TableField 里 value 的值
if (column.contains(",")) {
List<String> columnList = Arrays.asList(column.split(","));
String columnStrNew = columnList.stream().map(c -> fieldColumnMap.get(c)).collect(Collectors.joining(","));
if (oConvertUtils.isNotEmpty(columnStrNew)) {
column = columnStrNew;
}
}else{
column = fieldColumnMap.get(column);
}
//update-end-author:scott date:2022-10-10 for:【jeecg-boot/issues/I5FJU6】doMultiFieldsOrder() 多字段排序方法存在问题
//SQL注入check //SQL注入check
SqlInjectionUtil.filterContent(column); SqlInjectionUtil.filterContent(column);